大砲開講

惡意連結/程式碼是放置在 main.asp (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\system32\clrptm.dll

[Added service]
NAME: yysjstwz
DISPLAY: yysjstwz
FILE: \??\C:\WINDOWS\system32\drivers\clrptm.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\temp003[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\category1_1_1_4_3[1].htm
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
C:\WINDOWS\system32\clrptm.dll
C:\WINDOWS\system32\drivers\clrptm.sys

到目前為止 (2007/11/14 @ 09:00)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

clrptm.dll:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact, Backdoor.Win32.PcClient.bal"
[ Sophos ], "Mal/Behav-024″
[ Nod32 ], "probably a variant of Win32/Genetik trojan"
[ vba32 ], "Trojan-Downloader.Win32.Delf.ain"
[ Sunbelt ], "VIPRE.Suspicious"
[ WebWasher ], "BlockReason.46 (suspicious)"
[ bitdefender ], "Backdoor.Agent.YYF"
clrptm.sys:
[ Alpha_Gen ], "Possible_Rootkit"
[ Kaspersky ], "Rootkit.Win32.Agent.iz"
[ McAfee ], "New Malware.an !!"
[ McAfee_Beta ], "New Malware.an !!"
[ Panda ], "Rootkit/PcClient.FK"
[ Panda_Beta ], "Rootkit/PcClient.FK"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ HBEDV ], "TR/Rootkit.Gen"
[ Rising ], "RootKit.Win32.Agent.nhx"
[ quickheal ], "Rootkit.Agent.iz"
[ WebWasher ], "Trojan.Rootkit.Gen"
temp003[1].jpg:
[ IntelliTrap ], "PAK_Generic.001″
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact, Backdoor.Win32.PcClient.aid"
[ Ikarus ], "Backdoor.Win32.PcClient.yw"
[ vba32 ], "Trojan.Win32.Agent.ckf"
[ Sunbelt ], "VIPRE.Suspicious"
[ WebWasher ], "BlockReason.46 (suspicious)"
[ bitdefender ], "Backdoor.Generic.25313″
category1_1_1_4_3[1].htm:
[ Alpha_Gen ], "Possible_EncScr"
[ Beta_Gen ], "Possible_EncScr"
[ Microsoft ], "[->(SCRIPT0001)]:Worm:VBS/VBSWG.gen"
[ HBEDV ], "HEUR/Exploit.HTML"
[ WebWasher ], "BlockReason.46 (suspicious)"