Trend Micro InterScan M Series, Руководство администратора

Страница: 369 / 480

Terminology
A
-
3
Mass-Mailing Attacks
Email-aware viruses have the ability to spread by email by automating the infected
computer's email client. Mass-mailing behavior describes a situation when an infec-
tion spreads rapidly between clients and servers in an email environment. Trend
Micro has designed the scan engine in InterScan Gateway Security Appliance to
detect behaviors that mass-mailing attacks usually demonstrate. The behaviors are
recorded in the virus pattern file that is updated using the Trend Labs ActiveUpdate
servers. The action set for mass-mailing behavior takes precedence over all other
actions, and the recommended action against mass-mailing attacks is that such email
be deleted.
Network Viruses
A virus spreading over a network is not, strictly speaking, a network virus. Only some
of the threats mentioned in this section, such as worms, qualify as network viruses.
Specifically, network viruses use network protocols, such as TCP, FTP, UDP, HTTP,
and email protocols such as SMTP and POP3 to replicate. InterScan Gateway Secu-
rity Appliance works with a network virus pattern file to identify and block network
viruses.
Pharming
Similar in nature to email phishing, pharming seeks to obtain personal or private (usu-
ally financial related) information through domain spoofing. Rather than being
spammed with malicious and mischievous email requests for you to visit spoofed
Web sites that appear legitimate, pharming "poisons" a DNS server by infusing it with
false information, resulting in your request's being redirected elsewhere. However,
your browser will indicate that you are at the correct Web site, which makes pharming
a bit more serious and more difficult to detect. Phishing attempts to defraud people
one at a time with an email, whereas pharming allows the scammers to target large
groups of people at one time through domain spoofing.