win2000怀疑中了红色代号病毒，请各位诊治

wweijie 2001-08-05 04:04:26
只要拨号上网，modem就开始上传数据，我捕获了部分数据，请各位诊治，如果是红色代号，如何杀除？万分感谢，我的机器名是webserver，ip是192.168.0.1

1 0.020029 XEROX 000000 96D520000200 TCP ....S., len: 0, seq:1073851620-1073851620, ack: 0, win: 8760, src: 3690 dst: 80 WEBSERVER 192.168.242.19 IP
Frame: Base frame properties
Frame: Time of capture = 2001-8-5 16:0:46.505
Frame: Time delta from previous physical frame: 0 microseconds
Frame: Frame number: 1
Frame: Total frame length: 62 bytes
Frame: Capture frame length: 62 bytes
Frame: Frame data: Number of data bytes remaining = 62 (0x003E)
ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
ETHERNET: Destination address : 96D520000200
ETHERNET: .......0 = Individual address
ETHERNET: ......1. = Locally administered address
ETHERNET: Source address : 000002000000
ETHERNET: .......0 = No routing information present
ETHERNET: ......0. = Universally administered address
ETHERNET: Frame Length : 62 (0x003E)
ETHERNET: Ethernet Type : 0x0800 (IP: DOD Internet Protocol)
ETHERNET: Ethernet Data: Number of data bytes remaining = 48 (0x0030)
IP: ID = 0x4C74; Proto = TCP; Len: 48
IP: Version = 4 (0x4)
IP: Header Length = 20 (0x14)
IP: Precedence = Routine
IP: Type of Service = Normal Service
IP: Total Length = 48 (0x30)
IP: Identification = 19572 (0x4C74)
IP: Flags Summary = 2 (0x2)
IP: .......0 = Last fragment in datagram
IP: ......1. = Cannot fragment datagram
IP: Fragment Offset = 0 (0x0) bytes
IP: Time to Live = 128 (0x80)
IP: Protocol = TCP - Transmission Control
IP: Checksum = 0x38FA
IP: Source Address = 61.137.133.20
IP: Destination Address = 192.168.242.19
IP: Data: Number of data bytes remaining = 28 (0x001C)
TCP: ....S., len: 0, seq:1073851620-1073851620, ack: 0, win: 8760, src: 3690 dst: 80
TCP: Source Port = 0x0E6A
TCP: Destination Port = Hypertext Transfer Protocol
TCP: Sequence Number = 1073851620 (0x4001ACE4)
TCP: Acknowledgement Number = 0 (0x0)
TCP: Data Offset = 28 (0x1C)
TCP: Reserved = 0 (0x0000)
TCP: Flags = 0x02 : ....S.
TCP: ..0..... = No urgent data
TCP: ...0.... = Acknowledgement field not significant
TCP: ....0... = No Push function
TCP: .....0.. = No Reset
TCP: ......1. = Synchronize sequence numbers
TCP: .......0 = No Fin
TCP: Window = 8760 (0x2238)
TCP: Checksum = 0xEFED
TCP: Urgent Pointer = 0 (0x0)
TCP: Options
TCP: Maximum Segment Size Option
TCP: Option Type = Maximum Segment Size
TCP: Option Length = 4 (0x4)
TCP: Maximum Segment Size = 1460 (0x5B4)
TCP: Option Nop = 1 (0x1)
TCP: Option Nop = 1 (0x1)
TCP: SACK Permitted Option
TCP: Option Type = Sack Permitted
TCP: Option Length = 2 (0x2)
00000: 96 D5 20 00 02 00 00 00 02 00 00 00 08 00 45 00 –Õ ...........E.
00010: 00 30 4C 74 40 00 80 06 38 FA 3D 89 85 14 C0 A8 .0Lt@.€.8ú=‰….À¨
00020: F2 13 0E 6A 00 50 40 01 AC E4 00 00 00 00 70 02 ò..j.P@.¬ä....p.
00030: 22 38 EF ED 00 00 02 04 05 B4 01 01 04 02 "8ïí.....´....

