Client Server hacked

Intermediary transaction http://www.aliyun.com/zixun/aggregation/6858.html ">seo diagnose Taobao guest cloud host technology Hall

Today, half day bubble in the computer room, the client machine was hacked, data backup did not do, finally thanks to the customer to do the site there is a previous backup, Dizzy dead! Last night 11:30, the customer call me said server remote connection number exceeds the maximum number of connections, let me restart the server----I will reboot!!

Probably after 10 minutes, the customer calls over----frightened to say that the username and password can't go in!! I asked what's going on! He said up to find more than two users, IIS tied on a Web site---he directly to the two users to delete, the site also directly deleted, and then he was kicked out, even the machine is not even on the!!

Obviously made two mistakes, first: This situation do not panic, first of all the Web site of the binding to save the screen, including time, this is evidence.

Second: View the system and security log, save the log and then analyze the log (analysis must ensure that you have complete data stored outside the third party of the server, so that the problem can be recovered quickly.) This will help you find out where your machine is, how to prevent similar things, and not just delete users and data blindly.

When there is no backup data, the network card must be disabled or notify the computer room unplug the network cable, to the computer room on-site processing---analysis log to make up for the best to redo the system. Brothers on the stand must not make such a mistake!! Another backup is the best way to prevent, although it is the most original but also the most insurance way!!