Preventing and controlling network worm virus's skill and its strategy

Each worm's eruption can bring massive loss to the society. On September 18, 2001, the Nimda worm was discovered, creates the loss appraisal data to Nimda to climb from 500 million US dollars after 2.6 billion US dollars, continues to climb, has been unable to the present to estimate 70-222. At present the worm erupts the frequency is more and more quick, in the recent two years, more and more many worms (for example shock wave, vibration wave and so on) appears in particular. Conducts the thorough research to the worm, and proposed one kind of effective solution, provides a safe network environment for the 70-222 enterpriseandthe government to become our pending issue.

Any is the 70-222 worm

The Internet worm is does not need the independent procedure which the computer user intervenes thenmoves, it through does not stop obtainsinthe network to have the loophole on the computer to be partial or the complete domination carries on the dissemination.

The worm and the virus most greatly differently lie in it not to need the artificial intervention, also can the independent unceasingly duplication and the dissemination. The 70-222 wormprocedurework flow may divide into the loophole to scan, the attack, the infection, the scene processes four stages. After the wormprocedurescans has the loopholethe computer system, migrates the worm main body to the goal main engine. Then, the wormprocedureenters the system whichinfects, carries on scene processing to the goal main engine. The scene processing partial work include: Hideaway, information collection and so on. The different worm adopts the IP production strategy certainly is not possibly same, even stochastically produces. Each step numerous Jan degree also different, some extremely complex, some then is extremely simple.

Worm's behavior characteristic includes:

Self- reproduction:

Usesoftwareloophole:

Creates the 70-222 networkjam:

Dissipation systemresources:

Leaves behind the security hidden danger:

Worm's work way induction as follows: Stochastically produces a IP address; The judgement corresponds this IP address the machine whether can infect; If may infect, then infects it; Duplicates 1 ~ 3 altogether m, m is the reproduction transcription quantity which the worm produces.

How examines the worm

May know by the above analysis, discovered as soon as possible the worm and to infects worm's main engine to carry on the isolation and the restoration, is prevented the worm is in flood, causes the heavy losses the key.

At present the domestic certainly not special worm examination andthe defense system, the traditional main engine anti-virussystemcertainly cannot carry on the examination to the unknown worm, only can passively to the characteristic worm which discovered carry on the examination. Moreover in the present market invasion examinationproduct, to worm's examination also mostly is based on the characteristic, therefore we use the exceptionally examination function which ids provides, through discoverynetworkin unusual, comes to worm's infection to carry on the control. Although some afterwards Zhuge's suspicion, but so long as discovers promptly, or can greatly reduce the loss which the worm creates.

In to the unknown worm's examination aspect, the invasion examination in connects in the unusual analysis foundation to the current capacity unusual statistical analysis and to tcp, also has used the method which exceptionally analyzes to the ICMP data, may comprehensivelyexaminein the network unknown worm. This kind ofnetworkworm's examinationtechnologyis Bob Gray, specifically realizes the process is: When a main engine does not exist to when the main engine initiates the connection, the middle router can produce ICMP-T3 (goal not to be possible to reach) the package to return for the worm the main engine.

This method may examine high speed has, the large-scale infection modelnetworkworm. (Is very difficult to examine in view of somenetworkdissemination specific worm and the slow dissemination worm. These two kind of worms, may think saidtothe entire network, their harm quite is small).

Omni-directional worm preventing and controlling strategy

When the worm is discovered, must carry on the response in the as far as possible short time to it. First produces reports to the police, the noticemanagement, and through the firewall, the router, or the HIDS interaction infected worm's main engine isolation; Then carries on the analysis to the worm, further formulates the examination strategy, the security hidden dangerdoes not carry onpatching as soon as possible to the overall system existence, prevented the worm infects once more, and to infected worm's main engine to carry on worm's deletion work.

Regarding when infected worm's main engine, its preventing and controlling strategy is such:

1. With firewall interaction: Through controls the firewall the strategy, visit to infects the main engine the foreign data to carry on the control, prevented the worm foreign net the main engine carries on the infection.

2. Switchboard linkage: Carries on the linkage through the SNMP agreement, when in discovered when webmaster machine by worm infection, may shut off infects the main engine with in net other main engines communications, prevented infects the main engine the net wantonly dissemination.

3. Informs HIDS (based on main engine invasion monitor): Is loaded with HIDS the serverto receive the information whichthe monitor system transmits, may carry on visit to suspicious main engine blocks, like this may prevent the main engine visit server which infects, causes onthe server the important resources to exempt is damaged.

4. Reports to the police: Produces reports to the police, the noticenetwork management, carries on the analysis after the worm, may through dispose Scaner to come tothe networkto carry on the loophole to scan, the notice existence loophole carries on the loophole main engine tothe Patchserver downloading patch to repair, the preventing and controlling worm further disseminates.

Two wonderful moves "forcefully" kill the viral advancement

In "Forcefully Closes" Killed "Advancement" in an article, mentioned the method had to use third partysoftware, had a simpler mentality? The 70-222 author provides two piece of small skills in here foreverybody, in order to helps you forcefully kills "is incorrigibly obstinate" the viral advancement.

According to advancement Zha Sha

This method is, inusesin front of this 70-222 method which orders through under WinXP system taskkill to realize, first needs to openthe systemthe advancement to tabulate the contact surface, found concrete advancement which the viral advancement corresponds.

After that is single-clicking in turn "starts -> the movement" the order, in springsinsystem movement frame, movement "cmd" order; Again inputs "taskkill /im aaa" in the DOS order line the form characterstring order, after single-clicks the carriage return key, the stubborn viral 70-222 advancement "aaa" forcefully is killed. For instance, must forcefully kill "conime.exe" the viral advancement, so long as carries out "taskkill /im conime.exe" under the order prompt symbol the order, how long couldn't want,the system could the self-recovery like chart show result.

According to advancement number Zha Sha

Above method, only to partial viral 70-222 advancement effective, meets some "is more stubborn" viral advancement, possibly did not help matters. This time you may systematic inset atorder - ntsd through Win2000 above, forcefully kills all viral advancements, because this order except the System advancement, the SMSS.EXE advancement, the CSRSS.EXE advancement cannot "cope with" outside, is basic may cope with other all advancements. But in uses this order kills in front of the viral advancement, needs first to search the 70-222 corresponding virus advancement the concrete advancement number.

Consideredthe systemadvancement tabulates the contact surface in to tacitly approve under the condition, is does not demonstrate the concrete advancement number, therefore you may first openthe system taskmanagementwindow, again single-clicks "examined" under the vegetable single item "the choice row" the order, in the establishment frame which springs, "PID (advancement designator)" the option will select, single-clicks "determines" the button. Returns tabulatesinthe page after the system advancement, you could examine the 70-222 corresponding virus advancement concrete PID.

Then opensthe systemmovement dialog box, moves "cmd" in among the order, inputs "ntsd -c q -p PID" under the order prompt symbol condition the order, was allowed strong about to assign PID the viral advancement to kill. For example, discovered some viral advancement PID is "444", then may carry out "ntsd -c q -p 444" the order, kills this viral advancement.