Just to check your new server, found that more than a FTP in the task manager. Exe process, and then found a file under C pan-gen directory


The open 218.206.207.7
123123
123123
The get MUMA. Exe c: \ bootMUMA exe
Bye


Is this the FTP commands? Indeed as expected the FTP can login




In addition to the system32 directory of the FTP. Exe is launched, other nothing abnormal process, what is this?

CodePudding user response:

Antivirus consciousness weak, these little trick comes with a firewall can block, attention should be paid to observe two points, the first is the virus, a second look at the current firewall open ports, open a strict mode, only need to open ports, all the rest of the DSC,

CodePudding user response:

Don't know if the attack others