blocks|key|561494|text|如果没有人从它运行合法的端口扫描：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|561495|561496|将其从网络中拉出immediately.|ordered-list-item|561497|If您有时间，将其拉到专用的专用环路上，并观察它在做什么。|561498|如果您正在执行此操作，请准备好扫描软件，在安全模式下重新启动系统，然后运行扫描。|561499|如果您正在执行此操作，请检查注册表中典型的已知位置是否有启动文件，以查看是否有任何异常。|561500|561501|无论你是否找到任何东西，擦除硬盘并从镜像中恢复。您将花费更多的时间来尝试清理系统，而不是重新创建它的映像，并且您不能100%25地确定您是否清理了系统。|561502|entityMap^0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|R|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|S|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|T|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|U|8|@]|9|@]|A|$]]|$1|J|3|K|5|E|7|V|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|W|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|X|8|@]|9|@]|A|$]]|$1|O|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|P|$]]

If no one is running legitimate port scans from it:

<ol>
<li>Pull it off the network immediately.</li>
<li>If you have the time, pull it on a dedicated, private loop and watch what it's doing.</li>
<li>If you are doing that, have scanning software ready, restart the system in safe mode, and run the scans.</li>
<li>If you are doing that, check the typical known locations in the registry for start-up files to see if there's anything unusual.</li>
</ol>

Whether or not you find anything, wipe the HD and restore from an image. You'll spend more time trying to clean the system than you would re-imaging it and you won't be 100% sure you got the system clean.

blocks|key|3781319|text|您可以使用wireshark找出到底发生了什么。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3781320|entityMap|0|LINK|mutability|MUTABLE|url|http://www.wireshark.org/^0|5|9|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

You could use <a href="http://www.wireshark.org/" rel="nofollow noreferrer">wireshark</a> to find out what exactly is happening.

blocks|key|4626349|text|你怎么知道它是在“扫描端口”？我见过一些过度活跃的Windows防火墙产品进入核战争模式，仅仅通过拦截一个ICMP回应(ping)数据包就可以尖叫血腥谋杀。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4626350|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

How did you figure out that it is "scanning ports"? I have seen some hyperactive Windows firewall products go into nuclear war mode and scream bloody murder just by intercepting one ICMP echo (ping) packet.

blocks|key|4626363|text|尝试找出哪个进程正在执行端口扫描(可能使用netstat?)|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|4626364|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Netstat^0|L|7|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

try to find which process is doing the port scan (maybe using <a href="http://en.wikipedia.org/wiki/Netstat" rel="nofollow noreferrer">netstat</a>?)

blocks|key|3781242|text|还有其他的可能性。出于合法的原因，我在以前的作业中运行过端口扫描。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3781243|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

There are other possibilities. I've run port scans at previous jobs for legitimate reasons.

blocks|key|3781477|text|即使不是所有的防病毒/反恶意软件产品，任何恶意软件都很容易被大多数产品检测不到。即使是相对不熟练的人也可以使用可用的工具或服务来做到这一点。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3781478|清洁机器的唯一方法是擦拭它。一直都是。一台企业机器应该足够简单，每个人都可以节省时间，只需将其擦除即可。但是，如果问题经常再次出现，或者怀疑数据丢失或被盗，请联系专业人员。|3781479|杀毒软件只是过滤掉垃圾的一般噪音，它不会捕获定向/真正的攻击。|3781480|但就像有人说的，你确定机器正在做非法的事情，而不是正常的操作吗？你需要一些网络技能才能决定我会猜...但是，如果是行为不端，而你找不到原因，那就把它擦掉。很容易选择。|3781481|即使你确实发现了某种病毒或恶意软件，你也应该清除它--因为这是足够的迹象，表明机器可能会进一步受到危害，而你不会检测到它。|3781482|在主机安全中有一种说法，如果一台主机被感染了，那么它就不再是你的主机了，不管你对它做了什么，除了完全清除它(即使是这样也是乐观的，因为有时有办法将恶意软件存储在可编程的rom中，比如在易受攻击的网卡的固件中或在其中的其他非易失性存储中)。|3781483|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|P|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|Q|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|R|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|S|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|M|$]]

Any and all malware can easily be made undetectable to most if not all antivirus/antimalware products. Even a relatively unskilled person could do it with available tools or services.

The only way to clean a machine is to wipe it. Always. A corporate machine should be easy enough and everyone saves time just wiping it. If the problem reappears often however or data loss or theft is suspected - contact professionals.

The antivirus software is just to filter out the general noise of crap, it will not catch directed/real attacks.

But as someone said, are you sure the machine is doing illicit things and not just normal operation? You need some network skill to decide that I'd guess... but if it is misbehaving and you can't find the cause - wipe it. Easy choice.

Even if you did find some kind of virus or malware, you should definately wipe it - as that is sign enough that the machine might be even further compromised which you won't detect.

There's a saying in host security, if a host has been infected, it is no longer your host regardless of what you do to it except for wiping it completely (and even that is way optimistic as there are sometimes ways to store malware in programmable rom like in a vulnerable network card's firmware or some other non-volatile piece of storage in it).

A workstation is scanning ports in the LAN; however virus scan have not picked anything up (McAffee, Sophos, MS).

Is the only option to clean the hard drive?

Are there any new malware of this description that have not yet been picked-up for scanning by the anti-virus software vendors.

Port Scanning Orginating from a Workstation; Virus scan do not show any Malware

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

工作站正在扫描局域网中的端口；但是病毒扫描没有检测到任何东西(McAffee、Sophos、MS)。是清理硬盘的唯一选择吗？是否有此描述的新恶意软件尚未被防病毒软件供应商拾取以进行扫描。

问端口扫描来自工作站；病毒扫描不显示任何恶意软件
EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问端口扫描来自工作站；病毒扫描不显示任何恶意软件EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问端口扫描来自工作站；病毒扫描不显示任何恶意软件
EN