剑盟原帖http://bbs.janmeng.com/viewthread.php?tid=856992&extra=page%3D1，第5楼回复
hmily发了一个Conficker，为了便于会员测试修改了可能影响的跳转。
未修改时：
0041B6A4     8D45 F0         lea     eax, dword ptr [ebp-10]
0041B6A7     50              push    eax
0041B6A8     FF15 14104000   call    dword ptr [<&KERNEL32.GetSystemTime>]                      ; kernel32.GetSystemTime
0041B6AE     66:817D F0 D907 cmp     word ptr [ebp-10], 7D9                                     ; 2009年
0041B6B4     8B3D 80104000   mov     edi, dword ptr [<&MSVCRT.sprintf>]                         ; MSVCRT.sprintf
0041B6BA     0F87 6A010000   ja       0041B82A                                                   ; 大于则跳
0041B6C0     75 18           jnz     short 0041B6DA
0041B6C2     66:837D F2 03   cmp     word ptr [ebp-E], 3                                        ; 3月
0041B6C7     0F87 5D010000   ja       0041B82A
0041B6CD     75 0B           jnz     short 0041B6DA
0041B6CF     66:837D F6 13   cmp     word ptr [ebp-A], 13                                       ; 19日
0041B6D4     0F87 50010000   ja       0041B82A
0041B6DA     FF15 18104000   call    dword ptr [<&KERNEL32.GetVersion>]                         ; kernel32.GetVersion
0041B6E0     3C 05           cmp     al, 5                                                      ; Windows2000/XP/2k3
0041B6E2     0F82 42010000   jb       0041B82A                                                   ; 小于则跳
0041B6E8     0F00C0          sldt    ax
0041B6EB     66:85C0         test    ax, ax                                                     ; 虚拟机环境中ax!=0
0041B6EE     0F85 36010000   jnz     0041B82A                                                   ; 非零则跳
0041B6F4     8885 DCFEFFFF   mov     byte ptr [ebp-124], al

修改后：
0041B6A4     8D45 F0         lea     eax, dword ptr [ebp-10]
0041B6A7     50              push    eax
0041B6A8     FF15 14104000   call    dword ptr [<&KERNEL32.GetSystemTime>]                      ; kernel32.GetSystemTime
0041B6AE     66:817D F0 D907 cmp     word ptr [ebp-10], 7D9
0041B6B4     8B3D 80104000   mov     edi, dword ptr [<&MSVCRT.sprintf>]                         ; MSVCRT.sprintf
0041B6BA     EB 1E           jmp     short 0041B6DA
0041B6BC     90              nop
0041B6BD     90              nop
0041B6BE     90              nop
0041B6BF     90              nop
0041B6C0     75 18           jnz     short 0041B6DA
0041B6C2     66:837D F2 03   cmp     word ptr [ebp-E], 3
0041B6C7     0F87 5D010000   ja       0041B82A
0041B6CD     75 0B           jnz     short 0041B6DA
0041B6CF     66:837D F6 13   cmp     word ptr [ebp-A], 13
0041B6D4     0F87 50010000   ja       0041B82A
0041B6DA     FF15 18104000   call    dword ptr [<&KERNEL32.GetVersion>]                         ; kernel32.GetVersion
0041B6E0     3C 05           cmp     al, 5
0041B6E2     90              nop
0041B6E3     90              nop
0041B6E4     90              nop
0041B6E5     90              nop
0041B6E6     90              nop
0041B6E7     90              nop
0041B6E8     0F00C0          sldt    ax
0041B6EB     66:85C0         test    ax, ax
0041B6EE     90              nop
0041B6EF     90              nop
0041B6F0     90              nop
0041B6F1     90              nop
0041B6F2     90              nop
0041B6F3     90              nop
0041B6F4     8885 DCFEFFFF   mov     byte ptr [ebp-124], al

可以看到被修改的地方涉及三个运行条件的检测：
1.系统时间超过2009年3月19日则跳走，这是对系统时间的限制
2.系统版本低于Win2000则跳走，这是操作系统版本的限制
3.系统在虚拟机下运行，则跳走，这是对病毒分析员利用虚拟机调试病毒的限制