Shulou(Shulou.com)06/01 Report--

A server was hacked by the sweep chicken. After going up, it was found that the task manager could not be used, and commands such as taskkill could not be used.

Net user immediately saw the account of hacker$. "Local users and groups" in "computer Management" can no longer be opened, and the Group Policy Editor can no longer be opened. Sethc and other things have changed, and a lot of horses have been saved. Causes the server to slow down remotely.

Let's first talk about the experience of restoring these.

Exe, such as 1.taskkill and taskmgr, directly check the permissions and find that they no longer belong to any users or groups. In the advanced level of security, add a group, and then open "Properties"-> "Security" again, and add an administrators group. Ok is ready to open.

two。 Group Policy Open error: mmc was unable to create the snap-in. There is a LoadLibrary error in regsvr32 gpedit.dll wsecedit.dll. Use the same method above to restore the permissions of dll as above, then ok.

3. Computer management does not have local users and groups, open lusrmgr.msc the same prompt: MMC can not create a snap-in, using the same method above, restore the permissions of localsec.dll, then ok.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.