网管日志_JAN062005
一早来开机就发现Host Monitor报告Web Server出问题了，SQL Server No Answer，远程到此机器，AVG的定时扫描报告说C:\WINNT\SYSTEM32\SPOOL\下HELP中的Secure.bat有病毒，顺着检查发现C:\WINNT\SYSTEM32\SPOOL\下比平时多了一个Help的隐藏目录，于是学警察BaiBai用ALT+Print Screen对现场做了个快照，然后将Help目录打包下来，将目录删除，并将此次事件写入系统运维记录，遗憾的是引子Secure.bat给我第一时间删除了，以后发现问题得先保留现场再处理。
分析一下Help的内容（如下），基本上以收集信息为主，再加上一个Telsrv的程序，充分体现了孙子兵法里面知己知彼，百战不殆的精神：
AV_FW.bat，用来停止各种Anti Virus以及防火墙如BackICE的服务，并且最后还删除了历史扫描记录和病毒数据库文件；
Fport.exe，用来收集端口信息，包括守护在端口的进程，并将收集的结果保存到Fport.txt中；
regedit.exe，注册表编辑器；
kill.exe，PsKill v1.03 - local and remote process killer；
system.bat，报告系统信息，以及找到Serv-U信息，并将结果保存到Systeminfo.txt中；
telsrv.exe，一个Telnet Server，http://www.pcmicro.com/netfoss/telsrv.html；
由于这台服务器是自己接手的，是一台All in One的服务器，于是一步一步来：
※根据Secure.bat在Google上找到了Symantec一个有关Backdoor.Sumtax的安全公告：http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sumtax.html，按照说明检查了相关的地方，并清理了注册表；
※重新检查服务，将不需要的服务都关闭了（也纳闷怎么开了那么多乱七八糟的服务）；
※使用%SystemRoot%\system32\wupdmgr.exe到微软站点打足补丁；
※重新修改了SQL Server的SA密码，将本地Administrator改名，同时也修改密码，并写入服务器运维报告；
※将可疑的进程都Kill掉，并且查看以下的键值，将可疑的进程都砍掉；
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce
AV_FW.bat的内容：
net stop _Avp32.exe /y >> av_fw.txt
net stop _Avpcc.exe /y >> av_fw.txt
net stop _Avpm.exe /y >> av_fw.txt
net stop Ackwin32.exe /y >> av_fw.txt
net stop Agnitum Outpost Firewall /y >> av_fw.txt
net stop Anti-Trojan.exe /y >> av_fw.txt
net stop ANTIVIR /y >> av_fw.txt
......
net stop AVCONSOL /y >> av_fw.txt
net stop WEBTRAP /y >> av_fw.txt
net stop POP3TRAP /y >> av_fw.txt
del c:\*ANTI-VIR*.DAT /s /q >> av_fw.txt
del c:\*CHKLIST*.DAT /s /q >> av_fw.txt
del c:\*CHKLIST*.MS /s /q >> av_fw.txt
del c:\*CHKLIST*.CPS /s /q >> av_fw.txt
del c:\*CHKLIST*.TAV /s /q v
......
system.bat的内容：
@echo off
echo System Information: > Systeminfo.txt
echo. >> Systeminfo.txt
echo. >> Systeminfo.txt
echo. >> Systeminfo.txt
echo. >> Systeminfo.txt
#OPERATING SYSTEM
echo ___________________ >> Systeminfo.txt
echo Operating System... >> Systeminfo.txt
echo ?>> Systeminfo.txt
VER >> Systeminfo.txt
#FREE SPACE
echo _____________ >> Systeminfo.txt
echo Free Space... >> Systeminfo.txt
echo ?>> Systeminfo.txt
dir c: | find "bytes" >> Systeminfo.txt
dir c: | find "libres" >> Systeminfo.txt
dir d: | find "bytes" >> Systeminfo.txt
dir d: | find "libres" >> Systeminfo.txt
dir e: | find "bytes" >> Systeminfo.txt
dir e: | find "libres" >> Systeminfo.txt
dir f: | find "bytes" >> Systeminfo.txt
dir f: | find "libres" >> Systeminfo.txt
dir g: | find "bytes" >> Systeminfo.txt
dir g: | find "libres" >> Systeminfo.txt
dir h: | find "bytes" >> Systeminfo.txt
dir h: | find "libres" >> Systeminfo.txt
#FINDING SERVU
echo ________________ >> Systeminfo.txt
echo Finding Servu... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\Ser*.ini >> Systeminfo.txt
Dir /s /a d:\Ser*.ini >> Systeminfo.txt
Dir /s /a e:\Ser*.ini >> Systeminfo.txt
Dir /s /a c:\Ser*.exe >> Systeminfo.txt
Dir /s /a d:\Ser*.exe >> Systeminfo.txt
Dir /s /a e:\Ser*.exe >> Systeminfo.txt
#FINDING rar
echo ________________ >> Systeminfo.txt
echo Finding RAR.. >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\*.rar >> Systeminfo.txt
Dir /s /a d:\*.rar >> Systeminfo.txt
Dir /s /a e:\*.rar >> Systeminfo.txt
Dir /s /a f:\*.rar >> Systeminfo.txt
Dir /s /a g:\*.rar >> Systeminfo.txt
Dir /s /a h:\*.rar >> Systeminfo.txt
#FINDING mp3
echo ________________ >> Systeminfo.txt
echo Finding MP3... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\*.mp3 >> Systeminfo.txt
Dir /s /a d:\*.mp3 >> Systeminfo.txt
Dir /s /a e:\*.mp3 >> Systeminfo.txt
Dir /s /a f:\*.mp3 >> Systeminfo.txt
Dir /s /a g:\*.mp3 >> Systeminfo.txt
Dir /s /a h:\*.mp3 >> Systeminfo.txt
