[Share] Cloud Server Malware Cleanup Example

When the website is accessed through Baidu search, it redirects to an abnormal website.

After careful analysis and verification, it was determined to be caused by malware injection, but no abnormal code was found in the webpage source files or by scanning with security tools.

A new empty file 1.html was created, and testing with tools also showed malware injection, indicating a system-level problem.

After checking site settings and other information, it was found that an abnormal dll had been added to IIS site > Modules, as shown in the figure.

Based on experience, paths beginning with %windir% are automatically added by the system and theoretically should not be a problem; if it is c:\windows, it needs to be carefully verified.

After analysis, this file is a Trojan virus file.

Delete the module loading and delete the file. After restarting IIS and testing, the malware injection disappears.

After analysis, the hacker mainly exploited Windows system security vulnerabilities, thereby causing some damage to the system.

Currently, problems mainly exist in Windows 2008 and Windows 2012 systems. Users using these two systems are strongly advised to upgrade to Windows 2016. For specific operations, refer to: https://www.west.cn/faq/list.asp?unid=2446

Or purchase a new cloud server in the same data center with the same configuration, install the 2016 system, migrate data to the new server yourself, then submit a ticket to transfer the time to the new server.

Security settings

If you cannot upgrade temporarily, please perform necessary security settings.

1. Install antivirus software or security control software, such as Yunlock.

2. Use an independent user process pool. (Just use our company's Website Building Assistant to create a site.)

3. Disable DCOM

Windows Administrative Tools > Component Services > right-click My Computer > Properties > Default Properties > uncheck Enable Distributed COM on this computer. If it is not checked by default, no action is needed.

4. Replace a process level token: remove all pool users, including the iis_users group.

Windows Administrative Tools > Local Security Policy > Local Policies > User Rights Assignment. The figure shows the correct permissions.

5. Impersonate a client after authentication: remove all pool users, including the iis_users group.

Windows Administrative Tools > Local Security Policy > Local Policies > User Rights Assignment. The figure shows the correct permissions.

These are temporary security settings and cannot ensure long-term security. It is recommended to upgrade to Windows 2016 as soon as possible to completely solve the problem.