手动HIPS（Manual HIPS）.doc

手动HIPS（Manual HIPS） HIPS (host intrusion prevention system) is different from the traditional network firewall, the traditional network firewall (NIPS) to restrict the user to access a specific IP address through TCP/IP protocol, or restricted Internet users access to personal user terminal and server, and HIPS system such as A firewall is to limit the process called B process, or no change or add a registry file, as opposed to the kill virus every day every day antivirus software passive defense, HIPS can effectively prevent the virus and Trojan secretly run. HIPS software a lot, such as SSM (System, Safety, Monitor), SNS (SafenSec), etc., in fact, use the WindowsXP system comes with local security settings, you can also DIY simple HIPS. Local security policy new rule creation method Click start to run, type secpol.msc, enter (you can open the control panel selection of management tools and the local security policy), open local security policy (XP Professional Edition), right click on the software limitation strategy, select create new strategy, software restriction policies will automatically create more children, be careful not to modify the other rules under the system default four registry rules, otherwise the system will collapse. All we have to do is add security policies to the other rules. Right click on the other rules, can create a new certificate, hash, Internet region and path rules, simple HIPS will only use the path rules add specific path in the input box in the path to create a path of new rules, and set the security level for no or not limited. Tip: rules can use folders, environment variables, and folder wildcards, such as ? And * such a wildcard, environmental variables including%WinDir% folder (Windows directory),%UserProFile% (* and Settings\: \Documents%Temp%, the current user name) (*: \Documents and Settings\*\Local Settings\Temp). To prevent the virus to hide in the corner Many trojan virus used to hiding in the most obscure corner, such a