专门名词索引

Adware is a software application that displays advertising banners while the program is running. Adware often contains spyware in order for the program to know which advertisements to display based on the current user’s preference.

Dialers are Trojans that, upon execution, connect the system to a pay-per-call location in which the unsuspecting user is billed for the call without his/her knowledge. Dialers often arrive in porn-related or other enticing service-related applications.

A dropper is malware that drops other malware into a system. Some droppers just drop viruses or Trojans, while others are viruses or Trojans that - after performing their payload - also drop copies of other malware into the system.

An exploit is a Trojan that abuses certain vulnerabilities on existing systems or services. Exploits typically utilize a known flaw, which allows it to execute an otherwise difficult routine, such as running an arbitrary program on the target machine.

Keyloggers are Trojans that, upon execution, log every keystroke or activity in a system. Although similar to third-party parenting/monitoring software, some malware actually employ the same technique to gather valuable data from unsuspecting users.

Kits are malware-producing applications that give the user the option to create customized malware. A kit can often produce multiple variations of a virus or a worm depending on the number of options offerred in the kit. An antivirus scanner should be capable of detecting the source (kit application) and its spawn.

Multi-partite viruses have characteristics of both boot sector viruses and file infecting viruses.

Polymorphic viruses indicate that the virus code contains a special routine that changes the other parts of the virus code on each replication to evade detection by antivirus software. Trend Micro’s antivirus products have the ability to decrypt the virus and detect such viruses.

Spyware is a software applications that monitors a user’s computing habits and personal information and sends this information to third parties without the user’s authorization or knowledge.

Distribution potential is derived from the characteristics of the malicious program. Fast-spreading network worms can spread across continents within just minutes. Some malicious programs also use numerous infection and spreading techniques – often referred to as blended threats or mixed threats. The Nimda virus, for example, was able to spread via email, network shares, infected Web sites, as well as Web traffic (http/port 80).

As new systems are made and improved with added functionality, proof-of-concept malware often follows. This uniqueness, as well as the widespread implementation of a particular operating system or software, also influences the potential distribution of each malware. Many viruses written in the past do not run or spread on newer operating systems or operating systems that have all the latest security patches installed.

High
- Blended threats (i.e. spreads via email, P2P, IM, network shares)
- Mass mailers
- Spreads via network shares

Medium
- Mailers
- has spread via third-party or media
- spreads in IRC, IM, or P2P
- requires user intervention to spread
- URL/Web site download

Low
- no network spreading
- requires manual distribution to spread

Reported Infections, or real-time spread, is measured by reports coming in from the World Virus Tracking Center, as well as from Trend Micro business units around the world that are receiving threat reports and support inquiries in their areas. Reports from other antivirus industry vendors, and media attention, also contribute to this factor.

High - reports indicate that the virus has been seen all over the world and with numerous infections per site.

Medium - few reported incidents all over the world or numerous reports in certain regions.

Low - no, or very few, infections reported.

巨集病毒 - W2KM、W97M、X97M、P97M、A97M、WM、XM、V5M

COM 及 EXE 档病毒 - PE 、 NE 或没有字首

后门程式 - BKDR

开机型病毒 - 没有字首

特洛依木马型病毒 - TROJ

Executable and Link format - ELF

恶作剧程式 - JOKE

Java 恶意程式码 - JAVA

ActiveX 恶意程式码 - ATVX

VBScript、JavaScript 或 HTML 病毒 - VBS、JS、HTML

Damage potential and danger to systems is derived from the characteristics of the malicious program. Some malicious programs have been known to attack important operating system files, leaving the system unstable or unable to re-boot.

High
- system becomes unuseable (i.e. flash bios, format HDD)
- system data or files are unrecoverable (i.e. encryption of data)
- system cannot be automatically recovered using tools
- recovery requires restoring from backup
- Causes large amounts of network traffic (packet flooders, mass mailers)
- Data/files are sent to a third party

Medium
- can be recovered using Trend Micro products or cleaning tools
- Minor data/file modification (i.e. File infectors)
- malware that write minimal amount of data to the disk
- malware that kill applications in memory
- causes medium amount of network traffic (i.e. slow mailers)
- Automatically executes unknown programs
- deletes security reletad applications (i.e. antivirus, firewall)

Low
- no system changes
- deletion of less significant files in the system
- damage can be recovered by users without using any tools
- damage can be reversed just by rebooting the system

大部份的病毒都可以经由Trend 防毒软体从寄宿档案中被清除。会修改系统登录或留下档案的病毒或特洛依木马型病毒需要特定的清除指示。通常，删除特洛依木马型病毒或恶作剧程式的方法是直接删除感染的程式，不需要任何清除动作。

若要快速检查您的 PC 是否还含有病毒，请利用 HouseCall ─ 这是趋势科技的线上扫毒程式。这项工具可侦测出您的 PC 中潜藏的病毒。

若要在病毒感染您的 PC 或网路之前就将病毒扫除，维护您 PC 的健康，请即刻采用可能的防毒解决方案。趋势科技可针对家庭用户、企业用户以及ISP，提供病毒防护与内容保全解决方案。