问题： ORACLE数据库的勒索病毒是一个老话题了，2016/2017年时候爆发过一波，当时主要是PLSQ DEV/TOAD等工具的登陆数据库脚本被注入病毒；近期又有客户中招，所幸发现及时，相应的存储过程并未爆发，因此将相应的病毒存入过程删除即可。该客户也使用了堡垒机，但是还有部分维护人员是可以直连的,所以中招了。

后续处理： 建议用户限制dba 权限，所有员工的数据库连接工具从内网的统一软件平台下载，杜绝从互联网下载。
同时发动员工检查所用数据库管理工具如下部位：
sqlplus中的glogin.sql/login.sql
toad中的toad.ini
plsql dev中的login.sql/afterconnect.sql

检查信息如下：
1）数据库里面查询下，如果有这些对象，及时给与清理（注意% ‘中间有空格）
select 'DROP TRIGGER '||owner||'."'||TRIGGER_NAME||'";' aaaom dba_triggers where
TRIGGER_NAME like 'DBMS_%_INTERNAL% '
union all
select 'DROP PROCEDURE '||owner||'."'||a.object_name||'";' aaaom dba_procedures a 
where a.object_name like 'DBMS_%_INTERNAL% ' order by 1;

--注意% '之间的空格

SQL> select 'DROP TRIGGER '||owner||'."'||TRIGGER_NAME||'";' aaaom dba_triggers where
  2  TRIGGER_NAME like 'DBMS_%_INTERNAL% '
  3  union all
  4  select 'DROP PROCEDURE '||owner||'."'||a.object_name||'";' aaaom dba_procedures a
  5  where a.object_name like 'DBMS_%_INTERNAL% ' order by 1;

'DROPTRIGGER'||OWNER||'."'||TRIGGER_NAME||'";'
--------------------------------------------------------------------------------
DROP PROCEDURE aaa."DBMS_CORE_INTERNAL         ";
DROP PROCEDURE aaa."DBMS_CORE_INTERNAL         ";
DROP PROCEDURE aaa."DBMS_SYSTEM_INTERNAL         ";
DROP PROCEDURE aaaUSER."DBMS_CORE_INTERNAL         ";
DROP PROCEDURE aaaUSER."DBMS_CORE_INTERNAL         ";
DROP PROCEDURE aaaUSER."DBMS_SYSTEM_INTERNAL         ";
DROP PROCEDURE SYSTEM."DBMS_CORE_INTERNAL         ";
DROP PROCEDURE SYSTEM."DBMS_CORE_INTERNAL         ";
DROP PROCEDURE SYSTEM."DBMS_SUPPORT_INTERNAL         ";
DROP PROCEDURE SYSTEM."DBMS_SYSTEM_INTERNAL         ";
DROP PROCEDURE SYSTEM."DBMS_SYSTEM_INTERNAL         ";
DROP TRIGGER aaa."DBMS_CORE_INTERNAL         ";
DROP TRIGGER aaaUSER."DBMS_CORE_INTERNAL         ";
DROP TRIGGER SYSTEM."DBMS_CORE_INTERNAL         ";
DROP TRIGGER SYSTEM."DBMS_SUPPORT_INTERNAL         ";
DROP TRIGGER SYSTEM."DBMS_SYSTEM_INTERNAL         ";

已选择16行。
SQL> select dbid,name,to_char(created,'yyyymmdd hh24:mi:ss') aaaom v$database;

      DBID NAME               TO_CHAR(CREATED,'YYYYMMDDHH24:MI:S
---------- ------------------ ----------------------------------
3735788888 AAAORCL             20170419 12:08:05