2 0.030043 XEROX 000000 96D520000200 TCP ....S., len: 0, seq:1078731693-1078731693, ack: 0, win: 8760, src: 3774 dst: 80 WEBSERVER 192.168.157.84 IP
Frame: Base frame properties
Frame: Time of capture = 2001-8-5 16:0:46.515
Frame: Time delta from previous physical frame: 10014 microseconds
Frame: Frame number: 2
Frame: Total frame length: 62 bytes
Frame: Capture frame length: 62 bytes
Frame: Frame data: Number of data bytes remaining = 62 (0x003E)
ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
ETHERNET: Destination address : 96D520000200
ETHERNET: .......0 = Individual address
ETHERNET: ......1. = Locally administered address
ETHERNET: Source address : 000002000000
ETHERNET: .......0 = No routing information present
ETHERNET: ......0. = Universally administered address
ETHERNET: Frame Length : 62 (0x003E)
ETHERNET: Ethernet Type : 0x0800 (IP: DOD Internet Protocol)
ETHERNET: Ethernet Data: Number of data bytes remaining = 48 (0x0030)
IP: ID = 0x4C75; Proto = TCP; Len: 48
IP: Version = 4 (0x4)
IP: Header Length = 20 (0x14)
IP: Precedence = Routine
IP: Type of Service = Normal Service
IP: Total Length = 48 (0x30)
IP: Identification = 19573 (0x4C75)
IP: Flags Summary = 2 (0x2)
IP: .......0 = Last fragment in datagram
IP: ......1. = Cannot fragment datagram
IP: Fragment Offset = 0 (0x0) bytes
IP: Time to Live = 128 (0x80)
IP: Protocol = TCP - Transmission Control
IP: Checksum = 0x8DB8
IP: Source Address = 61.137.133.20
IP: Destination Address = 192.168.157.84
IP: Data: Number of data bytes remaining = 28 (0x001C)
TCP: ....S., len: 0, seq:1078731693-1078731693, ack: 0, win: 8760, src: 3774 dst: 80
TCP: Source Port = 0x0EBE
TCP: Destination Port = Hypertext Transfer Protocol
TCP: Sequence Number = 1078731693 (0x404C23AD)
TCP: Acknowledgement Number = 0 (0x0)
TCP: Data Offset = 28 (0x1C)
TCP: Reserved = 0 (0x0000)
TCP: Flags = 0x02 : ....S.
TCP: ..0..... = No urgent data
TCP: ...0.... = Acknowledgement field not significant
TCP: ....0... = No Push function
TCP: .....0.. = No Reset
TCP: ......1. = Synchronize sequence numbers
TCP: .......0 = No Fin
TCP: Window = 8760 (0x2238)
TCP: Checksum = 0xCD45
TCP: Urgent Pointer = 0 (0x0)
TCP: Options
TCP: Maximum Segment Size Option
TCP: Option Type = Maximum Segment Size
TCP: Option Length = 4 (0x4)
TCP: Maximum Segment Size = 1460 (0x5B4)
TCP: Option Nop = 1 (0x1)
TCP: Option Nop = 1 (0x1)
TCP: SACK Permitted Option
TCP: Option Type = Sack Permitted
TCP: Option Length = 2 (0x2)
00000: 96 D5 20 00 02 00 00 00 02 00 00 00 08 00 45 00 –Õ ...........E.
00010: 00 30 4C 75 40 00 80 06 8D B8 3D 89 85 14 C0 A8 .0Lu@.€.¸=‰….À¨
00020: 9D 54 0E BE 00 50 40 4C 23 AD 00 00 00 00 70 02 T.¾.P@L#­....p.
00030: 22 38 CD 45 00 00 02 04 05 B4 01 01 04 02 "8ÍE.....´....

