9,506
社区成员
发帖
与我相关
我的任务
分享新病毒_ewin2k
本人安装ewin2k pro打好全部补丁
但只要开启 sqlserver 和 iis 就会有msconfig,systemService等不明线程访问互联网
最近又总是自动通过ftp访问外部
在防火墙日志中出现:
Description Packet sent from 61.10.16.94 (TCP Port 4998) to 221.216.168.48 (TCP Port 4899) was blocked
Rating Medium
Date / Time 2005/05/12 09:14:18+8:00 GMT
Type Firewall
Protocol TCP (flags:S)
Program
Source IP 61.10.16.94:4998
Destination IP 221.216.168.48:4899
Direction Incoming
Action Taken Blocked
Count 1
Source DNS cm61-10-16-94.hkcable.com.hk
Destination DNS TOWERNB
但我一直没查出是什么病毒,木马,通过什么漏洞
请各位高手帮忙为谢!
但只要开启 sqlserver 和 iis 就会有msconfig,systemService等不明线程访问互联网
最近又总是自动通过ftp访问外部
在防火墙日志中出现:
Description Packet sent from 61.10.16.94 (TCP Port 4998) to 221.216.168.48 (TCP Port 4899) was blocked
Rating Medium
Date / Time 2005/05/12 09:14:18+8:00 GMT
Type Firewall
Protocol TCP (flags:S)
Program
Source IP 61.10.16.94:4998
Destination IP 221.216.168.48:4899
Direction Incoming
Action Taken Blocked
Count 1
Source DNS cm61-10-16-94.hkcable.com.hk
Destination DNS TOWERNB
但我一直没查出是什么病毒,木马,通过什么漏洞
请各位高手帮忙为谢!
...全文
请发表友善的回复…
发表回复
yslzhf 2005-05-13
- 打赏
- 举报
报告新病毒吧,让专家处理
hlost 2005-05-12
- 打赏
- 举报
ftp访问日志:
Description File Transfer Program requested permission to access the internet.
Rating High
Date / Time 2005/05/12 09:21:48+8:00 GMT
Type New Program
Program C:\WINNT\system32\FTP.EXE
Source IP
Destination IP 202.106.46.151:53
Direction Outgoing (connect)
Action Taken Blocked
Count 1
Source DNS
Destination DNS dialdns.bta.net.cn
Description File Transfer Program requested permission to access the internet.
Rating High
Date / Time 2005/05/12 09:21:48+8:00 GMT
Type New Program
Program C:\WINNT\system32\FTP.EXE
Source IP
Destination IP 202.106.46.151:53
Direction Outgoing (connect)
Action Taken Blocked
Count 1
Source DNS
Destination DNS dialdns.bta.net.cn
andy_he 2005-05-12
- 打赏
- 举报
http://www.chinaitlab.com/www/special/sniffer.asp,看看。
oyljerry 2005-05-12
- 打赏
- 举报
要不直接向瑞星等报告病毒
