How to kill and prevent ASP Trojans

How to kill and prevent Trojans [Figure]

First of all, I would like to thank the "hackers" who did not erase them during the development of the Internet. The quotation marks here do not demean anything, but refer to those who are really proficient in code and discover and exploit program vulnerabilities based on their own profound technology. They generally do not do anything, it's just fun in research. I personally think that their existence promotes the rapid development of technology. For the common "tool users", most of them seem to have no strength in addition to messing around, damaging, and self-blocking hacking.

To put it bluntly, some hackers recently studied the code of the online forum and found that they could bypass the program to upload arbitrary files in some way, and then use the uploaded malicious code to do almost everything they wanted to do. The versions affected by this vulnerability are all versions earlier than 7.7.2. in theory, it also affects all sites that use similar program development. To address this vulnerability, we strongly recommend that you upgrade to the latest version. The address is as follows:

Http://bbs.dvbbs.net/dispbbs.asp? BoardID = 8 & ID = 704362 & page = 1

If you are lucky enough to win the bid, I will provide some simple methods to scan and kill malicious code (Trojans) in the dynamic network forum based on my experience. The effect of the scan and kill is proportional to the degree of care you have paid, prepare your patience and follow me step by step.

As the saying goes, "Know yourself, know yourself, know yourself, and know yourself. To query Trojans, you must first understand the structure of your website, and secondly understand the composition of Trojans. A good website structure can quickly identify illegal files. A bad structure will make you dizzy. Simply put, it is to classify and release files, delete expired and tested files in time. This topic is not the focus of today. If you are interested, please search for it yourself. The composition of Trojans is complex and changeable. Generally, they appear in various forms based on different functions. A smaller one can be done with dozens of characters. You do not need many tools to check Trojans. An Ftp software and Windows built-in search functions are required. A text editor, such as a Windows notepad, is ready. We recommend that you use FlashFXP for Ftp software. It has some useful functions in trojan detection.

21:10:36, Tom told me that his Forum homepage was changed. I immediately logged on to his website and found that the Forum homepage file was changed. He asked him to come to the Ftp account and password, log on to Ftp and check it carefully. His space is only placed in a dynamic network forum. According to the analysis of the page being modified, the trojan program is uploaded and modified. So I open FlashFxp and select a tool, select search for files on the FTP server, as shown in figure 1. 500) this. style. width = 500; ">

Generally, the trojan is an asp file. I enter *. asp in the name and click Search now, as shown in figure 2. 500) this. style. width = 500; ">

After waiting patiently for a while, the result came out. I clicked "in Folders" to arrange the searched files in folders. The website structure is clear because it uses a dynamic network forum. Except for the root directory and INC directory, no asp files should exist in other directories. Now there is a suspicious file haha under the UploadFace directory. asp, I clicked "Modify time" again to arrange the last modification time. I found this file was last modified, and it was really suspicious. For good deletion, I chose it, check the source code and check whether it is a trojan. If you are sure, do not hesitate to delete it! Figure 3. 500) this. style. width = 500; ">

The idea is that IIS also maps other types of files to asp. dll explanation, I searched again like 2 *. cer ,*. cdx ,*. asa ,*. htr. delete one of these files because the program does not need them.

Hey, I didn't expect it to take 2 minutes to solve the problem. I was so proud that I suddenly thought that what if hackers modified normal files and added malicious code? The file content can not be checked using Ftp. I can only go back and check all the files. The directories under upload have hundreds of MB, so I won't be able to continue, you only need to ensure that there are no executable files such as asp in it, and the database does not need to be deleted. All other files can be downloaded. Figure 4. 500) this. style. width = 500; ">

Tom is urging me. He wants to activate the forum as soon as possible. He uses the original official program. I will delete the old program first, as shown in Figure 5,500) this. style. width = 500; "> then download the latest SP2 dynamic network forum, or upload the files in the root directory and those directories that have just been deleted. If the files are not uploaded to the database, the Forum will soon be restored, after repeatedly telling him not to install plug-ins or other programs, I concentrated on studying the downloaded files.

Enable the Windows Search function and write the name of the file to be searched *. asp, think of many Trojans with this line of code "LANGUAGE = VBScript. encode. encode to find all "VBScript. the asp file of Encode, hey, I found a few, figure 6. 500) this. style. width = 500; "> Of course, not all Trojans must use this line of code to continue searching for keywords to determine if they are Trojans. List some keywords for reference.

The keywords I provide are not necessarily the most comprehensive. I hope that experienced users can continue to provide them. I will update the keyword list at any time.

Keywords	Possibility	Solution	Files that contain this keyword on the Internet
VBScript. Encode	100%	Delete	None
Ocean	100%	Delete	None
Daoxiang	100%	Delete	None
Freezing Point	100%	Delete	None
0D43FE01-F093-11CF-8940-00A0C9054228	100%	Delete	None
093FF999-1EA0-4079-9525-9614C3504B74	100%	Delete	None
72c24dd5-d70a-438b-8a42-98417b88afb8	100%	Delete	None
CreateTextFile	100%	Delete	None
Eval (r	100%	Delete	None
Execute request	100%	Delete or replace	Generally, execute request ("x") is added to a normal file to execute abnormal code.
Execute session	100%	Delete or replace	None, same as above
OpenTextFile	100%	Delete	None
WriteLine	100%	Delete	None
WSCRIPT	100%	Delete	None
5 xSoft	100%	Delete	None
Scripting. Dictionary	100%	Delete	None
Request. BinaryRead	100%	Delete	None
DeleteFile	90%	Delete or replace	Bytes
MoveFile	90%	Delete or replace	Reg. asp
Getfile	90%	Delete or replace	Reg. aspshowimg. aspviewfile. asp
= VBS	90%	Delete or replace	Dv_ubbcode.asp

If you have operation permissions on the server, we recommend that you set the following settings: enter site properties, select the main directory, click configuration, and delete all unnecessary script mappings. asp. All others