最近常有這個問題....

[jones]

我的主機是用win200pro+appserv1.9+dnsd+maild+xoops+blackice
最近常會有收到norton 通知redcode的病毒通知在blackice的XXX00.enc
的紀錄檔發現病毒..隔天..整各網路就癱瘓了...雖有做ghost回復..但
已經做了3-4次了..這情況屢試不爽 lol...

以下是自我測試...
發現 port 81 開了3個?

在紀錄檔裡面也有相關的訊息...但都找不到相關的佈告

請求大家的協助

Proto Local Address Foreign Address State
TCP jones:echo jones:0 LISTENING
TCP jones:discard jones:0 LISTENING
TCP jones:daytime jones:0 LISTENING
TCP jones:qotd jones:0 LISTENING
TCP jones:chargen jones:0 LISTENING
TCP jones:http jones:0 LISTENING
TCP jones:epmap jones:0 LISTENING
TCP jones:microsoft-ds jones:0 LISTENING
TCP jones:1025 jones:0 LISTENING
TCP jones:1029 jones:0 LISTENING
TCP jones:1033 jones:0 LISTENING
TCP jones:1038 jones:0 LISTENING
TCP jones:1202 jones:0 LISTENING
TCP jones:3306 jones:0 LISTENING
TCP jones:smtp jones:0 LISTENING
TCP jones:81 jones:0 LISTENING
TCP jones:pop3 jones:0 LISTENING
TCP jones:1028 jones:0 LISTENING
TCP jones:1029 jones:3306 ESTABLISHED
TCP jones:1226 jones:1028 TIME_WAIT
TCP jones:1228 jones:1028 TIME_WAIT
TCP jones:3306 jones:1029 ESTABLISHED
TCP jones:81 jones:0 LISTENING
TCP jones:pop3 jones:0 LISTENING
TCP jones:netbios-ssn jones:0 LISTENING
TCP jones:smtp jones:0 LISTENING
TCP jones:81 jones:0 LISTENING
TCP jones:pop3 jones:0 LISTENING
TCP jones:1227 u125-129.u203-204.giga.net.tw:pop3 TIME_WAI
TCP jones:1229 u125-129.u203-204.giga.net.tw:pop3 TIME_WAI
UDP jones:echo *:*
UDP jones:discard *:*
UDP jones:daytime *:*
UDP jones:qotd *:*
UDP jones:chargen *:*
UDP jones:snmp *:*
UDP jones:microsoft-ds *:*
UDP jones:1201 *:*
UDP jones:domain *:*
UDP jones:1034 *:*
UDP jones:1046 *:*
UDP jones:netbios-ns *:*
UDP jones:netbios-dgm *:*
UDP jones:isakmp *:*
UDP jones:router *:*
UDP jones:4500 *:*
UDP jones:domain *:*
UDP jones:isakmp *:*
UDP jones:router *:*
UDP jones:4500 *:*

事件類型: 錯誤
事件來源: NetBT
事件類別目錄: 無
事件識別碼: 4319
日期: 2004/2/7
時間: 上午 10:31:02
使用者: 不適用
電腦: JONES
描述:
在 TCP 網路上偵測到名稱重複。 傳送訊息的電腦的 IP 位址在資料中。 請在指令視窗中使用 nbtstat -n 來查看那一個名稱是在衝突狀態。
資料:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 df 10 00 c0 ....ß..À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 04 00 a8 c0 ..¨À