麦咖啡(mcafee) VSE 8.5 服务器防挂马心得
<p>重点: <br /><img height="492" alt="" src="https://img.jbzj.com/do/uploads/userup/0907/20124620N46.jpg" width="505" border="0" /> <br /><br /><img height="490" alt="" src="https://img.jbzj.com/do/uploads/userup/0907/2012463364V.jpg" width="502" border="0" /> <br /><br />单单的防还是不能解决问题，下面是我们找出真凶了 <br /><br />给大家介绍一个工具可以像MMC计算机管理管理单元中的“会话”文件夹，显示的是通过网络登录到计算机的会话， <br />远程服务管理单元显示的是远程桌面登录的会话，但没有一个工具可以显示所有登录会话---不管任何登录类型--以及这些用户使用的程序列表。 <br />这个工具是Sysinternals（现在已经是微软）的LogoSessions工具! <br />http://www.microsoft.com/technet/sysinternals/security/logonsessions.mspx <br />可以从这个地址去下载 Free <br />可以把LogoSessions中显示代码和其它工具显示的信息关联起来。 <br /><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode3"> <br />日志 <br />========= <br />Logonsesions v1.1 <br />Copyright (C) 2004 Bryce Cogswell and Mark Russinovich <br />Sysinternals - wwww.sysinternals.com <br /> Logon session 00000000:000003e7: <br />User name: WORKGROUP\SDAHFPWE <br />Auth package: NTLM <br />Logon type: (none) <br />Session: 0 <br />Sid: S-1-5-18 <br />Logon time: 2008-2-18 15:33:05 <br />Logon server: <br />DNS Domain: <br />UPN: <br />356: \SystemRoot\System32\smss.exe <br />404: \??\C:\WINDOWS\system32\csrss.exe <br />428: \??\C:\WINDOWS\system32\winlogon.exe <br />472: C:\WINDOWS\system32\services.exe <br />484: C:\WINDOWS\system32\lsass.exe <br />692: C:\WINDOWS\system32\svchost.exe <br />836: C:\WINDOWS\System32\svchost.exe <br />960: C:\WINDOWS\system32\spoolsv.exe <br />1128: C:\Program Files\Symantec\pcAnywhere\awhost32.exe <br />1164: C:\WINDOWS\System32\svchost.exe <br />1300: C:\Program Files\McAfee\Common Framework\FrameworkService.exe <br />1376: C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe <br />1452: C:\Program Files\McAfee\Common Framework\naPrdMgr.exe <br />1532: C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.exe <br />1696: C:\WINDOWS\System32\svchost.exe <br />1912: C:\WINDOWS\System32\svchost.exe <br />3844: C:\WINDOWS\system32\wbem\wmiprvse.exe <br />4000: C:\WINDOWS\system32\dllhost.exe <br />3172: C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe <br />3960: \??\C:\WINDOWS\system32\csrss.exe <br />396: \??\C:\WINDOWS\system32\winlogon.exe <br />372: C:\WINDOWS\system32\inetsrv\inetinfo.exe <br />2920: C:\WINDOWS\System32\svchost.exe <br />2780: \??\C:\WINDOWS\system32\csrss.exe <br />1576: \??\C:\WINDOWS\system32\winlogon.exe <br /> Logon session 00000000:000081e5: <br />User name: <br />Auth package: NTLM <br />Logon type: (none) <br />Session: 0 <br />Sid: (none) <br />Logon time: 2008-2-18 15:33:05 <br />Logon server: <br />DNS Domain: <br />UPN: <br /> Logon session 00000000:0000c0f7: <br />User name: NT AUTHORITY\ANONYMOUS LOGON <br />Auth package: NTLM <br />Logon type: Network <br />Session: 0 <br />Sid: S-1-5-7 <br />Logon time: 2008-2-18 15:33:08 <br />Logon server: <br />DNS Domain: <br />UPN: <br /> Logon session 00000000:000003e5: <br />User name: NT AUTHORITY\LOCAL SERVICE <br />Auth package: Negotiate <br />Logon type: Service <br />Session: 0 <br />Sid: S-1-5-19 <br />Logon time: 2008-2-18 15:33:09 <br />Logon server: <br />DNS Domain: <br />UPN: <br /> Logon session 00000000:5cbf7d87: <br />User name: SDAHFPWE-WUYMBI\maggie <br />Auth package: NTLM <br />Logon type: RemoteInteractive <br />Session: 2 <br />Sid: S-1-5-21-1476199771-2381760486-1211474579-1009 <br />Logon time: 2008-2-21 9:44:18 <br />Logon server: SDAHFPWE-WUYMBI <br />DNS Domain: <br />UPN: <br />3164: C:\WINDOWS\system32\rdpclip.exe <br />740: C:\WINDOWS\Explorer.EXE <br />3528: C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE <br />392: C:\WINDOWS\system32\ctfmon.exe <br />3952: C:\WINDOWS\system32\mmc.exe <br />336: C:\Program Files\RhinoSoft.com\Serv-U\ServUAdmin.exe <br /> Logon session 00000000:60d81435: <br />User name: SDAHFPWE-WUYMBI\IUSR_SDAHFPWE-WUYMBI <br />Auth package: NTLM <br />Logon type: NetworkCleartext <br />Session: 0 <br />Sid: S-1-5-21-1476199771-2381760486-1211474579-1015 <br />Logon time: 2008-2-21 10:55:33 <br />Logon server: SDAHFPWE-WUYMBI <br />DNS Domain: <br />UPN: <br /> Logon session 00000000:000003e4: <br />User name: NT AUTHORITY\NETWORK SERVICE <br />Auth package: Negotiate <br />Logon type: Service <br />Session: 0 <br />Sid: S-1-5-20 <br />Logon time: 2008-2-18 15:33:06 <br />Logon server: <br />DNS Domain: <br />UPN: <br />2496: c:\windows\system32\inetsrv\w3wp.exe <br /> Logon session 00000000:000309aa: <br />User name: SDAHFPWE-WUYMBI\jooline2008sh <br />Auth package: NTLM <br />Logon type: RemoteInteractive <br />Session: 1 <br />Sid: S-1-5-21-1476199771-2381760486-1211474579-500 <br />Logon time: 2008-2-18 15:35:34 <br />Logon server: SDAHFPWE-WUYMBI <br />DNS Domain: <br />UPN: <br /> Logon session 00000000:60f64f82: <br />User name: SDAHFPWE-WUYMBI\jooline2008sh <br />Auth package: NTLM <br />Logon type: RemoteInteractive <br />Session: 3 <br />Sid: S-1-5-21-1476199771-2381760486-1211474579-500 <br />Logon time: 2008-2-21 11:06:47 <br />Logon server: SDAHFPWE-WUYMBI <br />DNS Domain: <br />UPN: <br />1840: C:\WINDOWS\system32\rdpclip.exe <br />3580: C:\WINDOWS\Explorer.EXE <br />2876: C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE <br />888: C:\Program Files\RhinoSoft.com\Serv-U\ServUTray.exe <br />3280: C:\WINDOWS\system32\cmd.exe <br />376: C:\WINDOWS\system32\conime.exe <br />1820: C:\Program Files\McAfee\VirusScan Enterprise\mcconsol.exe <br />720: C:\WINDOWS\system32\NOTEPAD.EXE <br />2320: E:\logonsessions.exe <br />============================== <br /></div><br />在安全日志事件中，可以把输出的登录会话ID和安全日志事件说明进行关联，查找登录事件和会话相关的事件。 <br />这样很容易找到是怎么回事了....</p>
頁:
[1]