新闻中心
已感染数万设备!警惕ZombieBoy挖矿木马传播
病毒信息
病毒性质:挖矿木马
影响范围:目前已感染数万台设备,涉及多行业
危害等级:高危
传播方式:内网扫描、“永恒之蓝”漏洞利用
病毒描述
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERtTPvufdqrffsfeaosFTavJvnd2AT0R5JX45P3EAAolVZChg7ZheK8TQ.jpg)
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERtu6F83osZGLq33F91JFHEKdkTvObZ7aWY9YE5Ykb7kiaZM209neZWomA.jpg)
感染现象
受感染的主机上出现了未知IP策略的明显现象,该策略会将除了22.148.18.88之外连接445的IP全部阻止。![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERt3ohia8iawKLDQG0oMFLk1AcmS1HVjpwkpCd7FxThCEKlsKVShyC3ich6g.jpg)
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERtrI6Px4UQfMpAmLumxk3IzyqgJ9XyevjUBcQ2DnftkmS5adEdhiahIrg.jpg)
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERtmNhic3e8AP7lSwicOcZxQLJUSlDdcAUIkJibZqFRibRzuvuibT4yPfLP6Cg.jpg)
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERtqTzCjrKEl41eibzvKOIgAA3WzYwlzuLwv8icsvrFe9hIwWlou6xm1ntA.jpg)
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERticu7gy8XqvyQicxR43vzmJDOabXr3wVFhkS8aTdXQPQVTR5Nph1q0wVw.jpg)
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERtsBh70T4trbenVFEK9LjYXU8nsV44mJFjlxf9HYcUbvG8Ok4xMIg3Xg.jpg)
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERt8jjLPXpicTdCFcCmKypx2Puxn6M0ic43c5tECKbh72G54ludbM0BDqCw.jpg)
![](https://download.sangfor.com.cn/Uploads/Editor/image/20190715/EJiaEo3Lq9krzpLMmPpanUZ9IPZXy0ERt503O5ichZibrdOngnqmY4pxvUmCcp5hiaKibIqWXCdWAkRcgH8G2mBa11Q.jpg)
解决方案
关闭业务上不需要的端口,如135、137、138、139、445等。
使用安全产品查杀木马文件及进程,深信服EDR产品、下一代防火墙及安全感知平台等安全产品均具备病毒检测能力,部署相关产品用户可进行病毒检测。
使用深信服安全产品,接入安全云脑,使用云查服务可以即时检测防御新威胁。
深信服为广大个人用户免费提供查杀工具,可下载如下工具,进行检测查杀。
32位系统下载链接:https://edr.sangfor.com.cn/tool/SfabAntiBot_X86.7z
下一篇:
网络西部牛仔的燃情岁月
![](https://download.sangfor.com.cn/887c68fa9ecb439196d323a09fcaabb2.png)