level 1
lami39
楼主
HKEY_LOCAL_MACHINE\SAM项被修改。注意下面两个用户的用户名和字符串值[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\mat01$]@=hex(3fb):[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\mat01$$]@=hex(3fb):由于两个用户有相同的字符串而对应字符串在注册表中只有一个[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003FB]"F"=hex:02,00,01,00,00,00,00,00,d0,cb,53,b3,4d,25,c5,01,00,00,00,00,00,00,00,\ 00,9c,e7,8a,7d,c1,64,c4,01,00,00,00,00,00,00,00,00,f2,c8,c3,a0,ab,5e,c5,01,\ fb,03,00,00,01,02,00,00,10,02,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00"V"=hex:00,00,00,00,c0,00,00,00,02,00,01,00,c0,00,00,00,0a,00,00,00,00,00,00,\ 00,cc,00,00,00,0a,00,00,00,00,00,00,00,d8,00,00,00,00,00,00,00,00,00,00,00,\ d8,00,00,00,00,00,00,00,00,00,00,00,d8,00,00,00,00,00,00,00,00,00,00,00,d8,\ 00,00,00,00,00,00,00,00,00,00,00,d8,00,00,00,00,00,00,00,00,00,00,00,d8,00,\ 00,00,00,00,00,00,00,00,00,00,d8,00,00,00,00,00,00,00,00,00,00,00,d8,00,00,\ 00,00,00,00,00,00,00,00,00,d8,00,00,00,15,00,00,00,a8,00,00,00,f0,00,00,00,\ 08,00,00,00,01,00,00,00,f8,00,00,00,14,00,00,00,00,00,00,00,0c,01,00,00,14,\ 00,00,00,00,00,00,00,20,01,00,00,04,00,00,00,00,00,00,00,24,01,00,00,04,00,\ 00,00,00,00,00,00,01,00,14,80,a0,00,00,00,b0,00,00,00,14,00,00,00,30,00,00,\ 00,02,00,1c,00,01,00,00,00,02,c0,14,00,44,00,05,01,01,01,00,00,00,00,00,01,\ 00,00,00,00,02,00,70,00,04,00,00,00,00,00,14,00,5b,03,02,00,01,01,00,00,00,\ 00,00,01,00,00,00,00,00,00,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,\ 00,00,20,02,00,00,00,00,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,\ 00,24,02,00,00,00,00,24,00,44,00,02,00,01,05,00,00,00,00,00,05,15,00,00,00,\ fd,37,42,40,9e,40,7e,14,07,e5,3b,2b,fb,03,00,00,01,02,00,00,00,00,00,05,20,\ 00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,6d,00,\ 61,00,74,00,30,00,31,00,00,00,6d,00,61,00,74,00,30,00,31,00,01,00,ff,ff,ff,\ ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,cd,e1,6b,01,02,00,00,\ 07,00,00,00,01,00,01,00,c4,23,db,d3,8d,d3,29,03,56,cd,e1,6b,57,c6,22,66,01,\ 00,01,00,2d,d5,1b,9f,e6,f3,2f,a6,7c,01,7d,99,ae,2b,0c,9d,01,00,01,00,01,00,\ 01,00删除其中一个用户项[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\mat01$]@=hex(3fb):重新启动电脑就OK了。由此我也确定该服务器被人成功攻击并复制了用户。看来安全问题还应该引起大家的重视
2007年04月18日 03点04分
1