...全文
194 14 打赏 收藏 转发到动态 举报
AI 作业
写回复
用AI写文章
14 条回复
切换为时间正序
请发表友善的回复…
发表回复
RickeyLv 2001-08-09
  • 打赏
  • 举报
 回复
不用下载那一百多兆的补丁，只要到ms的网站下载一个RedCodeClean（56K),一切搞定，我就是这样的。
wweijie 2001-08-08
  • 打赏
  • 举报
 回复
解决了：首先安装sp2然后安装微软最新的补丁，再使用最新的杀毒软件查杀木马。
应急的办法是删除Ida映射，方法是在IIS-站点-主目录-属性
谢谢各位
wweijie 2001-08-07
  • 打赏
  • 举报
 回复
症状如nettips(大藏)说的一样，在有c:\explorer.exe和d:\explorer.exe两个木马程序，c:\explorer.exe不能删除，如何删除该木马？
微软的补丁我已经下载，但它必须首先安装sp1或sp2
truemichael 2001-08-07
  • 打赏
  • 举报
 回复
补丁下载地址：
Windows NT 4.0:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30833
Windows 2000 Professional, Server and Advanced Server:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30800
另外最好删除Ida映射，方法是在IIS-站点-主目录-属性
hd506lg 2001-08-06
  • 打赏
  • 举报
 回复
奇怪奇怪真奇怪！
bibleboy 2001-08-06
  • 打赏
  • 举报
 回复
gz
wweijie 2001-08-06
  • 打赏
  • 举报
 回复
感染
现在重装系统之后还这样（我只格式化了系统盘）
阿鹏兄 2001-08-06
  • 打赏
  • 举报
 回复
gz
nettips 2001-08-06
  • 打赏
  • 举报
 回复
大家快看看这个帖子：
有了针对中国的“红色代码病毒”了
http://bbs.patching.net/viewdoc.asp?id=2675 & currentpage=1
wa19801 2001-08-06
  • 打赏
  • 举报
 回复
这好象就是红色代码病毒！到microsoft 去下载一个补丁！去这里看看！
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-033.asp
zwbrush 2001-08-06
  • 打赏
  • 举报
 回复
呵呵,停掉IIS服务试试..
原来我的也是这样的,我把IIS服务反安装了,,,结果就好了...


zjlsct 2001-08-06
  • 打赏
  • 举报
 回复
据说红色代码不感染中文版的系统嘛
wmx111 2001-08-06
  • 打赏
  • 举报
 回复
gz
playingmygame 2001-08-05
  • 打赏
  • 举报
 回复
关注
万能网卡驱动兼容win7 / xp
Intel 946-G45/Q45系列集成显卡驱动14.37.1.5029版For Win2000/XP [13.63M] 2009年02月13日 是 Intel 946-G35/Q35系列集成显卡驱动15.12.75.4.1930版For Win7-32 [22.57M] 2009年10月29日 是 Intel B43/G41/G43/...
漂亮的.Net控件
System32目录中去，可在设计期间选择其他图片，带演示程序，须装有.net  beta2. 我才发现VS.net正式版也适用，.net  beta2下编写的控件，vs.net  正式版下重新编译一下即可,注意...
管理员必须掌握的常用命令
返回的结果中，`time=`后面的时间表示往返延迟，`TTL=`后的数字则可能反映出目标主机的操作系统类型，如Win98的TTL通常为32，Win2000为128，Unix系统可能为250。 2. **nbtstat命令** `nbtstat` 是NetBIOS over TCP...
红色代码系列病毒的清理与修复
前不久我们网站四台win2000服务器全部中了红色代码II号病毒，现将清理过程书写如下，望大家注意免受其害。首先如果你的机器开着IIS并没有安win2000第三个补丁的话你将非常有可能感染了红色代码病毒，这里你的机器中C...
计算机病毒会感染和破坏CD,世界十大最强大的计算机病毒。
1. CIH(1998)排名列表，品牌排名列表此计算机病毒属于W32家族，在Windows 95/98中带有后缀EXE的文件会感染该文件。它具有极强的破坏力，可以重写BIOS以使其无用(只要计算机的微处理器是奔腾Int...
Windows Server

6,868

社区成员

177,996

社区内容

发帖
与我相关
我的任务
社区描述
Windows 2016/2012/2008/2003/2000/NT
社区管理员
  • Windows Server社区
  • qishine
加入社区
  • 近7日
  • 近30日
  • 至今

加载中

查看更多榜单
社区公告
暂无公告

试试用AI创作助手写篇文章吧

+ 用AI写文章