用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

Log generated by networkedition use mdecoder 0.30
[root]http://companyadc.51job.com/companyads/shanghai/sh/caijing061128/index.files/mm.files/06093.htm
    [exe]http://www.ac66.cn/88/serv.exe

Log generated by networkedition use mdecoder 0.30
[root]http://qhdhouse.inhe.net/showcz.asp?soft_id=102329
    [script]http://qhdhouse.inhe.net/inc/js.js
    [iframe]http://qhdhouse.inhe.net/top.asp
    [iframe]http://qhdhouse.inhe.net/menu.asp
    [script]http://z360.net
        [iframe]http://7o8.net/a.htm
    [script]http://qhdhouse.inhe.net/counter.asp
    [script]http://js.users.51.la/3073883.js

Log generated by networkedition use mdecoder 0.30
[root]http://quacor.zhnews.net/show.php?contentid=1382&visible=7
    [script]http://quacor.zhnews.net/image/swfobject.js
    [script]http://quacor.zhnews.net/image/jquery-1.3.2.min.js
    [script]http://quacor.zhnews.net/image/global.js
        [script]http://ad.googlesyndications.co.cc/data/backup/yx/images.png?rd
            [iframe]http://theflower.9966.org/data/backup/yx/data.htm?12
                [exe]http://qqtvzb.9966.org/data/r1.exe
    [iframe]http://news.zhnews.net/others/quacor-top.html
        [script]http://news.zhnews.net/js/index-top.js
        [script]http://news.zhnews.net/data/js.php?id=128
        [script]http://news.zhnews.net/data/js.php?id=131
        [exe]http://news.zhnews.net/css/basic/980-top.css
    [script]http://www.quacor.com/data/js/195.js
    [script]http://www.quacor.com/data/js/196.js
    [iframe]http://news.zhnews.net/others/quacor-bottom.html
        [script]http://news.zhnews.net/data/js.php?id=129
        [script]http://news.zhnews.net/data/js.php?id=132
        [script]http://news.zhnews.net/js/all-bottom.js
        [exe]http://news.zhnews.net/css/basic/980-top.css

css的确不是exe文件，但那个r1.exe的确是网马呀