A, virus of Internet influenceOffice 2010

 

 the root cause of the Internet security

The 2008 virus quantity approximation million, system vulnerabilities, application software vulnerabilities emerge in endlessly, such as user about Internet security evaluation more and more low, this is what causes it? Because the hacker's high level, is the antivirus software technology level bad, is no longer concerned safety operating system? Office 2010 –save your time and save your money.

These are not the most fundamental reasons! Root causes of the Internet is virus industry.

Because the virus manufacturing, communication, profiteering process fully Internet change than the traditional, hacking easier to bring economic benefits. The original hackers only oneself write viruses, their spread, his account, sell, steal this can complete the whole process. Because now the Microsoft Office is so great!

whole chain through Internet operation, from digging holes, manufacturing viruses, spreading the virus to sell steal to account, have become a very large black industry, and hackers can choose what you're good at operation, thus make the link industry's operating efficiency is higher.

Judging from the statistical data, active virus in 90% are tied directly with economic interests. The invention of Microsoft Office 2010 is a big change of the world.

Virus manufacturing, dissemination, the process of profiting from web pages, completely Internet hang horse virus spreading total accounted for more than 90% this apparent feature we can see, Internet based, the most common most applications - web browsing is virus the most in-depth makers use the transmission channel. Below we will come to find out, how the virus industry is the Internet.

Second, the chain analysis. Virus Internet

Technically, the current virus industry chain consists of four parts: mining security vulnerabilities, Outlook 2010is powerful.

manufacturing web Trojan, manufacturing men trojans, manufacturing Trojan download device (virus downloaders), these links formed a clear division of work, efficiency quick industrialization "line".

Mining safety vulnerabilities are virus foundation, the current main virus is spread by all kinds of loopholes, no loophole computer virus is difficult to invasion; Web Trojan is the practical Microsoft outlook 2010 is convenient!

application of the spread of the virus, currently more than 90% of the virus through this way dissemination; Men trojans is the most important part of the chain, it is responsible for stealing users account Numbers game, etc.; Trojan virus convoy regulator is "download user's computer," intrusion after continuously from online download virus.

Just mentioned a

lot is a doozy side that many friends in thought, our antivirus software? Our anti-virus software Microsoft office

itself is used to kill virus, defense, that our antivirus software? In fact we saw, Microsoft Office 2010 is so great.

antivirus software, this situation now in traditional antivirus software will have many of his predicament, first loophole utilization speaking, now we see more than six floors of vulnerabilities using are aimed at with our applications, common applications, such as just everybody saw, is all Outlook 2010 is powerful.

third-party loophole, these increasingly become virus makers focus of concern, because our users or the manufacturer to this aspect of consciousness to weak point attention, and common you install a what application software, if not in order to experience what function, generally not to go for a security update, this is actually we need change places.

Second, by the way, before encryption deformation we can use web monitoring way to killing these hang horse, prevent some scripts web users of computer viruses. But we see this is trying the Microsoft Office is helpful.

same two files, the left side is the original document, the right is encrypted files, conventional signature way is helpless, and the encryption deformation may I go on to multiple computation, can deformation many times, also can through different algorithms to do, that is the traditional for antivirus software is not too orientation.

The third LP attack, a lot of friends know LP attack, first hackers on the network to visit his a anonymous space, this existed is his virus, he has obtained a web access, after he landed in this Office 2010 is my favorite.

website hang buy to some trojans. LP violated computer attack is to become a source of attack, constantly of LAN computer technology attack. For everyone to see, page did not show, because it is zero zero times, but in fact already in the implementation of this code, then we now visit this hang horse page. Microsoft outlook 2010 is convenient!

Now of the virus has fully developed, Internet difficulty we will meet so many awkward questions. Well, thank you LiHaiMing sir's explanation and analysis. Everyone a son accept so much information, and may feel a little boring, below we take a break, we at arc long side prepared lounge, everybody can smoke, eat a snack and have a rest. The more wonderful content will behind.

We see the Trojan Office

 

horse manufacturing, this is the pipeline industrialized production model, first is bugs mining, this is the work done, once the success, I will be based vulnerability mining web Trojan, loophole do goal through use these loopholes invasion of computer users the current Microsoft Office is so great!

system. The third men trojans, I finish your system the invasion is to be done? The inside is to plunder

Resources. Also a virus dissolve device, is once you infected once, he'll keep download from the web site at many of the virus, after just one infection often suffered from such attacks, this is the whole assembly line type of industrial production model.

