|
|
|
请钉子大哥帮忙分析下原因,多谢!
事件的经过如下:
1 因新建账号无电子邮件地址,运行收件人更新服务报错Event ID:8270
2.用exchange 2003安装目录下的工具setup.exe /domainprep重置权限
3.次日早上检查新建账号及收发mail均正常
4.过了大概一个小时,发现服务器的所有应用程序初始化失败,wordpad ,任务管理器,AD,exchange系统管理器均打不开
5.12:00pm重启服务器,出现蓝屏报错代码
Stop:c000021a{fatal system error}
The windows logon process system process terminated unexpectedly with a status of
0xc0000080(0x00000000 0x0000000)
The system has been shutdown
6.尝试修复,进入安全模式,最近的一次正确配置选项依然报上面的错误
7,最后插入系统盘修复安装,成功进入系统
8.检查收发邮件,outlook(pop3,exchange server)方式正常,http方式弹出输入用户名和密码的对话框,进入后,打开inbox,一直是loading状态,在服务器本机上进入webmail依然是这样,并有病毒如图
8.运行趋势的病毒扫描工具安全模式杀毒,病毒以清除
9.检查收发mail,webmai仍然不能用,outlook可以的
10.扫描清除的病毒日志如下
/
2008-10-30, 17:48:06, Running scanner "P:\syptools\VSCANTM.BIN"...
2008-10-30, 18:09:29, Scanner "P:\syptools\VSCANTM.BIN" has finished running.
2008-10-30, 18:09:29, VSCANTM Log:
2008-10-30, 18:09:29, Files Detected:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 17:48:06
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR C:\*.* /P=P:\syptools\lpt$vpn.628
C:\WINDOWS\ime\IMJP8_1\imjpmig.exe [PE_VIRUT.B]
C:\WINDOWS\ime\IMKR6_1\imekrmig.exe [PE_VIRUT.B]
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OTAFO5QF\0032[1].exe [TROJ_INJECT.UHB]
C:\WINDOWS\system32\IME\PINTLGNT\imscinst.exe [PE_VIRUT.B]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [PE_VIRUT.B]
C:\WINDOWS\system32\Isass.exe [PE_VIRUT.B]
C:\WINDOWS\system32\Isass.exe [WORM_SDBOT.AHI]
17864 files have been read.
17864 files have been checked.
17845 files have been scanned.
29090 files have been scanned. (including files in archived)
6 files containing viruses.
Found 7 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 18:09:28 21 minutes 21 seconds (1280.86 seconds) has elapsed.(71.701 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 18:09:29, Files Clean:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 17:48:06
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR C:\*.* /P=P:\syptools\lpt$vpn.628
Success Clean [ PE_VIRUT.B]( 6474) from C:\WINDOWS\ime\IMJP8_1\imjpmig.exe
Success Clean [ PE_VIRUT.B]( 6474) from C:\WINDOWS\ime\IMKR6_1\imekrmig.exe
Success Clean [ PE_VIRUT.B]( 6474) from C:\WINDOWS\system32\IME\PINTLGNT\imscinst.exe
Success Clean [ PE_VIRUT.B]( 6474) from C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
Success Clean [ PE_VIRUT.B]( 6474) from C:\WINDOWS\system32\Isass.exe
17864 files have been read.
17864 files have been checked.
17845 files have been scanned.
29090 files have been scanned. (including files in archived)
6 files containing viruses.
Found 7 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 18:09:28 21 minutes 21 seconds (1280.86 seconds) has elapsed.(71.701 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 18:09:29, Clean Fail:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 17:48:06
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR C:\*.* /P=P:\syptools\lpt$vpn.628
17864 files have been read.
17864 files have been checked.
17845 files have been scanned.
29090 files have been scanned. (including files in archived)
6 files containing viruses.
Found 7 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 18:09:28 21 minutes 21 seconds (1280.86 seconds) has elapsed.(71.701 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 18:09:30, Running scanner "P:\syptools\VSCANTM.BIN"...
2008-10-30, 18:29:30, Scanner "P:\syptools\VSCANTM.BIN" has finished running.
2008-10-30, 18:29:30, VSCANTM Log:
2008-10-30, 18:29:30, Files Detected:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 18:09:30
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR D:\*.* /P=P:\syptools\lpt$vpn.628
8962 files have been read.
8962 files have been checked.
8961 files have been scanned.
22129 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 18:29:30 19 minutes 59 seconds (1198.48 seconds) has elapsed.(133.730 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 18:29:30, Files Clean:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 18:09:30
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR D:\*.* /P=P:\syptools\lpt$vpn.628
8962 files have been read.
8962 files have been checked.
8961 files have been scanned.
22129 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 18:29:30 19 minutes 59 seconds (1198.48 seconds) has elapsed.(133.730 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 18:29:30, Clean Fail:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 18:09:30
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR D:\*.* /P=P:\syptools\lpt$vpn.628
8962 files have been read.
