1、样本来源及多引擎扫描结果：
样本是从江民论坛得到的。据说江民今天的病毒库不报。我用瑞星今天的病毒库扫——也不报。
Virustotal多引擎扫描报告（只有三家报，但均无肯定结果）：
AntiVir 6.35.1.0 08.08.2006 no virus found
Authentium 4.93.8 08.08.2006 no virus found
Avast 4.7.844.0 08.04.2006 no virus found
AVG 386 08.07.2006 no virus found
BitDefender 7.2 08.08.2006 no virus found
CAT-QuickHeal 8.00 08.07.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 08.08.2006 no virus found
DrWeb 4.33 08.08.2006 no virus found
eTrust-InoculateIT 23.72.89 08.08.2006 no virus found
eTrust-Vet 12.6.2329 08.08.2006 no virus found
Ewido 4.0 08.07.2006 no virus found
Fortinet 2.77.0.0 08.08.2006 Spy/SNIFF
F-Prot 3.16f 08.06.2006 no virus found
F-Prot4 4.2.1.29 08.06.2006 no virus found
Ikarus 0.2.65.0 08.08.2006 no virus found
Kaspersky 4.0.2.24 08.08.2006 no virus found
McAfee 4823 08.07.2006 no virus found
Microsoft 1.1508 08.04.2006 no virus found
NOD32v2 1.1696 08.07.2006 no virus found
Norman 5.90.23 08.07.2006 no virus found
Panda 9.0.0.4 08.07.2006 Suspicious file
Sophos 4.08.0 08.07.2006 no virus found
Symantec 8.0 08.08.2006 no virus found TheHacker 5.9.8.187 08.07.2006 no virus found
UNA 1.83 08.07.2006 no virus found
VBA32 3.11.0 08.07.2006 no virus found
VirusBuster 4.3.7:9 08.07.2006 no virus found
2、在XPSP2系统中运行后释放的文件：
C:\program files\tiny firewall pro\zseqkuqd.dll（此马的狡猾之处在于：这个dll文件名随机，释放的目录不定。第一次运行时，这个dll文件释放到C:\Program Files\Rising\Rav目录下，文件名为asufrjdp.dll）。
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\Packet.dll
C:\WINDOWS\system32\wanpacket.dll
3、进程插入：释放的三个dll全部插入explorer.exe进程。zseqkuqd.dll可能还插入了其它系统进程（用IS强制卸除explorer.exe进程中的zseqkuqd.dll后，这个dll文件依然不能删除。没功夫跟它捣乱。用SSM禁止其加载，重启后，才将zseqkuqd.dll删除）。
4、注册表改动：
（1）在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks分支添加：
"{1A404685-7563-4d02-B0F6-58B308A406A9}"=""
（2）在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop分支添加：
"RXMRU"=hex:00,00,00,00,0c,00,00,00,07,36,07,07,01,00,00,00,0c,00,00,00,07,\
36,07,07,02,00,00,00,0c,00,00,00,07,36,07,07,03,00,00,00,0c,00,\
00,00,07,36,07,07,04,00,00,00,0c,00,00,00,07,36,07,07,05,00,00,\
00,19,00,00,00,07,35,36,3f,29,3f,32,29,36,34,34,29,36,30,30,07,\
07,0c,00,00,00,0e,00,00,00,07,36,37,37,07,7e,08,00,00,00,0c,00,\
00,00,07,35,07,37,07,00,00,00,28,00,00,00,07,6f,73,73,77,3d,28,\
28,35,36,3f,29,3f,32,29,36,34,34,29,36,30,30,28,65,65,65,29,73,\
7f,73,07,07,0a,00,00,00,0c,00,00,00,07,36,07,37,06,00,00,00,10,\
00,00,00,07,31,32,33,34,35,07,68,0b,00,00,00,28,00,00,00,07,6f,\
73,73,77,3d,28,28,35,36,3f,29,3f,32,29,36,34,34,29,36,30,30,28,\
66,66,66,29,66,74,77,07,07,0d,00,00,00,28,00,00,00,07,6f,73,73,\
77,3d,28,28,35,36,3f,29,3f,32,29,36,34,34,29,36,30,30,28,64,64,\
64,29,66,74,77,07,07,ff,ff,ff,ff,0b,00,00,00,07,07,07
（3）在HKEY_CLASSES_ROOT\CLSID\分支添加：
{1A404685-7563-4d02-B0F6-58B308A406A9}
{1A404685-7563-4d02-B0F6-58B308A406A9}\InProcServer32的默认值设置为：
@="c:\\program files\\tiny firewall pro\\zseqkuqd.dll"
（4）在HKLM\System\CurrentControlSet\Services分支添加：
Npf（指向：C:\WINDOWS\system32\drivers\npf.sys）
【附图】：删掉的木马文件
