{"id":476395,"date":"2023-08-09T07:28:31","date_gmt":"2023-08-09T07:28:31","guid":{"rendered":""},"modified":"2023-09-05T11:12:38","modified_gmt":"2023-09-05T11:12:38","slug":"conficker-worm","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/conficker-worm\/","title":{"rendered":"\u98de\u514b\u8815\u866b"},"content":{"rendered":"<p>Conficker \u8815\u866b\u662f\u4e00\u79cd\u81ed\u540d\u662d\u8457\u7684\u8ba1\u7b97\u673a\u8815\u866b\uff0c\u56e0\u5176\u5feb\u901f\u4f20\u64ad\u548c\u7834\u574f\u80fd\u529b\u800c\u58f0\u540d\u72fc\u85c9\u3002\u5b83\u4e8e 2008 \u5e74\u5e95\u9996\u6b21\u88ab\u53d1\u73b0\uff0c\u5f88\u5feb\u6210\u4e3a\u6700\u4e25\u91cd\u548c\u6700\u666e\u904d\u7684\u6076\u610f\u8f6f\u4ef6\u5a01\u80c1\u4e4b\u4e00\uff0c\u611f\u67d3\u4e86\u5168\u7403\u6570\u767e\u4e07\u53f0\u8ba1\u7b97\u673a\u3002Conficker \u80fd\u591f\u901a\u8fc7\u7f51\u7edc\u6f0f\u6d1e\u4f20\u64ad\u5e76\u9003\u907f\u68c0\u6d4b\uff0c\u8fd9\u4f7f\u5b83\u6210\u4e3a\u7f51\u7edc\u5b89\u5168\u4e13\u5bb6\u7684\u68d8\u624b\u5bf9\u624b\u3002\u672c\u6587\u6df1\u5165\u63a2\u8ba8\u4e86 Conficker \u8815\u866b\u7684\u5386\u53f2\u3001\u7ed3\u6784\u3001\u529f\u80fd\u548c\u672a\u6765\u7684\u6f5c\u5728\u5f71\u54cd\uff0c\u63a2\u8ba8\u4e86\u5b83\u5bf9\u7f51\u7edc\u5b89\u5168\u683c\u5c40\u7684\u5f71\u54cd\u3002<\/p>\n<h2>Conficker \u8815\u866b\u7684\u8d77\u6e90\u5386\u53f2\u53ca\u5176\u9996\u6b21\u63d0\u53ca<\/h2>\n<p>Conficker \u8815\u866b\u75c5\u6bd2\uff0c\u53c8\u540d Downup\u3001Downadup \u6216 Kido\uff0c\u4e8e 2008 \u5e74 11 \u6708\u9996\u6b21\u88ab\u53d1\u73b0\u3002\u5176\u6700\u521d\u7684\u76ee\u6807\u662f Microsoft Windows \u64cd\u4f5c\u7cfb\u7edf\uff0c\u5229\u7528 Windows Server \u670d\u52a1\u4e2d\u7684\u4e00\u4e2a\u5173\u952e\u6f0f\u6d1e (MS08-067)\u3002\u8be5\u8815\u866b\u75c5\u6bd2\u901a\u8fc7\u7f51\u7edc\u5171\u4eab\u548c\u53ef\u79fb\u52a8\u5b58\u50a8\u8bbe\u5907\u4f20\u64ad\uff0c\u91c7\u7528\u591a\u79cd\u4f20\u64ad\u673a\u5236\u6765\u6e17\u900f\u65b0\u7cfb\u7edf\u3002<\/p>\n<h2>\u6709\u5173 Conficker \u8815\u866b\u7684\u8be6\u7ec6\u4fe1\u606f\u3002\u6269\u5c55\u4e3b\u9898 Conficker \u8815\u866b<\/h2>\n<p>Conficker \u8815\u866b\u75c5\u6bd2\u5177\u6709\u591a\u79cd\u72ec\u7279\u7279\u5f81\uff0c\u8fd9\u4e9b\u7279\u5f81\u4f7f\u5176\u58f0\u540d\u72fc\u85c9\u3002\u4e3b\u8981\u7279\u5f81\u5305\u62ec\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u4f20\u64ad<\/strong>\uff1aConficker \u4e3b\u8981\u901a\u8fc7\u7f51\u7edc\u5171\u4eab\u8fdb\u884c\u4f20\u64ad\uff0c\u5229\u7528\u5f31\u5bc6\u7801\u5e76\u5229\u7528\u4e0a\u8ff0 Windows \u6f0f\u6d1e (MS08-067)\u3002\u5b83\u8fd8\u53ef\u4ee5\u901a\u8fc7 USB \u9a71\u52a8\u5668\u548c\u5176\u4ed6\u53ef\u79fb\u52a8\u5a92\u4f53\u611f\u67d3\u7cfb\u7edf\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u591a\u6001\u4ee3\u7801<\/strong>\uff1a\u4e3a\u4e86\u9003\u907f\u68c0\u6d4b\uff0cConficker \u4f7f\u7528\u591a\u6001\u4ee3\u7801\uff0c\u6bcf\u6b21\u611f\u67d3\u540e\u5176\u5916\u89c2\u548c\u7279\u5f81\u90fd\u4f1a\u53d1\u751f\u53d8\u5316\u3002\u8fd9\u4f7f\u5f97\u4f20\u7edf\u7684\u57fa\u4e8e\u7b7e\u540d\u7684\u9632\u75c5\u6bd2\u8f6f\u4ef6\u5f88\u96be\u8bc6\u522b\u548c\u5220\u9664\u8be5\u8815\u866b\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u57df\u751f\u6210\u7b97\u6cd5\uff08DGA\uff09<\/strong>\uff1aConficker \u4f7f\u7528 DGA \u751f\u6210\u5927\u91cf\u4f2a\u968f\u673a\u57df\u540d\u3002\u7136\u540e\uff0c\u5b83\u4f1a\u5c1d\u8bd5\u8054\u7cfb\u8fd9\u4e9b\u57df\u540d\u4ee5\u4e0b\u8f7d\u66f4\u65b0\u6216\u5176\u4ed6\u6709\u6548\u8d1f\u8f7d\uff0c\u4ece\u800c\u4f7f\u5176\u63a7\u5236\u57fa\u7840\u8bbe\u65bd\u52a8\u6001\u5316\u4e14\u96be\u4ee5\u88ab\u7834\u574f\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u6709\u6548\u8d1f\u8f7d\u4ea4\u4ed8<\/strong>\uff1a\u5c3d\u7ba1 Conficker \u6ca1\u6709\u4e13\u95e8\u7528\u4e8e\u7834\u574f\u6570\u636e\u7684\u6709\u6548\u8f7d\u8377\uff0c\u4f46\u5b83\u53ef\u4ee5\u4f20\u64ad\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\uff0c\u4f8b\u5982\u6050\u5413\u8f6f\u4ef6\u6216\u6076\u610f\u5b89\u5168\u8f6f\u4ef6\uff0c\u4ece\u800c\u5bf9\u53d7\u611f\u67d3\u7684\u7cfb\u7edf\u9020\u6210\u6f5c\u5728\u7684\u6709\u5bb3\u540e\u679c\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u81ea\u6211\u9632\u5fa1\u673a\u5236<\/strong>\uff1a\u8be5\u8815\u866b\u91c7\u7528\u4e86\u590d\u6742\u7684\u81ea\u6211\u9632\u5fa1\u673a\u5236\u6765\u4fdd\u62a4\u81ea\u5df1\u514d\u53d7\u68c0\u6d4b\u548c\u5220\u9664\u5c1d\u8bd5\uff0c\u5305\u62ec\u7981\u7528\u5b89\u5168\u670d\u52a1\u548c\u963b\u6b62\u8bbf\u95ee\u9632\u75c5\u6bd2\u7f51\u7ad9\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>Conficker \u8815\u866b\u7684\u5185\u90e8\u7ed3\u6784\u3002Conficker \u8815\u866b\u7684\u5de5\u4f5c\u539f\u7406<\/h2>\n<p>Conficker\u8815\u866b\u75c5\u6bd2\u7684\u5185\u90e8\u7ed3\u6784\u975e\u5e38\u590d\u6742\uff0c\u5176\u8bbe\u8ba1\u76ee\u7684\u662f\u4e3a\u4e86\u4fbf\u4e8e\u5feb\u901f\u590d\u5236\u548c\u9003\u907f\u68c0\u6d4b\u3002\u5176\u5de5\u4f5c\u6d41\u7a0b\u53ef\u4ee5\u6982\u62ec\u5982\u4e0b\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u611f\u67d3<\/strong>\uff1a\u8be5\u8815\u866b\u5229\u7528\u7f51\u7edc\u5171\u4eab\u3001\u5f31\u5bc6\u7801\u6216 MS08-067 \u6f0f\u6d1e\u611f\u67d3\u6613\u53d7\u653b\u51fb\u7684\u7cfb\u7edf\u3002\u5b83\u8fd8\u53ef\u4ee5\u901a\u8fc7\u8fde\u63a5\u7684 USB \u9a71\u52a8\u5668\u4e0a\u7684\u81ea\u52a8\u8fd0\u884c\u548c\u5f31\u7f51\u7edc\u5171\u4eab\u8fdb\u884c\u4f20\u64ad\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u4f20\u64ad<\/strong>\uff1a\u6210\u529f\u611f\u67d3\u540e\uff0cConficker \u4f1a\u626b\u63cf\u672c\u5730\u7f51\u7edc\u548c\u8fde\u63a5\u7684\u8bbe\u5907\uff0c\u67e5\u627e\u5176\u4ed6\u6613\u53d7\u653b\u51fb\u7684\u673a\u5668\uff0c\u5e76\u8fc5\u901f\u901a\u8fc7\u7f51\u7edc\u4f20\u64ad\u3002<\/p>\n<\/li>\n<li>\n<p><strong>DLL \u7ec4\u4ef6<\/strong>\uff1aConficker \u5728\u53d7\u611f\u67d3\u7684\u7cfb\u7edf\u4e0a\u521b\u5efa\u4e00\u4e2a\u52a8\u6001\u94fe\u63a5\u5e93 (DLL) \u7ec4\u4ef6\uff0c\u8be5\u7ec4\u4ef6\u5145\u5f53\u4e3b\u8981\u6709\u6548\u8f7d\u8377\u4e0b\u8f7d\u7a0b\u5e8f\u3002\u6b64 DLL \u88ab\u6ce8\u5165\u5230 Windows \u8fdb\u7a0b\u4e2d\uff0c\u4ee5\u5b9e\u73b0\u9690\u8eab\u548c\u6301\u4e45\u6027\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u57df\u751f\u6210\u7b97\u6cd5\uff08DGA\uff09<\/strong>\uff1aConficker \u6839\u636e\u5f53\u524d\u65e5\u671f\u751f\u6210\u4f2a\u968f\u673a\u57df\u540d\u5217\u8868\uff0c\u5e76\u5c1d\u8bd5\u8054\u7cfb\u5b83\u4eec\u4ee5\u4e0b\u8f7d\u66f4\u65b0\u6216\u5176\u4ed6\u6076\u610f\u8d1f\u8f7d\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u81ea\u6211\u9632\u5907<\/strong>\uff1a\u8be5\u8815\u866b\u91c7\u7528\u4e86\u5404\u79cd\u81ea\u6211\u9632\u5fa1\u673a\u5236\uff0c\u4f8b\u5982\u7981\u7528 Windows \u670d\u52a1\u3001\u963b\u6b62\u8bbf\u95ee\u4e0e\u5b89\u5168\u76f8\u5173\u7684\u7f51\u7ad9\u4ee5\u53ca\u79ef\u6781\u62b5\u6297\u5220\u9664\u5c1d\u8bd5\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u547d\u4ee4\u4e0e\u63a7\u5236 (C&amp;C)<\/strong>\uff1aConficker \u901a\u8fc7 DGA \u751f\u6210\u7684\u57df\u6216\u5176\u4ed6\u65b9\u5f0f\u4e0e\u5176\u547d\u4ee4\u548c\u63a7\u5236\u670d\u52a1\u5668\u5efa\u7acb\u901a\u4fe1\uff0c\u63a5\u6536\u6765\u81ea\u653b\u51fb\u8005\u7684\u547d\u4ee4\u548c\u66f4\u65b0\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>Conficker \u8815\u866b\u5173\u952e\u7279\u5f81\u5206\u6790<\/h2>\n<p>Conficker \u8815\u866b\u75c5\u6bd2\u7684\u4e3b\u8981\u7279\u5f81\u4f7f\u5176\u5177\u6709\u6781\u5f3a\u7684\u6062\u590d\u80fd\u529b\u548c\u5e7f\u6cdb\u7684\u5f71\u54cd\u8303\u56f4\u3002\u8fd9\u4e9b\u7279\u5f81\u5305\u62ec\uff1a<\/p>\n<ul>\n<li>\n<p><strong>\u5feb\u901f\u4f20\u64ad<\/strong>\uff1aConficker \u80fd\u591f\u901a\u8fc7\u7f51\u7edc\u5171\u4eab\u548c USB \u9a71\u52a8\u5668\u5feb\u901f\u4f20\u64ad\uff0c\u4ece\u800c\u5728\u77ed\u65f6\u95f4\u5185\u5b9e\u73b0\u5927\u9762\u79ef\u611f\u67d3\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u591a\u6001\u4ee3\u7801<\/strong>\uff1a\u4f7f\u7528\u591a\u6001\u4ee3\u7801\u4f7f\u5f97 Conficker \u80fd\u591f\u5728\u6bcf\u6b21\u611f\u67d3\u65f6\u6539\u53d8\u5176\u5916\u89c2\uff0c\u4ece\u800c\u632b\u8d25\u4f20\u7edf\u7684\u57fa\u4e8e\u7b7e\u540d\u7684\u68c0\u6d4b\u65b9\u6cd5\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u52a8\u6001 C&amp;C<\/strong>\uff1aConficker \u57fa\u4e8e DGA \u7684\u547d\u4ee4\u548c\u63a7\u5236\u57fa\u7840\u8bbe\u65bd\u4f7f\u5f97\u5b89\u5168\u4e13\u5bb6\u5f88\u96be\u9884\u6d4b\u548c\u963b\u6b62\u5176\u901a\u4fe1\u6e20\u9053\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u81ea\u6211\u9632\u5fa1\u673a\u5236<\/strong>\uff1a\u8815\u866b\u7684\u81ea\u6211\u9632\u5fa1\u673a\u5236\u963b\u788d\u4e86\u6e05\u9664\u5de5\u4f5c\uff0c\u5e76\u5ef6\u957f\u4e86\u5176\u5728\u53d7\u611f\u67d3\u7cfb\u7edf\u4e2d\u7684\u5b58\u5728\u65f6\u95f4\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u957f\u5bff<\/strong>\uff1aConficker \u6301\u7eed\u6d41\u884c\u6570\u5e74\uff0c\u8bc1\u660e\u4e86\u5176\u5bf9\u7f51\u7edc\u5b89\u5168\u63aa\u65bd\u7684\u9002\u5e94\u6027\u548c\u5f39\u6027\u3002<\/p>\n<\/li>\n<\/ul>\n<h2>Conficker \u8815\u866b\u7684\u7c7b\u578b<\/h2>\n<p>Conficker \u8815\u866b\u6709\u591a\u4e2a\u53d8\u79cd\uff0c\u6bcf\u4e2a\u53d8\u79cd\u90fd\u6709\u5176\u72ec\u7279\u7684\u7279\u5f81\u548c\u8fdb\u5316\u53d8\u5316\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u91cd\u8981\u7684 