Set IIS anti-WebShell trojan for Windows Security

1. Disable dangerous Webshell components in ASP environment:
 
Regsvr32/u wshom. ocx
# Uninstall the WScript. Shell component
Regsvr32/u shell32.dll
# Uninstall the Shell. application Component
Regsvr32/u scrrun. dll
# Uninstall the FSO object
Regsvr32/u msado15.dll
# Unload stream objects

2. Adjust the ASP. NET trust level in the ASPX environment. When ASPX runs ASPXspy and other Trojans, an error message is displayed:
Edit the Framework configuration file:
1
C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ CONFIG \ web. config

To:
 
<Location allowOverride = "false"> # Disable User-Defined Level
<System. web>
<SecurityPolicy>
<TrustLevel name = "Full" policyFile = "internal"/>
<TrustLevel name = "High" policyFile = "web_hightrust.config"/>
<TrustLevel name = "Medium" policyFile = "web_mediumtrust.config"/>
<TrustLevel name = "Low" policyFile = "web_lowtrust.config"/>
<TrustLevel name = "Minimal" policyFile = "web_minimaltrust.config"/>
</SecurityPolicy> www.2cto.com
<Trust level = "High" originUrl = ""/> # The level is High. The default value is full.
<Identity impersonate = "true"/>
</System. web>
</Location>

Each ASP. NET trust level has the following permissions:
 
Full: unrestricted permissions. Applications can access any resources that fall within the operating system security scope. Supports all privileged operations;
High: unhosted Code cannot be called, service components cannot be called, Event Logs can be written, Microsoft Message queues can be accessed, and ole db data sources can be accessed;
Medium: In addition to the preceding restrictions, access to files in the current application directory is also restricted, and access to the registry is not allowed;
Low: Except for the preceding restrictions, applications cannot be connected to SQL Server, and codes cannot call CodeAccessPermission. Assert (no asserted security permission );
Minimum: only the execution permission is required.

High-level prohibit reading the registry and edit the High-level configuration file:
1
C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ CONFIG \ web_hightrust.config

Delete Registry Permissions:
 
# Http://www.onovps.com
<SecurityClass Name = "RegistryPermission" Description = "System. Security. Permissions. RegistryPermission,
Mscorlib, Version = 2.0.0.0, Culture = neutral, PublicKeyToken = b77a5c561934e089 "/>

Then, set IIS to net to 2.0 and restart IIS.
 
Cd C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727
Aspnet_regiis-I

To disable IISSPY, you can also modify the following file permissions:
 
/Windows/system32/activeds. tlb
# Remove the read permission of the file Users Group and the Power Users Group