We first see vulnerabilities mining, on the left is the condition of mining process loopholes in the The invention of Microsoft Office 2010 is a big change of the world.

early days after many security workers, mining after the information network vulnerabilities will report to the relevant manufacturers, manufacturers association based on these flow of the current system for patches. Now loophole mining depends on the moral, I dig holes need not do viruses, I just need to dig out the vulnerability of information, put this information can sell can change, this Office 2010 –save your time and save your money.

leads to a lot of flow of information sell online. We come to the right is hackers website, the left is bugs screenshots, it is in the name of the platform is among, we saw a Windows, have WindowsIP, lot, most the right side is the price, we see this as a supermarket is same, very real situation. The Outlook 2010is powerful.

next page Trojan and men trojans production, first look at page Trojan making me use this template can according to my need I need to use which loophole, vulnerabilities can use this unified template operation. Right more simple, Trojan men just need to choose the file you want to steal what game account. In fact after just these people have already seen, the Internet now is the virus more clear, a clear division of the module. Now the power of the virus it more big, destructive and propagation speed before far more. Microsoft outlook 2010 is convenient!

Looking again, spread word spread we mentioned just now more than 90% of the transmission way were using the web site of the horse, if hang traffic is very big, it users of these visits can be hanged horse after victim, if I have a lot of flow of words, large Numbers of users just visit the website, very simple one operation can be I control goals. So many viruses communicator, they may go to utilize various measures to promote some access to hang horse website. For example first we can through acquisition of some flow, say the way hang horse takeover some big porn sites, or some advertising sites, this place may have a lot of network flow. The second kind of mentioned large website, he can hire hackers reached the purpose of hang horse. The third kind of can also use SEO calculation, through some algorithm, optimizing I deceptive site's ranking, easier to let users to click on, including the use of P2P form give everybody download some software, this is the main Trojan virus spread the way.

Just look at so Microsoft office 2010

 

much, we estimate would want to, viruses really harvest so severe? This is our in some major security vendors, antivirus vendors on the BBS, some of the information intercepted as users we see this confusion, WuNaiHe helpless common occurance, viruses really so bad? Is Office 2010 –save your time and save your money.

there is a technical breakthrough? Or do the virus more people? In fact? We explained later. In the number of people manufacturing viruses increase but it's not the fundamental reasons. The fundamental reasons in where?

We first review the virus, the history of early CIS everyone know, to 2000, appeared with virus, Microsoft Office is so great!

love by E-mail, 2003 spread the virus appeared worms king 2004, the virus, everybody oscillations that time began to realize our operating system patches of how important it is to burn incense, 2006 panda virus. This year the latest Trojan group of viruses, using third-party loophole to spread. In fact we saw so many be representative of the typical virus, their methods of spread, they use some of the mechanism are quietly before something happened to change, the virus more is to destroy our system and network.

Now, then we more to see the pandas or Trojan group of incense, or more will go to steal the user account, will have so of some change, this is actually we talk about computer virus spread and Office 2007 is so powerful.

against the new trend of computer virus, has achieved the Internet change. So what is the Internet change? What is a computer virus realized the Internet change? We take, begin from objective comparison for the virus and now, in the past the virus have what different? The past virus virus makers are in exaggerates the purpose of social or prank developed, now more on economic benefits for economic purpose, which I make this virus is for economic interests, often behind The invention of Microsoft Office 2010 is a big change of the world.

have collectivize operation technology without any fundamental change. For from transmission way, we see more than 90% of the distribution is the way through a web hang horse. We need to see this contrast, need to understand is the past virus and now the biggest different, the virus is the past is more solo combat now had a clear division of work, who produce who spread? There is a flow of things, these are the changes in the past and present.

We look at this picture, this is just now, we have been in the Internet virus, then what is the industry chain chain? From the left lower feet, I need a loophole, using this loophole the diggers, then someone acquisitions make viruses that this virus virus holders, then sold to virus holder of the sales staff sales personnel, the virus has been forming sold in need, is what we call the men who hack these viruses through this website traffic dealer implanted inside, the website became spread platform. Then we said is economic interests, the ultimate money come from? Is that a Microsoft Office 2007is my love!

computer users, once the computer virus, computer store in after the account, passwords, personal property, including enterprise to confidential information may into money and that is the whole Internet viruses condition, division of labor is very clear, just like a real commercial companies alike have r&d team, planning team, by the sales team, can even after-sales service team I can according to your needs engraftment, this is obviously of system, this is change that is Internet viruses industrial chain.

