Simulates the intruder to examine the network attack(4)

Add date: 07/08/2008 Publishing date: 07/08/2008 Hits: 63

Total 5 pages, Current page:4, Jump to page:

2007-08-12 09:48: 45 218.205.238.6 reads in the webshell pony: in d:\ybcenter\gg3.asp shell remains QQ:183037, this person lands the server frequently afterward with hereafter the gate

2007-08-25 08:03: 15 218.28.24.118 once visited him before stays behind the operation database's webshell /system/unit/main.asp hereafter gate may glance over the sensitive database the information
2007-08-25 08:12: 45 218.28.24.118 reads in another webshell D:\ybcenter\ggsm.asp
Afterward, 218.28.24.118 with before stays behind the function quite entire webshell /Cnnsc.asp and /system/unit/Cnnsc.asp operate on frequently the server the document
2007-11-11 14:23: 23 218.28.24.118 operation database back door /service/asp.asp which once stayed behind with him visits the sensitive database the information
2007-08-25 08:27: 57 218.28.24.118 operation database back door /system/unit/sql.asp which once stayed behind with him visits the sensitive database the information
2007-11-11 11:02: 55 218.28.24.118 attempts operation database back door /yb/in_main3.asp which visited him once to stay behind to visit the sensitive database

2007-08-06 12:42: 41 218.19.22.152 writes down carries exe which script C:\down.vbs downloads is http://ray8701.3322.org/1.exe

2007-08-09 11:57: 16 218.19.98.147 writes ftp to download exe script c:\zxq.txt ftp the server 203.253.31.244 user kick1000 password 84460965 to download 1.exe
2007-08-26 07:43: 47 123.5.57.117 attempts to attack the server
2007-08-26 07:43: 47 123.5.57.117 writes ftp to download exe script c:\zxq.txt ftp the server 203.253.31.244 user kick1000 password 84460965 to download 1.exe

2007-12-10 12:41: 34 123.52.18.141 examines pours into

Fifth, the examination debarkation information examined whether to exist has a gram prosperous account.

Method: Inspects inside the registry the sam document to have same fv, inspects in the process in here not to discover that the existence has a gram prosperous account number.

Sixth, the examination system installation the diary, has not found the problem in here.

Seventh, examined that the IIS visit diary, has discovered the aggressor information in here.

2007-12-01 08:55: 16 220.175.79.231 examines pours into
2007-12-03 18:40: 48 218.28.68.126 examines pours into
2007-12-04 01:31: 32 218.28.192.90 examines pours into, scans the web table of contents
2007-12-04 23:23: 33 221.5.55.76 examines pours into
2007-12-05 09:20: 57 222.182.140.71 examines pours into
2007-12-08 09:39: 53 218.28.220.154 examines pours into
2007-12-08 21:31: 44 123.5.197.40 examines pours into
2007-12-09 05:32: 14 218.28.246.10 examines pours into
2007-12-09 08:47: 43 218.28.192.90 examines pours into
2007-12-09 16:50: 39 61.178.89.229 examines pours into
2007-12-10 05:50: 24 58.54.98.40 examines pours into

Locates the suspicious IP address, the tracing origin finds out the IP address the information.

Eighth, examined that the website home page the source code, in iframe this position examined whether to have does not belong to this website website information. (did search network horse's method), how as well as discover that some latent wooden horses and the network may use the crack.

Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * Next>>

Prev:Manual injection ASP script study

Next:Invades the chinalinux stand technical guidance

Comment:

Category: Home > hacker invade