#FINDING nfo
echo ________________ >> Systeminfo.txt
echo Finding NFO... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\*.nfo >> Systeminfo.txt
Dir /s /a d:\*.nfo >> Systeminfo.txt
Dir /s /a e:\*.nfo >> Systeminfo.txt
Dir /s /a f:\*.nfo >> Systeminfo.txt
Dir /s /a g:\*.nfo >> Systeminfo.txt
Dir /s /a h:\*.nfo >> Systeminfo.txt
#FINDING FTP.EXE
echo ________________ >> Systeminfo.txt
echo Finding FTP... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\FTP.EXE >> Systeminfo.txt
Dir /s /a d:\FTP.EXE >> Systeminfo.txt
Dir /s /a e:\FTP.EXE >> Systeminfo.txt
Dir /s /a f:\FTP.EXE >> Systeminfo.txt
Dir /s /a g:\FTP.EXE >> Systeminfo.txt
Dir /s /a h:\FTP.EXE >> Systeminfo.txt
#FINDING TFTP.EXE
echo ________________ >> Systeminfo.txt
echo Finding TFTP... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\TFTP.EXE >> Systeminfo.txt
Dir /s /a d:\TFTP.EXE >> Systeminfo.txt
Dir /s /a e:\TFTP.EXE >> Systeminfo.txt
Dir /s /a f:\TFTP.EXE >> Systeminfo.txt
Dir /s /a g:\TFTP.EXE >> Systeminfo.txt
Dir /s /a h:\TFTP.EXE >> Systeminfo.txt
#FINDING FIREDAEMON.EXE
echo ________________ >> Systeminfo.txt
echo Finding Firedaemon... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\FIREDAEMON.EXE >> Systeminfo.txt
Dir /s /a d:\FIREDAEMON.EXE >> Systeminfo.txt
Dir /s /a e:\FIREDAEMON.EXE >> Systeminfo.txt
Dir /s /a f:\FIREDAEMON.EXE >> Systeminfo.txt
Dir /s /a g:\FIREDAEMON.EXE >> Systeminfo.txt
Dir /s /a h:\FIREDAEMON.EXE >> Systeminfo.txt
#FINDING IOFTPD
echo ________________ >> Systeminfo.txt
echo Finding Ioftpd... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\io*.ini >> Systeminfo.txt
Dir /s /a d:\io*.ini >> Systeminfo.txt
Dir /s /a c:\io*.exe >> Systeminfo.txt
Dir /s /a d:\io*.exe >> Systeminfo.txt
Dir /s /a c:\rai*.ini >> Systeminfo.txt
Dir /s /a d:\rai*.ini >> Systeminfo.txt
Dir /s /a c:\rai*.exe >> Systeminfo.txt
Dir /s /a d:\rai*.exe >> Systeminfo.txt
#FINDING Sub0t.ini
echo ________________ >> Systeminfo.txt
echo Finding Sub0t.ini... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\Sub0t.ini >> Systeminfo.txt
Dir /s /a d:\Sub0t.ini >> Systeminfo.txt
Dir /s /a e:\Sub0t.ini >> Systeminfo.txt
Dir /s /a c:\svrany.exe >> Systeminfo.txt
Dir /s /a d:\svrany.exe >> Systeminfo.txt
#FINDING ftpc.exe
echo ________________ >> Systeminfo.txt
echo Finding ftpc.exe... >> Systeminfo.txt
echo >> Systeminfo.txt
Dir /s /a c:\ftpc.exe >> Systeminfo.txt
Dir /s /a d:\ftpc.exe >> Systeminfo.txt
Dir /s /a e:\ftpc.exe >> Systeminfo.txt
Dir /s /a f:\ftpc.exe >> Systeminfo.txt
Dir /s /a g:\ftpc.exe >> Systeminfo.txt
Dir /s /a h:\ftpc.exe >> Systeminfo.txt
#RUNNING SERVICES
echo ___________________ >> Systeminfo.txt
echo Running Services... >> Systeminfo.txt
echo ?>> Systeminfo.txt
NET START >> Systeminfo.txt
#RUNNING SERVICES
echo ______ >> Systeminfo.txt
echo SET... >> Systeminfo.txt
echo >> Systeminfo.txt
SET >> Systeminfo.txt
#INSTALLED SOFTWARE
echo _____________________ >> Systeminfo.txt
echo Installed Software... >> Systeminfo.txt
echo ?>> Systeminfo.txt
Start /Wait Regedit /E %TEMP%.\Tmp HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
Find "DisplayName" < %TEMP%.\Tmp | Find /V "QuietDisplayName" >> Systeminfo.txt
Del %TEMP%.\Tmp
#INSTALLED SOFTWARE
echo ___________ >> Systeminfo.txt
echo NET STAT... >> Systeminfo.txt
echo ?>> Systeminfo.txt
NETSTAT >> Systeminfo.txt
#RUNNING PROCESSES
echo ____________________ >> Systeminfo.txt
echo Running Processes... >> Systeminfo.txt
echo >> Systeminfo.txt
TASKLIST /SVC >> Systeminfo.txt
#SYSTEM INFO
echo ______________ >> Systeminfo.txt
echo System Info... >> Systeminfo.txt
echo >> Systeminfo.txt
echo. >> Systeminfo.txt
echo. >> Systeminfo.txt