最新Windows Vista的防治恶意软体技术157.pptVIP

Internet Explorer 7 Phishing Opt-in Windows Defender 監控 偵測 清除 軟體瀏覽(Soft Explorer) SpyNet 監控功能 開機執行程式 系統的設定變動 Internet Explorer 設定與Add-ons 下載的檔案 網路服務與驅動程式 應用程式的執行 Software Explorer 開機執行程式 執行中的程式 網路聯結程式 網路服務與驅動程式 執行中的應用程式分析 執行中的網路連結程式分析 偵測 支援的檔案格式 壓縮檔案 (zip, rar等) 檔案包裝 (upx, aspack) 眾多的檔案類型 偵測方法 檔案雜湊 (MD5, SHA1, CRC) Multi-CRC User-mode rootkit signatures 模擬 啟發式(Heuristics) * * * * * * * * * IE7 on Vista offers two major security improvements ActiveX Opt-in and Protected Mode. ActiveX Opt-in is designed to give users more control over the software running on their PCs. To reduce the attack surface, ActiveX Opt-in will disable by default ActiveX controls that are rarely used or were never intended to be invoked in IE.? Controls that users have installed via a web download or have been used in IE before upgrading to IE7 will be enabled by default. Users will have the option to enable controls as needed using the same Information Bar they have used to install new controls since Windows XP SP2. While the final implementation is still being developed, the goal is a safer browsing experience for users with the add-ons they value already enabled and ready for use. Protected Mode offers users a powerful security enhancement by reducing the severity of threats faced by malicious attacks. A new feature in IE7 for Windows Vista, Protected Mode eliminates the silent install of malicious code through software vulnerabilities. Protected mode accomplishes this by running IE in isolation from any other application or process in the operating system and limiting the IE process from writing to any location beyond Temporary Internet Files without explicit user consent. Running IE in isolation prevents it from accessing other applications, even other instances of IE, removing any potential for escalation of privilege by using a buffer overrun attack. A Protected Mode IE session will still enable users to enjoy the powerful extensibility and unique website features they are used