Prevent the aspxspy of wood and Marxism Service IIS information Execute command and so on Operation _win Server

Environment: windows2003+iis6+.net2.0

For security reasons, set the server security. Upload Aspxspy test.

Aspxspy probe

1. Prohibit the Aspxspy Trojan to execute the command to claim and read the registration form

Test method One:

  First open:
  after C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\web.config find
  <trust level= "full" Originurl= "" "/>
  changed to
  <trust level=" High "originurl=" "/>

  And then open C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\web_hightrust.config
  inside there's a sentence:
  <securityclass Name= "RegistryPermission" description= "System.Security.Permissions.RegistryPermission, mscorlib, version=2.0.0.0, Culture=neutral, publickeytoken=b77a5c561934e089 "/>
  Delete this sentence, you can prevent reading the registry

After testing, the Web site OLE DB permissions were not available after performing the above operation, causing the Access database to be inaccessible.

Test method Two: ( do not use )

%systemroot%/servicepackfiles/i386/activeds.dll
%systemroot%/system32/activeds.dll
%systemroot%/system32/activeds.tlb
Search these two files, remove the user group and powers group, and leave only Administrators and system permissions

After testing, the reboot caused the 3389,80,1433 and other ports to not connect remotely. I contacted the computer room personnel to solve the problem.

Method Three (not tested):

Disable the Adsiis.dll user permission in the C:\WINDOWS\SYSTEM32\INETSRV directory to prevent traversal of IIS
but list server details and all processes cannot be resolved! It

is said to have side effects: there is a conflict with SQL Server that is not able to connect to the servers remotely (this issue has not been tested, personal feeling should be the reason for MSSQL is not set up)

Method Four:

<system.web>
<identity impersonate= "true"/>
</system.web>
Copy the above code to C:\WINDOWS\ Microsoft.net\framework\v2.0.50727\config\web.config

This method is tested to effectively prevent the "execute command" from listing the System Information "user Information" service.

Reprinted annotated Source: http://www.freethy.cn/?p=481