Server poisoning Server system service deleted

All dependent server services of the Windows server 2008R2 server cannot be started. After checking, it is found that the Server system service has been deleted and the Netlogon service cannot be started. Found that the system has more Samserver services pointing to the path C:\ Windows\ Fonts\ lsass.exe

Check the registry and find that LanmanServer, Netlogon has been modified

[HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ services\ LanmanServer]

[HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ services\ Netlogon]

Solution:

Use the 360 system first aid kit for the antivirus discovery program on each server. Clear * restart the server

Import the LanmanServer, Netlogon registry and restart the server after all the problem servers have killed the virus

[HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ services\ LanmanServer]

[HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ services\ Netlogon]

After the server starts, check that the Server service returns to normal, the Netlogon service starts normally, and the AD domain and other server services start normally.