Conficker \u53d8\u79cd\u7684\u5217\u8868\uff1a<\/p>\n<table>\n<thead>\n<tr>\n<th>\u53d8\u4f53\u540d\u79f0<\/th>\n<th>\u68c0\u6d4b\u5e74\u4efd<\/th>\n<th>\u663e\u8457\u7279\u70b9<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u98de\u5ba2A<\/td>\n<td>2008<\/td>\n<td>\u9996\u6b21\u68c0\u6d4b\u5230\u5177\u6709\u521d\u59cb MS08-067 \u6f0f\u6d1e\u7684\u53d8\u4f53\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u98de\u5ba2B<\/td>\n<td>2009<\/td>\n<td>\u6539\u8fdb\u4e86\u4f20\u64ad\u65b9\u6cd5\u5e76\u589e\u52a0\u4e86\u81ea\u6211\u9632\u5fa1\u80fd\u529b\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u98de\u514b<\/td>\n<td>2009<\/td>\n<td>\u4e3a C&amp;C \u901a\u4fe1\u5f15\u5165\u4e86 DGA\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u98de\u514b<\/td>\n<td>2009<\/td>\n<td>\u589e\u5f3a\u7684\u52a0\u5bc6\u548c\u66f4\u5f3a\u5927\u7684 DGA \u529f\u80fd\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u98de\u514b<\/td>\n<td>2009<\/td>\n<td>\u5f3a\u5316 DGA \u548c\u989d\u5916\u7684\u4f20\u64ad\u8f7d\u4f53\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Conficker \u8815\u866b\u7684\u4f7f\u7528\u65b9\u6cd5\u3001\u4f7f\u7528\u8fc7\u7a0b\u4e2d\u51fa\u73b0\u7684\u95ee\u9898\u53ca\u89e3\u51b3\u65b9\u6cd5<\/h2>\n<p>\u503c\u5f97\u6ce8\u610f\u7684\u662f\uff0cConficker \u8815\u866b\u662f\u4e00\u79cd\u6076\u610f\u8f6f\u4ef6\uff0c\u4f7f\u7528\u5b83\u662f\u975e\u6cd5\u548c\u4e0d\u9053\u5fb7\u7684\u3002Conficker \u7684\u4e3b\u8981\u76ee\u7684\u662f\u611f\u67d3\u548c\u7834\u574f\u6613\u53d7\u653b\u51fb\u7684\u7cfb\u7edf\uff0c\u4ee5\u5229\u4e8e\u653b\u51fb\u8005\u3002\u8be5\u8815\u866b\u80fd\u591f\u4f20\u64ad\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\u6216\u521b\u5efa\u50f5\u5c38\u7f51\u7edc\uff0c\u8fd9\u5bf9\u53d7\u611f\u67d3\u7684\u7528\u6237\u6784\u6210\u4e86\u4e25\u91cd\u7684\u5b89\u5168\u548c\u9690\u79c1\u98ce\u9669\u3002<\/p>\n<p>\u4e0e Conficker \u8815\u866b\u76f8\u5173\u7684\u95ee\u9898\u5305\u62ec\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u4f20\u64ad<\/strong>\uff1aConficker \u5728\u7f51\u7edc\u4e2d\u7684\u5feb\u901f\u4f20\u64ad\u53ef\u80fd\u5bfc\u81f4\u5927\u8303\u56f4\u611f\u67d3\u5e76\u59a8\u788d\u6574\u4f53\u7f51\u7edc\u6027\u80fd\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u6570\u636e\u76d7\u7a83<\/strong>\uff1a\u867d\u7136 Conficker \u4e0d\u662f\u76f4\u63a5\u7684\u6709\u6548\u8f7d\u8377\uff0c\u4f46\u5b83\u53ef\u4ee5\u4f5c\u4e3a\u653b\u51fb\u8005\u4ece\u53d7\u611f\u67d3\u7cfb\u7edf\u7a83\u53d6\u654f\u611f\u6570\u636e\u7684\u7f51\u5173\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u50f5\u5c38\u7f51\u7edc\u7684\u521b\u5efa<\/strong>\uff1a\u53d7\u611f\u67d3\u7684\u7cfb\u7edf\u53ef\u88ab\u5229\u7528\u6765\u5f62\u6210\u50f5\u5c38\u7f51\u7edc\uff0c\u4f7f\u7f51\u7edc\u72af\u7f6a\u5206\u5b50\u80fd\u591f\u53d1\u8d77\u5206\u5e03\u5f0f\u62d2\u7edd\u670d\u52a1 (DDoS) \u653b\u51fb\u548c\u5176\u4ed6\u6076\u610f\u6d3b\u52a8\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5931\u53bb\u63a7\u5236<\/strong>\uff1a\u4e00\u65e6\u7cfb\u7edf\u88ab\u611f\u67d3\uff0c\u7528\u6237\u5c31\u4f1a\u5931\u53bb\u5bf9\u5176\u673a\u5668\u7684\u63a7\u5236\uff0c\u4ece\u800c\u5bb9\u6613\u53d7\u5230\u8fdc\u7a0b\u64cd\u7eb5\u3002<\/p>\n<\/li>\n<\/ol>\n<p>\u51cf\u8f7b Conficker \u8815\u866b\u5f71\u54cd\u7684\u89e3\u51b3\u65b9\u6848\u5305\u62ec\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u8865\u4e01\u7ba1\u7406<\/strong>\uff1a\u5b9a\u671f\u5bf9\u64cd\u4f5c\u7cfb\u7edf\u548c\u8f6f\u4ef6\u5e94\u7528\u5b89\u5168\u66f4\u65b0\u548c\u8865\u4e01\uff0c\u4ee5\u9632\u6b62\u5229\u7528\u5df2\u77e5\u6f0f\u6d1e\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5f3a\u5bc6\u7801<\/strong>\uff1a\u5f3a\u5236\u4f7f\u7528\u5f3a\u5927\u4e14\u552f\u4e00\u7684\u5bc6\u7801\u6765\u4fdd\u62a4\u7f51\u7edc\u5171\u4eab\u548c\u7528\u6237\u5e10\u6237\uff0c\u9632\u6b62\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u9632\u75c5\u6bd2\u548c\u53cd\u6076\u610f\u8f6f\u4ef6<\/strong>\uff1a\u4f7f\u7528\u5177\u6709\u6700\u65b0\u7b7e\u540d\u7684\u77e5\u540d\u5b89\u5168\u8f6f\u4ef6\u6765\u68c0\u6d4b\u548c\u5220\u9664\u6076\u610f\u8f6f\u4ef6\uff0c\u5305\u62ec Conficker\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u7981\u7528\u81ea\u52a8\u8fd0\u884c<\/strong>\uff1a\u5173\u95ed\u53ef\u79fb\u52a8\u5a92\u4f53\u4e0a\u7684\u81ea\u52a8\u8fd0\u884c\u529f\u80fd\uff0c\u964d\u4f4e\u8fde\u63a5 USB \u9a71\u52a8\u5668\u65f6\u81ea\u52a8\u611f\u67d3\u7684\u98ce\u9669\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>\u4e3b\u8981\u7279\u5f81\u4ee5\u53ca\u4e0e\u7c7b\u4f3c\u672f\u8bed\u7684\u5176\u4ed6\u6bd4\u8f83\u4ee5\u8868\u683c\u548c\u5217\u8868\u7684\u5f62\u5f0f<\/h2>\n<table>\n<thead>\n<tr>\n<th>\u7279\u5f81<\/th>\n<th>\u98de\u514b\u8815\u866b<\/th>\n<th>\u9707\u8361\u6ce2\u8815\u866b<\/th>\n<th>\u7206\u80fd\u866b<\/th>\n<th>Mydoom\u8815\u866b<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u9996\u6b21\u4eae\u76f8<\/td>\n<td>2008 \u5e74 11 \u6708<\/td>\n<td>2004 \u5e74 4 \u6708<\/td>\n<td>2003 \u5e74 8 \u6708<\/td>\n<td>2004 \u5e74 1 \u6708<\/td>\n<\/tr>\n<tr>\n<td>\u76ee\u6807\u64cd\u4f5c\u7cfb\u7edf<\/td>\n<td>\u89c6\u7a97<\/td>\n<td>\u89c6\u7a97<\/td>\n<td>\u89c6\u7a97<\/td>\n<td>\u89c6\u7a97<\/td>\n<\/tr>\n<tr>\n<td>\u7e41\u6b96\u65b9\u6cd5<\/td>\n<td>\u7f51\u7edc\u5171\u4eab<\/td>\n<td>\u7f51\u7edc\u5171\u4eab<\/td>\n<td>\u7f51\u7edc\u5171\u4eab<\/td>\n<td>\u7535\u5b50\u90ae\u4ef6<\/td>\n<\/tr>\n<tr>\n<td>\u88ab\u5229\u7528\u7684\u6f0f\u6d1e<\/td>\n<td>MS08-067<\/td>\n<td>LSASS<\/td>\n<td>\u8fdc\u7a0b\u901a\u4fe1\u534f\u8bae<\/td>\n<td>\u54d1\u5267<\/td>\n<\/tr>\n<tr>\n<td>\u6709\u6548\u8f7d\u8377<\/td>\n<td>\u6076\u610f\u8f6f\u4ef6\u4f20\u64ad<\/td>\n<td>\u5173\u95ed\u7535\u8111<\/td>\n<td>DDoS \u653b\u51fb<\/td>\n<td>\u7535\u5b50\u90ae\u4ef6\u4e2d\u7ee7<\/td>\n<\/tr>\n<tr>\n<td>\u901a\u8baf\u65b9\u5f0f<\/td>\n<td>\u7cd6\u5c3f\u75c5\u6027\u80c3\u708e<\/td>\n<td>\u4e0d\u9002\u7528<\/td>\n<td>IRC \u9891\u9053<\/td>\n<td>\u90ae\u4ef6\u4f20\u8f93\u534f\u8bae<\/td>\n<\/tr>\n<tr>\n<td>\u4f30\u8ba1\u611f\u67d3\u4eba\u6570<\/td>\n<td>\u767e\u4e07<\/td>\n<td>\u6570\u5341\u4e07<\/td>\n<td>\u767e\u4e07<\/td>\n<td>\u767e\u4e07<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u4e0e