Rising 2008 safety Microsoft

 

technology conference Mr LiHaiMing speech

First look at two real case, the first is about ordinary computer users browse the hanging in between undoubtedly horse virus website cause the system paralyzed process. This is a health system, like our normal everyone to use system with a lot of the application itself as the media player software, like many applications, this time we actually see all the tools are can normal use, this is a very healthy system, our electronic reading device etc, application software is a good Many people like Microsoft Office.

condition. Once we accidentally hanging on a horse's website could lead to the entire after the destruction of health status. System See, PPlive can also be normal use of also can normal connections, once visited a malicious website appears later what affair? Please note, this site is hanging horse website, once a skip connected to another site that has been implanted trojans, viruses, the progress bar constantly under the IE in advance, but the state of the system? This is Microsoft Office 2007 is welcomed by the whole world.       

true, the state of the system is almost no response state, actual really no response?

This is just a phenomenon, the surface of what we see now is likely some friends experienced some of the things that we once visited malicious website, at that time our computer will not supple, no response, we may mean crashed in, but in fact backstage do many things, of course, Office 2007 makes life great!

now we can not see, to meet give everybody answers. This time the virtual memory Windows and hints that something is too low, has cost of our resources, meet this kind of situation we may only restart your computer. We see, after the restart after entering system, automatic opened just the web at that time we'll watch it, our start menu inside, we all programs graph into another, and applications are not available, and Windows also hints of software system be replaced, all Windows 7 make life wonderful!

applications shall not use. Then we look out into the system inside what's going on? Double-click the disk into not to go with this program in, in later become like this, everyone may have a consciousness I come back. Panda incense is like this, infection later system became so, just now, we see that the surface phenomenon, why can appear such problems? May many friends will have doubt I just visited a website, a very simple operation there is nothing doing, why should that be?

See, first open system's directory, you know this is our usual some applications, some temporary files in this, now is the normal state, once I visited malicious website, we see after the open the page at the same time, we only see the phenomenon, backstage on the surface of the download a I loveOffice 2010 !

lot of procedures, progress is also a lot of unknown process, this is altered. Download countless virus software, and the execution of all silently silent up, this is just behind us to see the situation. So many friends saw later possibility jittery, or feel empathy, yes, because this is very true occurred in our side of things, may have everybody in work across. Microsoft Office 2010is so great!

So face newOffice

 

 challenges, rising company is how to deal with? This is I today to share with the theme. Rising Internet security strategy implementation, also is rising "cloud plan". We first see, what exactly is cloud plan? Since rising since security strategy proposed cloud plan, many firms Microsoft Office 2010 is so great.

also has proposed his plan to cloud the understanding, someone says the cloud plan is computing clouds, and some say cloud plan is the way to get more virus samples, in fact I said the two ideas are not comprehensive or slice off, rising a word is how to understand? We think cloud of the Internet plan is safe. So what is the security of the Internet? The traditional information security strategy of why can't deal with the threat of Internet viruses? Below I in my speech will answer for each of you. Office 2010 is my favorite.

First to see the traditional security strategy? What are those? We sums up the traditional security strategies have two points, first is to upgrade software upgrade to speed up the way of interval after the virus in the user reflect speed. Another way is to develop and perfect more host anti-virus technology applied in products more virus solution and defense technology. Below we came to each of the two ways of ills make a understanding. Outlook 2010 is powerful.

First look at first, shorten the software upgrade for users to accelerate the interval after the virus in the reflect speed. This strategy problem in what place? All through this sentence in fact already see problems, from this sentence of logical relationship can be seen above, if the spread of the virus speed, updated speed magnified indefinitely, if we strategies is to make software upgrade intervals, what concept of infinite shrink? We upgrade the expansion of the frequency of infinite. Microsoft Office is helpful.

Obviously is not reasonable relations, so we see rising from 2002 to 2007 we upgrade changes in frequency trend, in 2002, weekly updates, 2003 3 times, four times in 2004, 2005 five times a week, in 2007 the upgrade, which means I 21 times every upgrade three times the virus. Then from between 2002 and 2007, our upgrade frequency increased 20 times. Virus added much the frequency of updates? Viruses increase in the number of how many? I in 2003 and see about a report, sina.com global outbreak in 2002 the number of new virus to 20,000 more so much, but now 08 I report everybody a data every new virus sample, it has reached more than 20,000. It means the virus is now virtually the Internet change makes virus updates faster in 10 minutes, the virus can updates for the unit, even faster. That our antivirus software can not can so update? Also can, with absolutely no problem, we can also 10 minutes updates the virus that what concept? Is an hour to upgrade 6 times, 24 hours a day to upgrade 144 times, technically we have no problem, but all of rising users who can endure the frequency of upgrading 144 times a day? Microsoft outlook 2010

