手動 HIPS 看看這隻。

留侯

文件加了壳，大蜘蛛：
tl.exe probably infected with BACKDOOR.Trojan
tl.exe - archive BINARYRES
tl.exe/data001 packed by XOREXE
tl.exe/data001 packed by UPX
tl.exe/data001 probably infected with MULDROP.Trojan
tl.exe/data001 packed by BINARYRES

这是大蜘蛛启发式分析仪作出的判断，命名中带有“probably”或者“可能”这样的字眼。

qianyuqx

mse kill

左手

2011-10-27 18:56:49    结束其他进程    阻止
进程: c:\documents and settings\administrator\local settings\temp\19.tmp
目标: c:\documents and settings\administrator\桌面\tl.exe
规则: [应用程序]*\temp\*

2011-10-27 18:56:49    删除文件    阻止并结束进程
进程: c:\documents and settings\administrator\local settings\temp\19.tmp
目标: C:\Documents and Settings\Administrator\桌面\tl.exe
规则: [应用程序]* -> [文件组][S]Risk Created

2011-10-27 18:57:45    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\tl.exe
目标: c:\documents and settings\administrator\local settings\temp\1a.tmp
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1A.tmp" "C:\Documents and Settings\Administrator\桌面\tl.exe" "3552"
规则: [应用程序]* -> [子应用程序]*.tmp

2011-10-27 18:57:45    创建新进程    阻止
进程: c:\documents and settings\administrator\local settings\temp\1a.tmp
目标: c:\windows\system32\rundll32.exe
命令行: rundll32 shell32,Control_RunDLL "C:\WINDOWS\java\classes\4b631b0.z"
规则: [应用程序组]【Filter】Block Read -> [应用程序]* -> [子应用程序]c:\windows\system32\rundll32.exe

2011-10-27 18:57:45    结束其他进程    阻止
进程: c:\documents and settings\administrator\local settings\temp\1a.tmp
目标: c:\documents and settings\administrator\桌面\tl.exe
规则: [应用程序]*\temp\*

hx1997

DefenseWall log file

10.27.2011  23:56:36，模块 D:\WINDOWS\system32\rundll32.exe， Attempt to create new file D:\WINDOWS\msaspy.dll (文件 )

10.27.2011  23:56:36，模块 D:\Documents and Settings\~~\Local Settings\Temp\21.tmp， 1:Process is running untrusted now (进程)

10.27.2011  23:56:36，模块 D:\WINDOWS\system32\rundll32.exe， 1:Process is running untrusted now (进程)

10.27.2011  23:56:35，模块 D:\Documents and Settings\~~\桌面\tl.exe， 1:Process is running untrusted now (进程)

xljbxx

EAV 4.2 阻止下载

用户名不存在

Comodo没那么细，MD可以看出是以什么命令行调用的

xljbxx

nis2012 kill

zhousulin5

2011-10-28 15:40:28    创建新进程    允许
进程: d:\specimen\tl.exe
目标: c:\documents and settings\user\local settings\temp\9.tmp
命令行: "C:\DOCUME~1\user\LOCALS~1\Temp\9.tmp" "D:\specimen\tl.exe" "228"
规则: [应用程序]?:\*\* -> [子应用程序]?:\*\temp\*.tmp

2011-10-28 15:40:28    创建文件    允许
进程: c:\documents and settings\user\local settings\temp\9.tmp
目标: C:\WINDOWS\java\classes\a515e60d.z
规则: [应用程序]c:\documents and settings\user\local settings\temp\?.tmp -> [文件]c:\windows\java\classes; *.z

2011-10-28 15:40:28    修改文件    允许
进程: c:\documents and settings\user\local settings\temp\9.tmp
目标: C:\WINDOWS\java\classes\a515e60d.z
规则: [应用程序]c:\documents and settings\user\local settings\temp\?.tmp -> [文件]c:\windows\java\classes; *.z

2011-10-28 15:40:28    创建新进程    阻止
进程: c:\documents and settings\user\local settings\temp\9.tmp
目标: c:\windows\system32\rundll32.exe
命令行: rundll32 shell32,Control_RunDLL "C:\WINDOWS\java\classes\a515e60d.z"
规则: [应用程序]?:\*\* -> [子应用程序]c:\windows\system32\rundll32.exe

2011-10-28 15:40:28    结束其他进程    阻止
进程: c:\documents and settings\user\local settings\temp\9.tmp
目标: d:\specimen\tl.exe
规则: [应用程序]* -> [目标应用程序]*