請問 rundll32.exe(x64) 大量發送垃圾信 port(25) ? (本檔案經微軟證實沒問題)

請問 rundll32.exe(x64) 大量發送垃圾信 port(25) ? (本檔案經微軟證實沒問題)

C:\Windows\SysWOW64\rundll32.exe

因被 hinet 警告發垃圾信, 於是強鎖 port(25), 發現在某特定一分鐘內(半夜或凌晨),
rundll32.exe(x64) 大量發送垃圾信 port(25), 對象分散世界各地, 數量極為龐大, 上千封, 且呈現不規則 ip,
每天約 1~2 次, 每次僅一分鐘即止, 電腦需數小時未用, 且必須所有帳號登出或鎖定, 才會發生!?


本機概況:

1.全新機安裝約一個月, 所有設備全新, 僅用以股票看盤, 無區網, 無無線, 全家僅此一台電腦!
2.w7-ut x64 + norton360 + ad-aware 皆為原版安裝, 即時防護.
3.以 zyxel 硬體連接上網 (固IP/非pppoe/非撥接)
4.in port 全鎖, 無 dmz, 僅開放少數軟體所需之 port.
5.out port(25) 全鎖, 僅開放上游單一 smtp-IP 於必要時可用, 每一封信防火牆均有發送紀錄.


檢測軟體:

1.norton 360 v4
2.ad-aware pro
3.zone alarm extrame
4.一些國內外 spam 網站

檢測結果完全正常, 僅有一些 cookie 問題而已.


垃圾信檔頭如下:

-----------------第一封-----------------
Received: from siao.tw (HELO siao.tw) (114.33.10.48)
by trap04.abusix.org (qpsmtpd/0.83) with SMTP; Tue, 18 May 2010 05:00:20 +0000
Message-ID:
Date: Tue, 18 May 2010 13:00:49 +0800
From:
MIME-Version: 1.0
To:
Subject: Grandpa Harrington did
Content-Type: application/oct

-----------------第二封-----------------
Received: from mtain-me05.r1000.mx.aol.com (mtain-me05.r1000.mx.aol.com [172.29.96.141]) by air-me04.mail.aol.com (v129.4) with ESMTP id MAILINME044-8baf4bf1cb6411e; Mon, 17 May 2010 19:04:04 -0400
Received: from siao.tw (unknown [114.33.10.48])
by mtain-me05.r1000.mx.aol.com (Internet Inbound) with SMTP id 501553800008C
for redacted; Mon, 17 May 2010 19:04:03 -0400 (EDT)
Message-ID:
Date: Tue, 18 May 2010 07:03:58 +0800
From:
MIME-Version: 1.0
To:
Subject: Said Davy. The bill came up, and Willie Quarr
Content-Type: application/oct

-----------------第三封-----------------
Received: from mtain-di06.r1000.mx.aol.com (mtain-di06.r1000.mx.aol.com [172.29.64.10]) by air-da05.mail.aol.com (v129.4) with ESMTP id MAILINDA053-863d4bf23f59289; Tue, 18 May 2010 03:18:49 -0400
Received: from siao.tw (unknown [114.33.10.48])
by mtain-di06.r1000.mx.aol.com (Internet Inbound) with SMTP id 30C2E380000B5
for redacted; Tue, 18 May 2010 03:18:46 -0400 (EDT)
Message-ID:
Date: Tue, 18 May 2010 15:18:42 +0800
From:
MIME-Version: 1.0
To:
Subject: FLORIDA THE OUTDOOR GIRLS AT OCEAN VIE
Content-Type: application/oct