Conficker \u8815\u866b\u76f8\u5173\u7684\u672a\u6765\u89c2\u70b9\u548c\u6280\u672f<\/h2>\n<p>\u968f\u7740\u6280\u672f\u7684\u53d1\u5c55\uff0c\u7f51\u7edc\u5a01\u80c1\u4e5f\u53d8\u5f97\u8d8a\u6765\u8d8a\u590d\u6742\u3002Conficker \u8815\u866b\u75c5\u6bd2\u4ecd\u7136\u662f\u4e00\u4e2a\u8b66\u793a\u6545\u4e8b\uff0c\u5b83\u5c55\u793a\u4e86\u4e00\u4e2a\u7cbe\u5fc3\u8bbe\u8ba1\u7684\u8815\u866b\u75c5\u6bd2\u5982\u4f55\u4f20\u64ad\u5e76\u9003\u907f\u68c0\u6d4b\u3002\u672a\u6765\uff0c\u6211\u4eec\u53ef\u4ee5\u671f\u5f85\u770b\u5230\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u9ad8\u7ea7\u8815\u866b<\/strong>\uff1a\u6076\u610f\u8f6f\u4ef6\u521b\u5efa\u8005\u53ef\u80fd\u4f1a\u5f00\u53d1\u51fa\u66f4\u52a0\u590d\u6742\u7684\u8815\u866b\uff0c\u80fd\u591f\u5229\u7528\u96f6\u65e5\u6f0f\u6d1e\u5e76\u91c7\u7528\u4eba\u5de5\u667a\u80fd\u8fdb\u884c\u9003\u907f\u653b\u51fb\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5feb\u901f\u7e41\u6b96<\/strong>\uff1a\u8815\u866b\u53ef\u80fd\u4f7f\u7528\u65b0\u7684\u4f20\u64ad\u65b9\u6cd5\uff0c\u4f8b\u5982\u5229\u7528\u7269\u8054\u7f51\u8bbe\u5907\u6216\u5229\u7528\u793e\u4f1a\u5de5\u7a0b\u6280\u672f\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u9632\u75c5\u6bd2\u548c\u4eba\u5de5\u667a\u80fd<\/strong>\uff1a\u7f51\u7edc\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u5c06\u91c7\u7528\u66f4\u5148\u8fdb\u7684\u4eba\u5de5\u667a\u80fd\u7b97\u6cd5\u6765\u6709\u6548\u68c0\u6d4b\u548c\u5e94\u5bf9\u591a\u6001\u6076\u610f\u8f6f\u4ef6\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5168\u7403\u5408\u4f5c<\/strong>\uff1a\u4e3a\u4e86\u6709\u6548\u6253\u51fb\u6b64\u7c7b\u5a01\u80c1\uff0c\u653f\u5e9c\u3001\u7ec4\u7ec7\u548c\u7f51\u7edc\u5b89\u5168\u4e13\u5bb6\u4e4b\u95f4\u7684\u56fd\u9645\u5408\u4f5c\u81f3\u5173\u91cd\u8981\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>\u4ee3\u7406\u670d\u52a1\u5668\u5982\u4f55\u4e0e Conficker \u8815\u866b\u4e00\u8d77\u4f7f\u7528\u6216\u5173\u8054<\/h2>\n<p>\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u80fd\u88ab\u653b\u51fb\u8005\u6ee5\u7528\uff0c\u4ee5\u4fc3\u8fdb Conficker \u8815\u866b\u548c\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\u7684\u4f20\u64ad\u3002\u653b\u51fb\u8005\u53ef\u80fd\u4f1a\u4f7f\u7528\u4ee3\u7406\u670d\u52a1\u5668\u6765\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u9690\u85cf\u8eab\u4efd<\/strong>\uff1a\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u9690\u85cf\u6076\u610f\u8f6f\u4ef6\u6d41\u91cf\u7684\u6765\u6e90\uff0c\u4f7f\u9632\u5fa1\u8005\u96be\u4ee5\u8ffd\u6eaf\u5230\u6765\u6e90\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u89c4\u907f\u57fa\u4e8e IP \u7684\u963b\u6b62<\/strong>\uff1aConficker \u53ef\u4ee5\u4f7f\u7528\u4ee3\u7406\u670d\u52a1\u5668\u6765\u907f\u514d\u57fa\u4e8e IP \u7684\u963b\u6b62\uff0c\u8fd9\u4f7f\u5f97\u7f51\u7edc\u7ba1\u7406\u5458\u5f88\u96be\u63a7\u5236\u5176\u4f20\u64ad\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5229\u7528\u6613\u53d7\u653b\u51fb\u7684\u4ee3\u7406<\/strong>\uff1a\u653b\u51fb\u8005\u53ef\u80fd\u4f1a\u627e\u5230\u6613\u53d7\u653b\u51fb\u7684\u4ee3\u7406\u670d\u52a1\u5668\u8fdb\u884c\u611f\u67d3\uff0c\u5e76\u5c06\u5176\u7528\u4f5c\u989d\u5916\u7684\u4f20\u64ad\u5a92\u4ecb\u3002<\/p>\n<\/li>\n<\/ol>\n<p>\u56e0\u6b64\uff0c\u5bf9\u4e8e\u50cf OneProxy \u8fd9\u6837\u7684\u4ee3\u7406\u670d\u52a1\u5668\u63d0\u4f9b\u5546\u6765\u8bf4\uff0c\u5b9e\u65bd\u5f3a\u5927\u7684\u5b89\u5168\u63aa\u65bd\u4ee5\u9632\u6b62\u5176\u670d\u52a1\u88ab\u6076\u610f\u6ee5\u7528\u81f3\u5173\u91cd\u8981\u3002\u6301\u7eed\u76d1\u63a7\u5e76\u786e\u4fdd\u4ee3\u7406\u670d\u52a1\u5668\u672a\u5217\u5165\u516c\u5171\u4ee3\u7406\u6570\u636e\u5e93\u6709\u52a9\u4e8e\u4e3a\u5408\u6cd5\u7528\u6237\u63d0\u4f9b\u5b89\u5168\u53ef\u9760\u7684\u670d\u52a1\u3002<\/p>\n<h2>\u76f8\u5173\u94fe\u63a5<\/h2>\n<p>\u6709\u5173 Conficker \u8815\u866b\u53ca\u5176\u5bf9\u7f51\u7edc\u5b89\u5168\u7684\u5f71\u54cd\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u60a8\u53ef\u4ee5\u63a2\u7d22\u4ee5\u4e0b\u8d44\u6e90\uff1a<\/p>\n<ul>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/insights\/threat-intelligence-reports\/conficker\" target=\"_new\" rel=\"noopener nofollow\">\u5fae\u8f6f\u5b89\u5168\u60c5\u62a5\u62a5\u544a<\/a><\/li>\n<li><a href=\"https:\/\/www.symantec.com\/security-center\/writeup\/2009-011316-0247-99\" target=\"_new\" rel=\"noopener nofollow\">\u8d5b\u95e8\u94c1\u514b\u5bf9 Conficker \u7684\u5206\u6790<\/a><\/li>\n<li><a href=\"https:\/\/us-cert.cisa.gov\/ncas\/alerts\/TA09-020A\" target=\"_new\" rel=\"noopener nofollow\">\u7f8e\u56fd\u8ba1\u7b97\u673a\u5e94\u6025\u54cd\u5e94\u5c0f\u7ec4 (US-CERT) \u5bf9 Conficker \u53d1\u51fa\u8b66\u62a5<\/a><\/li>\n<li><a href=\"https:\/\/www.confickerworkinggroup.org\/\" target=\"_new\" rel=\"noopener nofollow\">\u98de\u514b\u5de5\u4f5c\u7ec4<\/a><\/li>\n<\/ul>\n<p>\u8bf7\u8bb0\u4f4f\uff0c\u968f\u65f6\u4e86\u89e3\u7f51\u7edc\u5a01\u80c1\u5e76\u91c7\u7528\u6700\u4f73\u5b89\u5168\u5b9e\u8df5\u5bf9\u4e8e\u4fdd\u62a4\u60a8\u7684\u7cfb\u7edf\u548c\u6570\u636e\u514d\u53d7 Conficker \u8815\u866b\u7b49\u6f5c\u5728\u5a01\u80c1\u81f3\u5173\u91cd\u8981\u3002<\/p>","protected":false},"featured_media":476396,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-476395","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Conficker Worm: A Persistent Cyber Threat<\/mark>","faq_items":[{"question":"What is the Conficker worm?","answer":"<p>The Conficker worm is a notorious computer worm that gained infamy for its rapid spread and destructive capabilities. It was first detected in November 2008 and primarily targeted Microsoft Windows operating systems. Conficker exploited a critical vulnerability in the Windows Server service (MS08-067) and spread through network shares and removable storage devices.