Microsoft has gone on the defensive in the massive SQL injection attack that has hit websites running the company's Internet Information Services web server and SQL Server products.