We give everyoneMicrosoft office 2010

 

in front of the brief introduction of the technology, the next script monitoring look intelligent web scripting monitoring advantages and disadvantages, the first advantage is very clear, can put the network threatened to block out. The second advantage because we are based on Office 2010 –save your time and save your money.

behavior, don't produce url library or very large virus library, so this is a lightweight behavior monitoring system, so upgrades maintenance cost was very small. The third because we were intercepted at a script engine the piece, and not the script, the script by digital Numbers can very Microsoft Office is so great!

much, for example basically all the tools, like IE, QQ, MSN, actually including, and some live tools, game kind have exaggeration west swim, and CS, CS we have developed it itself was hanged horse, you play poisoning. If use our intelligent script monitoring system, as long as he use to IE class box can monitor. Its shortcomings, this is just a monitoring technology, it will definitely lead to some execution system problem, still need we inside to add some feature matching and loopholes, loopholes spill against this match is more time-consuming, will slow down the whole script running speed. Microsoft outlook 2010 is convenient!

The second question, we raised three hang horse types, including a is the document type, using Internet connection hang horse, malicious web site we can block to, but for the cursor files and animation files, itself the structure and internal documents without relationship, script is there is no way to do this intercept. Of course the two files have obvious characteristics, its operation structure is very similar, we will simply use file repository in virus features added.

Zhongguancun online software information on November 18 afternoon 13 points of news, this The invention of Microsoft Office 2010 is a big change of the world.

morning, "2008 rising Internet security technology conference" morning field's meeting has been successfully concluded. In the morning session, the academician of Chinese academy of sciences NiGuangNa as honorable guests also attended the event, and at the conference did concise and splendid speech. Subsequently, rising MaoYiDing, and vice President of WangJianFeng and Mr LiHaiMing rising mainland China Internet computer virus outbreak in detail analysis.

ZhongWei: finally my turn, very urgent hope and everyone to communicate, because today I'll bring you very interesting things. Guests, respect of customer, everybody, good afternoon! Why to say good afternoon, I'll give you explain. Just my colleagues speech.

Rising 2008 safety technology conference Mr ZhongWei speech

We can find that the virus of the Internet has made virus outbreak of speed and renewal rate than in the past BaoFaShi growth, so the spread of the virus scope and endanger scope was also invisible expanded countless times, then face this kind of new form, traditional information security strategy have apparently cannot use of such a virus Internet new forms of development, then we say any thing, all with their own development cycle and life cycle, if can't adapt to the new forms of development of words, so he is also often decline of vertices began. If we take the traditional information safe mode compared to eight or nine o 'clock this morning the sun's words, now has almost 11:30, if not from now on, if not prepare from now started looking for coping strategies of words, we probably will be the time for me, so devoid, 11:30, possibly for many Outlook 2010is powerful.

people still morning, or at noon, but to me it is already in the afternoon. If we have no advanced consciousness, no crisis and urgency of words, we probably won't see tomorrow sunrise. The clock is good rising a little faster than others.

program also exists Microsoft

 

behavior program, if more comfortable words, many malicious put in, not a defensive role. If too strict word itself exists misstatement, for example say me to set a very strict definition, script creating documents I think is hazards program will not let you form, this to do? Microsoft Office is so great!

We actually to the problem itself also made a consideration, then we in the security system will be an jiaoyan things, through the network of supporting, very strict rules of accurate quote users directly actually, make sure it is a malicious behaviour. For we are not sure of the proposed rules, we actually just itself may be a malicious behaviour. Office 2010 –save your time and save your money.

And then to introduce a third technology, intelligent inspire scanning monitoring, why do we use it? It from the principle itself is a signature, everybody can use, you itself is behavior monitoring technology, how can use signature? This is a very simple question, because a lot of exploiting holes in the user's host program are not flaws, because now many security tools auxiliary users hit a patch, the safety of users consciousness also improves, most nets horse effect-acting is likely a, Office 2007 is so powerful.

two effect-acting, why do signature? This time for example a user using QQ loophole, but this loophole in don't exist, with killing don't exist, code ran not arise, let us be malicious behavior monitoring, through the behavior monitoring that it has no abnormal behavior, they think this is The invention of Microsoft Office 2010 is a big change of the world.

normal, apparently users this machine won't poisoning.

