使用如下sql存储过程清理被注入的木马等恶意程序代码:


SET QUOTED_IDENTIFIER OFF    

GO   

SET ANSI_NULLS OFF    

GO   

  

  

Create proc [dbo].[ReplaceKeyWord]   

  

@old nvarchar(100),   

  

@new nvarchar(100)   

  

as   

  

declare @sql nvarchar(1000)   

  

set @sql=N'    

  

declare   @s   nvarchar(4000),@tbname   sysname    

  

select   @s=N'''',@tbname=N''?''    

  

select   @s=@s+N'',''+quotename(a.name)+N''=replace(''+quotename(a.name)+N'',N'''''+@old+''''',N'''''+@new+''''')''    

  

from   syscolumns   a,systypes   b    

  

where   a.id=object_id(@tbname)       

  

and   a.xusertype=b.xusertype    

  

and   b.name   like   N''%char''    

  

if   @@rowcount>0    

  

begin    

  

set   @s=stuff(@s,1,1,N'''')    

  

exec(N''update   ''+@tbname+''   set   ''+@s)    

  

end '   

  

--print @sql   

  

exec   sp_msforeachtable   @sql;   

  

set @sql=N'    

  

declare   @s   nvarchar(4000),@tbname   sysname    

  

select   @s=N'''',@tbname=N''?''    

  

select   @s=@s+quotename(a.name)+N'',''   

  

from   syscolumns   a,systypes   b    

  

where   a.id=object_id(@tbname)       

  

and   a.xusertype=b.xusertype    

  

and   b.name   like   N''%text''    

  

if   @@rowcount>0    

  

begin    

  

exec UpdateTextColumn @tbname,@s,'''+@old+''','''+@new+'''   

  

end   

  

' ;   

  

exec   sp_msforeachtable @sql   

  

GO   

SET QUOTED_IDENTIFIER OFF    

GO   

SET ANSI_NULLS ON    

GO   

  

SET QUOTED_IDENTIFIER OFF    

GO   

SET ANSI_NULLS OFF    

GO   

  

  

CREATE proc [dbo].[UpdateTextColumn]   

  

@Table varchar(100),   

  

@Columns varchar(200),--eg:Column1,Column2,   

  

@old varchar(100),   

  

@new varchar(100)   

  

as   

  

    set nocount on   

  

    declare @sql nvarchar(2000)   

  

    declare @Column varchar(50)   

  

    declare @cpos int,@npos int   

  

    set @cpos=1;   

  

    set @npos=1;   

  

    set @npos=charindex(',',@Columns,@cpos);   

  

    while(@npos>0)   

  

    begin   

  

        set @Column = substring(@Columns,@cpos,@npos-@cpos);   

  

        set @cpos = @npos+1   

  

        set @npos=charindex(',',@Columns,@cpos);   

  

           

  

        set @sql = 'update '+@Table+' set '+@Column+'=replace(cast('+@Column+' as varchar(8000)),@old,@new) where Datalength('+@Column+')<=8000';   

  

        EXECUTE sp_executesql @Sql,   

  

                           N'@old varchar(100),@new varchar(100)',   

  

                           @old,   

  

                           @new   

  

        declare @ptr binary(16) ,@offset int,@dellen int   

  

           

  

        set @dellen = len(@old)   

  

           

  

        set @offset = 1  

  

        while @offset>=1   

  

        begin   

  

            set @offset = 0  

  

            set @sql = 'select     top 1 @offset = charindex('''+@old+''' , '+@Column+'), @ptr = textptr('+@Column+') from '+@Table+' where Datalength('+@Column+')>8000 and '+@Column+' like ''%'+@old+'%''';   

  

            EXEC sp_executesql @Sql,N'@offset int OUTPUT,@ptr binary(16) OUTPUT,@old varchar(100)',   

  

                               @offset OUTPUT,@ptr OUTPUT,@old;   

  

           if @offset > 0   

  

            begin   

  

                set @offset = @offset-1   

  

                set @sql='updatetext '+@Table+'.'+@Column+' @ptr @offset @dellen @new';   

  

                EXEC sp_executesql @Sql,N'@offset int ,@ptr binary(16),@dellen int,@new varchar(100)',@offset,@ptr,@dellen,@new;   

  

            end    

  

        end   

  

end   

  

GO   

SET QUOTED_IDENTIFIER OFF    

GO   

SET ANSI_NULLS ON    

GO
exec ReplaceKeyWord '需要替换的字符','替换成的新字符'
exec ReplaceKeyWord '<iframe src=... width=0 height=0></iframe>',''