Ali cloud server ECS how do Trojan virus infection

This paper provides a cloud server ECS solutions and late defense against the virus after infection.

• Solution after infection
• Virus defense methods

Solution after infection

By doing the following, the cloud server processing ECS ​​after infection.

1. To change the administrator password for the account. It recommends that the password is not less than 8, and the uppercase letters, lowercase letters, numbers, special character combination.
2. Modify the telnet port.
3. Windows operating systems: Windows examples of how to view and modify the default port for Remote Desktop
   • Linux operating system: modify /etc/ssh/sshd_configfile corresponding port number, restart sshd service.
4. Turn on the firewall restrictions to allow IP address to log in, the firewall is only open specific service port. Recommended source IP access control for FTP, database, etc. These do not need to be open to all users of the service.
   
   • Windows operating systems: how to configure the Windows firewall instance of the remote connection
   • Linux: How ECS cloud server instance to configure the default firewall Firewall
5. Check for unauthorized open ports, and if so, shut down unauthorized ports.
   • Windows operating system: In the CMD command line, enter the netstat /anocommand to check port.
   • Linux operating system: Execute netstat -anpcommand.
6. Check for strange anomalies in the running process, if there is, then shut down the process, and the server administrator to confirm whether this exception can delete files used by the process.
   • Check the Windows operating system: Select Start> Run, enter msinfo32, select Software Environment> running task, to be checked.
   • Linux System Check: by executing ps -efor topviewing command.
7. Install anti-virus killing the Trojan software, the server comprehensive virus scanning and killing. We recommend the use of cloud shield Ann Knight .
   • If you need to remove the unknown account in the system, Windows systems also need to check whether the SAM registry keys are hidden accounts.
   • If you have a Web service, the Web accounts limit access to the file system, open only read-only access.

Virus defense methods

, Cloud server ECS defense by the following procedure.

1. Open cloud shield Ann Knight, escort cloud server ECS, which focuses on the use of the following functions.
   • Safety Precautions - Vulnerability Management: comprehensive vulnerability management, asset vulnerability allows you to minimize the risk.
   • Intrusion Detection - Exception Log: record all login information, real-time alerts to log in with the very act freely configurable commonly used to login.
   • IDS - Website backdoor: backdoor server on a real-time detection.
   • Intrusion Detection - host exception: malicious process and malicious downloads or other abnormal source connected real-time detection and alarm.
2. Cloud shield other protective features, including the following features.
   • Web Application Firewall : You can prevent hackers exploit web application vulnerabilities invasion server, and a professional security team time to focus on domestic security dynamics, new loopholes, will immediately update your protection rules to prevent hackers use exploits new site if it is found.
   • · Cloud shield situational awareness: provide ECS, RDS, SLB products such as cloud security configuration detection. Help you expand your security visibility, focus on asset management cloud security incidents.
   • · Cloud shield security steward: Ali Ali cloud security butler service is a cloud-based security expert Ali cloud security best practices for many years experience for users on the cloud provides a full range of security technologies and consulting services, users establish and continuously optimized cloud on cloud security defense system to protect user traffic safety.
3. Change the password for all accounts, including the following password. It recommends that the password is not less than 8 and uppercase letters, lowercase letters, numbers, special character combination.
   • Server login password
   • Database connection password
   • Website background passwords
   • FTP password
   • Other server password management software
4. Reinforcement system.
   • Hide website background. As far as possible under the premise to ensure the normal operation of the site, using a multi-character name directory website background. Examples are as follows.
      

     / Mamashuomingziyaochangyidianheikecaizhaobudao /

   • Update the operating system and application vulnerabilities of fixes.