How to quickly determine whether the server has been maliciously invaded

The author makes a simple description of the common hosted server and VPS host using Windows Server system and how to troubleshoot malicious intrusion and provides a simple and corresponding solution.

First Steps, Checking System Groups and Users
My Computer——Right Management ——Local Users and Groups——Groups

Checking the Administrators Group Is there a user account other than the administrator user account (default is administrator).

Check if there is a non-system default account or an administrator-specified account in the users group.

Local Users and Groups ——Users

Check for users who are not commented or have an abnormal name.

Generally, the server that is compromised after the software will add an admin$ or similar user in the administrators group. Once you find this type of user, you should first avoid running any programs, stop all services, and use antivirus in time. The software performs a complete scan of the key areas of the server (starting the resident, C disk system folder user-defined folder) to avoid secondary cross-infection of the Trojan.

Second Step, Check Administrator Account for Abnormal Login and Logout History
My Computer ——Right Management ——Event Viewer——Security

Filter all events with event IDs 576 and 528 (576 is the system logout 528 for the system logout) to view the contents of the specific event information. There will be a login IP in the content. Check if the IP is the IP that the administrator frequently logs in.

Step 3, check if the server has an abnormal login startup item
Start menu ——All programs——Start

This directory is by default It should be an empty directory, but if an abnormal .bat program appears, you should scan the server in full to confirm server security.

Start Menu ——Run

msconfig

Start the menu bar to see if there is a startup project with a named exception, such as A.EXE XXXXI1SU2.EXE, etc. Scan the server to confirm server security.

Start Menu ——Run

regedit

hkey_current_user—software—micorsoft—windows—currentversion-run

hkey_current_machine—software—micorsoft—windows&mdash ;currentversion-run

Check for exceptions in the above 2 items.

In general, if the above three steps check that there is no abnormality, it can be basically determined that the security environment of the server is non-faulty.