内网病毒又发作了，ros该怎么办法呢？

0779hjj

如图：CPU占用40-100%之间，平时多数是10%以下，内存也比平时用多了很多，我已在filter rules:forward里把TCP/UDP：135-139端口dorp掉了。在不杀病毒的情况下，有什么办法改善一下ros吗？

majun1999

这个东西也没有啥好的办法！只能叫你的内网用户杀毒呢！

liu00901

内网用户2K/XP添加IP安全策略......阻止任何IP访问本机IP  134-139阻止本机IP访问任何IP  134-139

0779hjj

内网用的是win98，不是win2k/xp。我是在外网监控知道内网有病毒的，打了电话让人杀毒，可能没人信我，未杀，今天内存（昨晚看见越来越少）可能已被用完了，我用了几分钟都登录不上。

liu00901

A:除了在filter rules:forward里把TCP/UDP：135-139端口dorp掉还要在input 里把TCP/UDP：135-139端口dorp掉B:加内存,换高频CPUC:内网每台机装天网防火墙D:内网每台机断网杀毒

0779hjj

"input 里把TCP/UDP：135-139端口dorp掉"这个我早早就做了。我看现在只有杀毒这一招可以用了。每台机装天网太麻烦了，60台机子。

0779hjj

现在只在一台机子有毒，ros就这个样子了，假如有多几台有这样的毒,即使换高频CPU,加大内存,时间长了最终也会死啊!!!

bow

/ ip firewall rule forward add dst-address=:137-139 protocol=tcp action=drop comment="" disabled=no add dst-address=:137-139 protocol=udp action=drop comment="" disabled=no / ip firewall rule input add protocol=tcp tcp-options=non-syn-only connection-state=established \    action=accept comment="Established TCP connections." disabled=no add connection-state=related action=accept comment="Related connections" \    disabled=no add dst-address=:135-139 protocol=tcp action=drop comment="Drop Blaster \    Worm." disabled=no add dst-address=:445 protocol=tcp action=drop comment="Drop Blaster Worm" \    disabled=no add dst-address=:135-139 protocol=udp action=drop comment="Drop Messenger \    Worm" disabled=no add protocol=udp action=accept comment="UDP" disabled=no add protocol=icmp limit-count=100 limit-burst=2 limit-time=5s action=accept \    comment="Allow limited pings" disabled=no add protocol=icmp action=drop comment="Drop excess pings" disabled=no add dst-address=:22 protocol=tcp action=accept comment="SSH for demo \    purposes" disabled=no add dst-address=:23 protocol=tcp action=accept comment="Telnet for demo \    purposes" disabled=no add dst-address=:80 protocol=tcp action=accept comment="http for demo \    purposes" disabled=no add dst-address=:3987 protocol=tcp action=accept comment="winbox for demo \    purposes" disabled=no add action=drop log=yes comment="Log and drop everything else" disabled=no

0779hjj

QUOTE (bow @ Oct 13 2004, 09:30 AM)
/ ip firewall rule forward add dst-address=:137-139 protocol=tcp action=drop comment="" disabled=no add dst-address=:137-139 protocol=udp action=drop comment="" disabled=no / ip firewall rule input add protocol=tcp tcp-options=non-syn-only connection-state=established \    action=accept comment="Established TCP connections." disabled=no add connection-state=related action=accept comment="Related connections" \    disabled=no add dst-address=:135-139 protocol=tcp action=drop comment="Drop Blaster \    Worm." disabled=no add dst-address=:445 protocol=tcp action=drop comment="Drop Blaster Worm" \    disabled=no add dst-address=:135-139 protocol=udp action=drop comment="Drop Messenger \    Worm" disabled=no add protocol=udp action=accept comment="UDP" disabled=no add protocol=icmp limit-count=100 limit-burst=2 limit-time=5s action=accept \    comment="Allow limited pings" disabled=no add protocol=icmp action=drop comment="Drop excess pings" disabled=no add dst-address=:22 protocol=tcp action=accept comment="SSH for demo \    purposes" disabled=no add dst-address=:23 protocol=tcp action=accept comment="Telnet for demo \    purposes" disabled=no add dst-address=:80 protocol=tcp action=accept comment="http for demo \    purposes" disabled=no add dst-address=:3987 protocol=tcp action=accept comment="winbox for demo \    purposes" disabled=no add action=drop log=yes comment="Log and drop everything else" disabled=no  
  这是官方ros的设置吧？这个我知道，但可用内存还是越来越少了，最后没有了，现在能登录但已不能操作了。

zhx0123

xuexi。谢谢

权威

如果正确的 应该能看见拦阻的字节数的。你好好看看有没有？