0779hjj 发表于 2004-10-12 19:18:06

如图:CPU占用40-100%之间,平时多数是10%以下,内存也比平时用多了很多,我已在filter rules:forward里把TCP/UDP:135-139端口dorp掉了。在不杀病毒的情况下,有什么办法改善一下ros吗?

majun1999 发表于 2004-10-12 22:32:06

这个东西也没有啥好的办法!只能叫你的内网用户杀毒呢!

liu00901 发表于 2004-10-13 01:52:49

内网用户2K/XP添加IP安全策略......阻止任何IP访问本机IP134-139阻止本机IP访问任何IP134-139

0779hjj 发表于 2004-10-13 08:27:23

内网用的是win98,不是win2k/xp。我是在外网监控知道内网有病毒的,打了电话让人杀毒,可能没人信我,未杀,今天内存(昨晚看见越来越少)可能已被用完了,我用了几分钟都登录不上。

liu00901 发表于 2004-10-13 08:44:21

A:除了在filter rules:forward里把TCP/UDP:135-139端口dorp掉还要在input 里把TCP/UDP:135-139端口dorp掉B:加内存,换高频CPUC:内网每台机装天网防火墙D:内网每台机断网杀毒

0779hjj 发表于 2004-10-13 09:04:29

"input 里把TCP/UDP:135-139端口dorp掉"这个我早早就做了。我看现在只有杀毒这一招可以用了。每台机装天网太麻烦了,60台机子。

0779hjj 发表于 2004-10-13 09:11:07

现在只在一台机子有毒,ros就这个样子了,假如有多几台有这样的毒,即使换高频CPU,加大内存,时间长了最终也会死啊!!!

bow 发表于 2004-10-13 09:30:16

/ ip firewall rule forward add dst-address=:137-139 protocol=tcp action=drop comment="" disabled=no add dst-address=:137-139 protocol=udp action=drop comment="" disabled=no / ip firewall rule input add protocol=tcp tcp-options=non-syn-only connection-state=established \    action=accept comment="Established TCP connections." disabled=no add connection-state=related action=accept comment="Related connections" \    disabled=no add dst-address=:135-139 protocol=tcp action=drop comment="Drop Blaster \    Worm." disabled=no add dst-address=:445 protocol=tcp action=drop comment="Drop Blaster Worm" \    disabled=no add dst-address=:135-139 protocol=udp action=drop comment="Drop Messenger \    Worm" disabled=no add protocol=udp action=accept comment="UDP" disabled=no add protocol=icmp limit-count=100 limit-burst=2 limit-time=5s action=accept \    comment="Allow limited pings" disabled=no add protocol=icmp action=drop comment="Drop excess pings" disabled=no add dst-address=:22 protocol=tcp action=accept comment="SSH for demo \    purposes" disabled=no add dst-address=:23 protocol=tcp action=accept comment="Telnet for demo \    purposes" disabled=no add dst-address=:80 protocol=tcp action=accept comment="http for demo \    purposes" disabled=no add dst-address=:3987 protocol=tcp action=accept comment="winbox for demo \    purposes" disabled=no add action=drop log=yes comment="Log and drop everything else" disabled=no

0779hjj 发表于 2004-10-13 10:22:06

QUOTE (bow @ Oct 13 2004, 09:30 AM)
/ ip firewall rule forward add dst-address=:137-139 protocol=tcp action=drop comment="" disabled=no add dst-address=:137-139 protocol=udp action=drop comment="" disabled=no / ip firewall rule input add protocol=tcp tcp-options=non-syn-only connection-state=established \    action=accept comment="Established TCP connections." disabled=no add connection-state=related action=accept comment="Related connections" \    disabled=no add dst-address=:135-139 protocol=tcp action=drop comment="Drop Blaster \    Worm." disabled=no add dst-address=:445 protocol=tcp action=drop comment="Drop Blaster Worm" \    disabled=no add dst-address=:135-139 protocol=udp action=drop comment="Drop Messenger \    Worm" disabled=no add protocol=udp action=accept comment="UDP" disabled=no add protocol=icmp limit-count=100 limit-burst=2 limit-time=5s action=accept \    comment="Allow limited pings" disabled=no add protocol=icmp action=drop comment="Drop excess pings" disabled=no add dst-address=:22 protocol=tcp action=accept comment="SSH for demo \    purposes" disabled=no add dst-address=:23 protocol=tcp action=accept comment="Telnet for demo \    purposes" disabled=no add dst-address=:80 protocol=tcp action=accept comment="http for demo \    purposes" disabled=no add dst-address=:3987 protocol=tcp action=accept comment="winbox for demo \    purposes" disabled=no add action=drop log=yes comment="Log and drop everything else" disabled=no
这是官方ros的设置吧?这个我知道,但可用内存还是越来越少了,最后没有了,现在能登录但已不能操作了。

zhx0123 发表于 2006-10-4 21:31:03

xuexi。谢谢

权威 发表于 2006-10-5 02:39:47

你设置的防火墙有问题。

如果正确的 应该能看见拦阻的字节数的。你好好看看有没有?
页: [1]
查看完整版本: 内网病毒又发作了,ros该怎么办法呢?