8962 files have been checked.
8961 files have been scanned.
22129 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 18:29:30 19 minutes 59 seconds (1198.48 seconds) has elapsed.(133.730 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 18:29:30, Running scanner "P:\syptools\VSCANTM.BIN"...
2008-10-30, 19:45:49, Scanner "P:\syptools\VSCANTM.BIN" has finished running.
2008-10-30, 19:45:49, VSCANTM Log:
2008-10-30, 19:45:49, Files Detected:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 18:29:30
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR E:\*.* /P=P:\syptools\lpt$vpn.628
133472 files have been read.
133472 files have been checked.
133450 files have been scanned.
159583 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:45:48 1 hour 16 minutes 17 seconds (4576.92 seconds) has elapsed.(34.291 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:45:49, Files Clean:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 18:29:30
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR E:\*.* /P=P:\syptools\lpt$vpn.628
133472 files have been read.
133472 files have been checked.
133450 files have been scanned.
159583 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:45:48 1 hour 16 minutes 17 seconds (4576.92 seconds) has elapsed.(34.291 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:45:49, Clean Fail:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 18:29:30
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR E:\*.* /P=P:\syptools\lpt$vpn.628
133472 files have been read.
133472 files have been checked.
133450 files have been scanned.
159583 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:45:48 1 hour 16 minutes 17 seconds (4576.92 seconds) has elapsed.(34.291 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:45:49, Running scanner "P:\syptools\VSCANTM.BIN"...
2008-10-30, 19:45:51, Scanner "P:\syptools\VSCANTM.BIN" has finished running.
2008-10-30, 19:45:51, VSCANTM Log:
2008-10-30, 19:45:51, Files Detected:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 19:45:50
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR H:\*.* /P=P:\syptools\lpt$vpn.628
2 files have been read.
2 files have been checked.
2 files have been scanned.
2 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:45:51 0.48 seconds has elapsed.(242.000 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:45:51, Files Clean:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 19:45:50
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR H:\*.* /P=P:\syptools\lpt$vpn.628
2 files have been read.
2 files have been checked.
2 files have been scanned.
2 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:45:51 0.48 seconds has elapsed.(242.000 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:45:51, Clean Fail:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 19:45:50
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR H:\*.* /P=P:\syptools\lpt$vpn.628
2 files have been read.
2 files have been checked.
2 files have been scanned.
2 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:45:51 0.48 seconds has elapsed.(242.000 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:45:51, Running scanner "P:\syptools\VSCANTM.BIN"...
2008-10-30, 19:48:13, Scanner "P:\syptools\VSCANTM.BIN" has finished running.
2008-10-30, 19:48:13, VSCANTM Log:
2008-10-30, 19:48:13, Files Detected:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 19:45:51
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR P:\*.* /P=P:\syptools\lpt$vpn.628
12689 files have been read.
12689 files have been checked.
12688 files have been scanned.
13454 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:48:13 2 minutes 21 seconds (140.34 seconds) has elapsed.(11.060 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:48:13, Files Clean:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 19:45:51
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR P:\*.* /P=P:\syptools\lpt$vpn.628
12689 files have been read.
12689 files have been checked.
12688 files have been scanned.
13454 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:48:13 2 minutes 21 seconds (140.34 seconds) has elapsed.(11.060 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:48:13, Clean Fail:
Copyright (c) 1990 - 2006 Trend Micro Inc.
Report Date : 10/30/2008 19:45:51
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)
VSGetVirusPatternInformation is invoked
Virus Pattern Version : 628 (324062/324062 Patterns) (2008/10/29) (562860)
Command Line: P:\syptools\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR P:\*.* /P=P:\syptools\lpt$vpn.628
12689 files have been read.
12689 files have been checked.
12688 files have been scanned.
13454 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 10/30/2008 19:48:13 2 minutes 21 seconds (140.34 seconds) has elapsed.(11.060 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2008-10-30, 19:48:13, Running SSAPI scanner ""...
2008-10-30, 20:14:18, SSAPI Log:
SSAPI Scanner Version: 1.0.1003
SSAPI Engine Version: 5.2.1032
SSAPI Pattern Version: 6.99
SSAPI Anti-Rootkit Version: <Failed>
Spyware Scan Started: 10/30/2008 19:48:18
SSAPI requires the system to reboot.
Detected Items:
[CLEAN SUCCESS][Cookie_Atdmt] Internet Explorer Cache\atdmt.com,Cookie:ssisadministrator@atdmt.com/,C:\Documents and Settings\Administrator.SSIS\Cookies\administrator@atdmt[1].txt
Detected: 1 items.
Cleaned Success: 1 items.
Clean Failed: 0 items.
Spyware Scan Ended: 10/30/2008 20:14:18
Scan Complete. Time=1564.685669.
[localimg=400,263]1[/localimg]
|
|
|