第4章-3网络攻击技术及防范.ppt

* * * * * * * * * * * * * * * * * * Chapter 1: Introduction to Computer Viruses and Malware * 病毒码(Pattern)文件 * 1、范围：全球性， 如WORM_MOFEI.B病毒 /vinfo/virusencyclo/default5.asp?VName=WORM%5FMOFEI%2EBVSect=SPeriod=All Computers infected since June 5, 2003 Asia 158,055 North America 21,803 Europe 1,435 Australia and New Zealand 284 South America 53 Africa 42 (unknown) 88 Total 181,760 －－－－－－－－－－－－－－－－－－－－ Top 10 countries China 118,347 Taiwan 30,183 United States 21,489 South Korea 4,793 Japan 3,253 Italy 789 Singapore 546 Canada 300 France 235 Hong Kong 217 ×××××××××××××××××××××××××××××××××××××××××××××× 2、速度：越来接近零日攻击，如worm_zotob.a病毒 /vinfo/virusencyclo/default5.asp?VName=WORM_ZOTOB.A This memory-resident worm drops a copy of itself in the Windows system folder as BOTZOR.EXE. This worm takes advantage of the Microsoft Windows Plug and Play vulnerability to propagate across networks. For more information regarding this vulnerability, refer to the following Microsoft Web page: Microsoft Security Bulletin MS05-039 Microsoft: Microsoft Security Bulletin MS05-039 Published: August 9, 2005 TrendMicro: Initial samples received on:?Aug 13, 2005 ×××××××××××××××××××××××××××××××××××××××××××××× 3、方式：蠕虫、木马、间谍软件联合，如Lovgate病毒 蠕虫： WORM_LOVGATE.AE 木马： TROJ_LOVGATE.A PE病毒： PE_LOVGATE.AC 后门： BKDR_LOVGATE.DLL * Chapter 1: Introduction to Computer Viruses and Malware * * 例子，WORM_MYTOB /vinfo/virusencyclo/default5.asp?VName=WORM_MYTOB.A * 例子， WORM_SDBOT.ANF