<\/p>"},{"question":"How does the Conficker worm work?","answer":"<p>The Conficker worm infects vulnerable systems through network shares, weak passwords, and the MS08-067 vulnerability. Once infected, it rapidly spreads across the network and creates a dynamic-link library (DLL) component as its main payload downloader. It employs a Domain Generation Algorithm (DGA) to generate pseudo-random domain names for communication with its command and control servers, making it difficult to predict and disrupt its control infrastructure. Conficker also incorporates self-defense mechanisms to evade detection and removal attempts.<\/p>"},{"question":"What are the key features of Conficker?","answer":"<p>Conficker's key features include fast propagation through network shares and USB drives, polymorphic code to evade detection, a dynamic C&amp;C infrastructure through DGA-generated domains, and sophisticated self-defense mechanisms to protect itself.<\/p>"},{"question":"Are there different variants of the Conficker worm?","answer":"<p>Yes, there are multiple variants of the Conficker worm, each with its unique characteristics and improvements. The major variants include Conficker A, B, C, D, and E, with each version evolving to enhance its propagation and evasion capabilities.<\/p>"},{"question":"What problems can the Conficker worm cause?","answer":"<p>The Conficker worm can cause various problems, such as rapid network infections, data theft, creation of botnets for malicious activities, and loss of control over infected systems.<\/p>"},{"question":"How can I protect my system from Conficker?","answer":"<p>To protect your system from Conficker and similar threats, follow these measures:<\/p><ol><li>Keep your operating system and software up-to-date with security patches.<\/li><li>Use strong and unique passwords to secure network shares and user accounts.<\/li><li>Install reputable antivirus and anti-malware software with regular updates.<\/li><li>Disable the Autorun feature on removable media to prevent auto-infection.<\/li><li>Exercise caution while opening email attachments or clicking on suspicious links.<\/li><\/ol>"},{"question":"What is the future of cybersecurity related to Conficker?","answer":"<p>As technology evolves, cyber threats, including sophisticated worms like Conficker, are expected to become more advanced. We can expect to see the use of AI by cybercriminals to create even more evasive malware. To combat these threats effectively, international cooperation among governments, organizations, and cybersecurity experts will be crucial.<\/p>"},{"question":"How can proxy servers be associated with Conficker?","answer":"<p>Proxy servers can be misused by attackers to facilitate the spread of Conficker and other malware. Attackers may use proxy servers to hide their identity, evade IP-based blocking, and exploit vulnerable proxies as additional propagation vectors. Proxy server providers must implement robust security measures to prevent such misuse and ensure a safe and reliable service for legitimate users.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/476395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/476395\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/476396"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=476395"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}