ѶȫӦ"WannaCry"û÷
2017-05-14 23:42ۺϢ
512"WannaCry"Ⱦ¼ȫΧٸģ繥ߵеļܣҪ֧رԽļӢ40ҽƻݣҹԽΪ²ֽѧϵͳУѧҵıܵȡѶȫʵƶʵҸ˶־ǿѹûWannaCryڳУҪ÷С
˽⣬˴Wannacry¼Ǻڿȥ걻Ұȫ(NSA)ƵWindowsϵͳڿEternal Blue֮ϳֵعűý̳ҲԸ©Ϊڣķʽд
¼Ӱ췶Χ㷺־ǿǰººļָû飺
ǰԤ
1. ر©˿ڣװϵͳ
a) ԲһЩ߹߽ԶIJװͶ˿ΣԹܼ߹ߣصַhttps://guanjia.qq.com/wannacry/
b) ֶرն˿ڣذװ
i. صַhttp://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598 http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598
ii. ÷ǽӹζ˿
1. ʼ˵--ѡWindowsǽ
2. ǽûп"ر Windowsǽ"÷ǽ" ȷ"
3. " "Ȼ"վ"ٵҲ" ½"
4. ڴѡѡҪĹΪ"˿"һ
5. "ضض˿"445"һ"ѡ"ֹ"Ȼһֱһɼɡ
עͬϵͳЩ죬
iii. ѶƻҲͨðȫ445˿
1. ѡҪİȫ飬"༭"
2. ֱӵðť"°ȫ©"ͿԶӹ
3. ÿݰť"137139445"˿ڵιֻӱӰ445˿ڣڱǰеҵҪ
2. ݣװȫ
a) Ҫļ߱ݣʹU̵ȷʽȷʽб
b) ֵԴϵͳԭܣδܹ֮ǰϵͳԭ㣬ʹܹ֮Իԭϵͳһرܵԭļԭʱ䵽ܹڼļýᶪʧ
c) ĿǰְȫѾиķȣװЩȫѶԹܼңʵʱܹ
d) ԲһЩļߣļıݡԹܼҵĵػߣԹܼҹڿʹã-ϵͳ-ĵػߣ
3. ʵ
ݶڴƣԳɹiuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comļֱܶ˳ĿǰѱȫԱעᣬʡ
a) ͨûڿ״̬£֤ԸַĿɷʣԱܹⱻܣ֪
b) ҵûͨWeb ServerȻͨDNSķʽWeb Server IPķʽʵߣͨķҲԼȾ
º
1. ȿεߵȷʽܹԣȾ
2.
ذȫԹܼңɱֱӲɱֱӽɨѸĻͨU̵ȷʽ߰װ
3. Ҳڱݺֱӽϵͳװװο"ǰԤ"Ԥ
ºļָ
Ŀǰ֪ǰûļָͨµķʽָļ
1. лָּļĹܣֱָͨļûָޣֱӵϵ"Decrypt"ɵָڣʾѻָļбȻ"Start"ɻָбļ
2. ݶڼļɾԴļͨݻָһʻָѱܵIJļʹõݻָ߳ݻָûֱϵѶȫƶʵЭ
ĿǰѶȫԱʱ̹עWannaCryչûǿ簲ȫʶѶԹܼҶԵԽʵʱš
ĵַ:http://www.cnonline.org/2017/article/12140.html
˽⣬˴Wannacry¼Ǻڿȥ걻Ұȫ(NSA)ƵWindowsϵͳڿEternal Blue֮ϳֵعűý̳ҲԸ©Ϊڣķʽд
¼Ӱ췶Χ㷺־ǿǰººļָû飺
ǰԤ
1. ر©˿ڣװϵͳ
a) ԲһЩ߹߽ԶIJװͶ˿ΣԹܼ߹ߣصַhttps://guanjia.qq.com/wannacry/
b) ֶرն˿ڣذװ
i. صַhttp://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598 http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598
ii. ÷ǽӹζ˿
1. ʼ˵--ѡWindowsǽ
2. ǽûп"ر Windowsǽ"÷ǽ" ȷ"
3. " "Ȼ"վ"ٵҲ" ½"
4. ڴѡѡҪĹΪ"˿"һ
5. "ضض˿"445"һ"ѡ"ֹ"Ȼһֱһɼɡ
עͬϵͳЩ죬
iii. ѶƻҲͨðȫ445˿
1. ѡҪİȫ飬"༭"
2. ֱӵðť"°ȫ©"ͿԶӹ
3. ÿݰť"137139445"˿ڵιֻӱӰ445˿ڣڱǰеҵҪ
2. ݣװȫ
a) Ҫļ߱ݣʹU̵ȷʽȷʽб
b) ֵԴϵͳԭܣδܹ֮ǰϵͳԭ㣬ʹܹ֮Իԭϵͳһرܵԭļԭʱ䵽ܹڼļýᶪʧ
c) ĿǰְȫѾиķȣװЩȫѶԹܼңʵʱܹ
d) ԲһЩļߣļıݡԹܼҵĵػߣԹܼҹڿʹã-ϵͳ-ĵػߣ
3. ʵ
ݶڴƣԳɹiuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comļֱܶ˳ĿǰѱȫԱעᣬʡ
a) ͨûڿ״̬£֤ԸַĿɷʣԱܹⱻܣ֪
b) ҵûͨWeb ServerȻͨDNSķʽWeb Server IPķʽʵߣͨķҲԼȾ
º
1. ȿεߵȷʽܹԣȾ
2.
ذȫԹܼңɱֱӲɱֱӽɨѸĻͨU̵ȷʽ߰װ
3. Ҳڱݺֱӽϵͳװװο"ǰԤ"Ԥ
ºļָ
Ŀǰ֪ǰûļָͨµķʽָļ
1. лָּļĹܣֱָͨļûָޣֱӵϵ"Decrypt"ɵָڣʾѻָļбȻ"Start"ɻָбļ
2. ݶڼļɾԴļͨݻָһʻָѱܵIJļʹõݻָ߳ݻָûֱϵѶȫƶʵЭ
ĿǰѶȫԱʱ̹עWannaCryչûǿ簲ȫʶѶԹܼҶԵԽʵʱš
ĵַ:http://www.cnonline.org/2017/article/12140.html