Many webmasters currently use IIS servers, especially for ASP websites. Preventing ASP Trojans has become the most critical aspect of website security.
Generally speaking, today's ASP Trojans often operate the server through the following four points, so we only need to set up the following four points to start from one
Many webmasters currently use IIS servers, especially for ASP websites. Preventing ASP Trojans has become the most critical aspect of website security.
Generally speaking, today's ASP Trojans often operate the server through the following four points, so we can effectively prevent the intrusion of ASP Trojans to a certain extent by setting up the following four points:
1. Use the FileSystemObject component
FileSystemObject can perform regular operations on files
You can prevent the harm of such Trojans by modifying the registry and renaming this component.
HKEY_CLASSES_ROOT/Scripting.FileSystemObject/
Change the name to another name, such as: FileSystemObject_ChangeName
You can use this to call this component normally when you call it in the future.
Also change the clsid value
HKEY_CLASSES_ROOT/Scripting.FileSystemObject/CLSID/value of the project
You can also delete it to prevent the harm of such Trojans.
Unregister this component command: RegSrv32 /u C:/WINNT/SYSTEM/scrrun.dll
Disable Guest users from using scrrun.dll to prevent this component from being called.
Use the command: cacls C:/WINNT/system32/scrrun.dll /e /d guests
2. Use WScript.Shell component
WScript.Shell can call the system kernel to run basic DOS commands
You can prevent the harm of such Trojans by modifying the registry and renaming this component.
HKEY_CLASSES_ROOT/WScript.Shell/and
HKEY_CLASSES_ROOT/WScript.Shell.1/
Change the name to another name, such as: WScript.Shell_ChangeName or WScript.Shell.1_ChangeName
You can use this to call this component normally when you call it in the future.
Also change the clsid value
HKEY_CLASSES_ROOT/WScript.Shell/CLSID/value of the project
HKEY_CLASSES_ROOT/WScript.Shell.1/CLSID/value of the project
You can also delete it to prevent the harm of such Trojans.
3. Use Shell.Application component
Shell.Application can call the system kernel to run basic DOS commands
You can prevent the harm of such Trojans by modifying the registry and renaming this component.
HKEY_CLASSES_ROOT/Shell.Application/and
HKEY_CLASSES_ROOT/Shell.Application.1/
Change the name to another name, such as: Shell.Application_ChangeName or Shell.Application.1_ChangeName
You can use this to call this component normally when you call it in the future.
You need to change the clsid value as well.
HKEY_CLASSES_ROOT/Shell.Application/CLSID/value of the project
HKEY_CLASSES_ROOT/Shell.Application/CLSID/value of the project
You can also delete it to prevent the harm of such Trojans.
Disable Guest users from using shell32.dll to prevent this component from being called.
Use the command: cacls C:/WINNT/system32/shell32.dll /e /d guests
Note: All operations require restarting the WEB service to take effect.
4. Call Cmd.exe
Disable Guests group users from calling cmd.exe
cacls C：/WINNT/system32/Cmd.exe /e /d guests