1、 Downadup/Conficker
Conficker首要操縱Windows把持系統(tǒng)MS08-067縫隙來傳播，同時也能借助任何有USB接口的硬件設備來傳染，在2008年被發(fā)現(xiàn)，并在微軟的MS08-067補丁中被修復。但直到此刻，仍有良多局域網中發(fā)現(xiàn)有Downadup蠕蟲病毒傳染，有些殺毒軟件仍然不給力，沒法找到病毒泉源，導致在某些機械上不竭地反復發(fā)現(xiàn)Downadup陳述，但沒法刪除。
2 、Nmap腳本引擎smb-check-vulns.nse
Nmap供給了強大年夜的腳本引擎(NSE)，以撐持經由過程Lua編程來擴大Nmap的功能。除常見的主機發(fā)現(xiàn)、端口掃描等功能外，腳本引擎擴大了其他加倍多樣化的功能，如查抄常見的縫隙信息和本片文章提到的查抄蠕蟲傳染功能。
smb-check-vulns腳本的介紹和源碼下載可以在nmap.org官網上獲得：
http://nmap.org/nsedoc/scripts/smb-check-vulns.html
smb-check-vulns腳本可以查看以下縫隙：
MS08-067, a Windows RPC vulnerability
Conficker, an infection by the Conficker worm
Unnamed regsvc DoS, a denial-of-service vulnerability I accidentally found in Windows 2000
SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
MS06-025, a Windows Ras RPC service vulnerability
MS07-029, a Windows Dns Server RPC service vulnerability
此中關于Conficker的查抄，mnap是基于以下的這個Conficker掃描器
http://net.cs.uni-bonn.de/wg/cs/applications/containing-conficker
3、 Nmap掃描實例
此東西用來檢測長途可疑源的具體利用號令以下：
nmap -PN -T4 -p139,445 -n -v --script smb-check-vulns,smb-os-discovery--script-args safe=1 [targetnetworks]
如：
nmap -PN -T4 -p139,445 -n -v --script smb-check-vulns, smb-os-discovery--script-args safe=1 100.10.1.*
便利起見，可以將其導出到一個文件中：
nmap -PN -T4 -p139,445 -n -v --scriptsmb-check-vulns,smb-os-discovery --script-args safe=1 [targetnetworks] >nmap_result.log
從日記里面找關頭字，可以肯定病毒源的位置。
…
Host 172.30.160.22 is up (0.00s latency).
Interesting ports on 172.30.160.22:
PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:E0:4C:1E:22:B8 (RealtekSemiconductor)
Host script results:
| smb-os-discovery: Windows XP
| LAN Manager: Windows 2000 LAN Manager
| Name: WORKGROUP\WH013
|_ System time: 2009-12-21 17:10:57 UTC+8
| smb-check-vulns:
| MS08-067: CHECK DISABLED (remove 'safe=1'argument to run)
| Conficker: UNKNOWN; not Windows, orWindows with disabled browser service (CLEAN); or Windows with crashed browserservice (possibly INFECTED).
| | If you know the remote system isWindows, try rebooting it and scanning
| |_ again. (ErrorNT_STATUS_OBJECT_NAME_NOT_FOUND)
|_ regsvc DoS: CHECK DISABLED (add'--script-args=unsafe=1' to run)
…
Host 172.30.160.40 is up (0.00s latency).
Interesting ports on 172.30.160.40:
PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:16:76:A8:D4:1F (Intel)
Host script results:
| smb-os-discovery: Windows XP
| LAN Manager: Windows 2000 LAN Manager
| Name: SZWH\WH-ASP-04