But for a user, if have this loophole, we can catch him. But not all users are installed our program, our objective is to acquire more information, such as malicious website, bring them here can be added to the firewall repository, can protect more users. So for this piece said we made some processing, because most of the time we see is plain code and not encrypt the code after use of a loophole, such word, or other means, it, or the code and vulnerability itself is limited, every loophole of its code characteristics, plain code feature is actually very similar, this time can use Microsoft Office 2007is my love!

our broad spectrum characteristics were poor, but not to say after dozens of features encrypted hundreds of thousands of a feature, such become we can use very little cost to realize functions. Because it is a plain code herbs, accurately is very high, but because the script is the text you need to do to make intelligent matching broad-spectrum antivirus it takes a certain price, and we do have influence on the script itself.

Then we analyzed the Office

 

problems and some of our ideas, we found no way to fix with character method with virtual execution way this thing also exist big problems, see again we mention subjective defenses. This somewhat similar to the police handling, the first step and collect Microsoft Office 2010 is so great.

evidence, and the second step through expert experience to match this behavior is malicious survey of law, i.e., what can do similar to what not to do if you do not do is illegal and criminal. If we can understand the behavior and actions, script can you use rules to match? The answer is yes, Office 2010 is my favorite.

if we can intercept the script's behavior is can we do it. Because loopholes and fixes this itself is actually hanging relies on third-party control or system vulnerability to do, these loopholes in fact are limited, may be 100, 200, code is a specific, flow also is ongoing process, so if we can catch the script behavior can make expert experience rules for behavior judgement.

Next, the realization of the technique introduced intelligent behavior. In this part, we first introduce the Windows scripting operation model, through this one for the whole script introduced let everybody running framework with an overview of, then introduce our monitoring system architecture. And finally to introduce our behavior that judge rules, the three most used inside the Office 2007 can make life more better and easier.

main technology. First, let's look at Windows script execution architecture, divided into two parts, a digital, the second is a script script engine, and they both are independent, and there are two of the module, communication relationship is the whole script running script number of sponsors, which means it launch script operation, runs with to the script, which is why the environment we found that many scripts, for example, ABS, JS can be mixed programming, variable in ABS in JS Microsoft Office is helpful.

can also use, why? Because their national space is the same rather than more.

Then another function provided that means that it will accept and response script system call and scripts events, for example scripts I need to call some of the functions for example to system change, these are the window size of digital to do through script. The script engine first function is to provide the script code explain implementation, the second he will inform the script data some state script engine itself and the scripts are executed state, and the third will call system of some functions. We through carefully observed scripts digital and scripting engine I found some interesting features: first script provides the whole script digital operating environment, the script script engine and Numbers of the communication between is needed to achieve the COM interface. The script engine also has a very distinct characteristics, the function is all inside him by the COM constitution, this is our second features found. Next we introduced the script engine and scripts digital relationship, the script engine and script the characteristics of digital communication, and then to see script monitoring system model architecture. This is the system to provide script digital, this is script engine, we in the middle by inserting a script, in a traditional backlog engine inside, this script script monitoring stressful events and system call is not the systematic monitoring cause system can't get its monitoring, say so traditional not intelligent monitoring, just a scripting block monitoring, say so unable to system processing. But you may have a question, if I just do a safe browsing machine do a other things aren't they the same? Microsoft Office 2007 is the best invention in the world.

The following simpleMicrosoft office

 

 speak about three layer model, their function and what should be paid attention to practice. Judge layer is the responsibility of the will provide the data and tissue layers, determine its malicious compares is malicious behaviour. We need to consider the situation in to meet demand The invention of Microsoft Office 2010 is a big change of the world.

Next, malicious behavior is how to judge? There I made two groups, the first is based on continuous or pay equal attention to, based on the continuous movement, which means this Office 2010 –save your time and save your money.

program action is a sequence of order, or no, as long as you do I think you are, so says the former accuracy is definitely better than the latter high. The second is implementing judgement and afterwards judgement, the program each do an action will judge, until, you develop your yes can end you. Can do a behavior blocking, later judgement is let you all program run, and then all of Microsoft Office is so great!

the judgment. Do abstraction

Below I speaking a tissue layers of tissue layers, organized and existing function is the initiator of international relations, record its necessary action information. We need to consider what? Must first meet our needs, then satisfy the needs in how to organize these actions under the sponsors. In Microsoft Office 2007is my love!

the program after we want to create a created than the files and movements of the file is not same? Promoters The second point is whether we can put the abstract into files infected? If a program or Office 2007 is so powerful.

a PE file modified, the modified? This time we can judge as is a rough infected file action. This is two examples illustrate how processing how abstract movement.

The third point need to record what? Put the things recorded a is to find he had done? What's the impact? We can the amendment registry and other system resources advantage is recorded, so that we can be a review after operation.