管理工具100使用說(shuō)明課件

卡巴斯基Windows端點(diǎn)安全–管理篇第一章.第二章.第三章.第四章.第五章.KasperskyEndpoint文件系統(tǒng)保護(hù)網(wǎng)絡(luò)保護(hù)主動(dòng)防御威脅診斷Security10.0第六章.保護(hù)狀態(tài)診斷卡巴斯基Windows端點(diǎn)安全–管理篇第一章.KaspeKaspersky?EndpointKL002.98SecurityforWindows第一章. KasperskyEndpoint保護(hù)管理Security10.0Kaspersky?SecurityforWindowsKL002.98.KasperskyEndpointSecurityforWindows保護(hù)組件文件系統(tǒng)保護(hù)—文件反病毒—掃描任務(wù)網(wǎng)絡(luò)保護(hù)及網(wǎng)絡(luò)流量掃描—————郵件反病毒網(wǎng)頁(yè)反病毒即時(shí)通訊反病毒反網(wǎng)絡(luò)攻擊防火墻主動(dòng)防御—系統(tǒng)監(jiān)控KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows如何在管理組中創(chuàng)建新的組KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows右擊管理組點(diǎn)屬性就可以創(chuàng)建一個(gè)新的組KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindowsKasperskyEndpointSecurity10.0策略KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindowsKasperskyEndpointSecurity10.0策略KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows父組和子組策略屬性繼承關(guān)系父組策略子組策略客戶端計(jì)算機(jī)設(shè)置強(qiáng)制應(yīng)用強(qiáng)制應(yīng)用KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows禁用繼承KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows右擊點(diǎn)屬性配置掃描任務(wù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保護(hù)設(shè)置-啟用保護(hù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保護(hù)設(shè)置-自我保護(hù)設(shè)置KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows檢查威脅類型KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows卡巴斯基安全網(wǎng)絡(luò)KasperskySecurityNetworkKL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows卡巴斯基安全網(wǎng)絡(luò)KasperskySecurityNetworkKasperskyLab服務(wù)器KSN云端KasperskySecurityCenterKSN代理客戶端計(jì)算機(jī)本地KSN緩存KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindowsKSN代理KL002.98.KasperskyEndpoint實(shí)驗(yàn)6創(chuàng)建任務(wù)和策略實(shí)驗(yàn)6Kaspersky?EndpointKL002.98SecurityforWindows第二章. 文件系統(tǒng)保護(hù)保護(hù)管理Kaspersky?SecurityforWindows第二KL002.98.KasperskyEndpointSecurityforWindows文件系統(tǒng)保護(hù)惡意程序文件反病毒反病毒掃描硬盤KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows文件反病毒

攔截文件操作

清除文件感染

文件反病毒為反病毒保護(hù)的主要組件之一KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描技術(shù)

特征碼分析

啟發(fā)式分析

KSN數(shù)據(jù)庫(kù)對(duì)比分析KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描算法感染特征碼分析正常正常感染啟發(fā)式分析正常感染正常感染KSN本地緩存KSN本地緩存無(wú)記錄無(wú)記錄正常感染正常感染KSN云端KSN云端無(wú)記錄或無(wú)連接無(wú)記錄或無(wú)連接KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows標(biāo)準(zhǔn)安全級(jí)別低級(jí)別推薦級(jí)別高級(jí)別文件類型依據(jù)擴(kuò)展名掃描文件依據(jù)文件格式掃描掃描全部文件保護(hù)范圍所有可移動(dòng)驅(qū)動(dòng)器所有硬盤所有網(wǎng)絡(luò)驅(qū)動(dòng)器所有可移動(dòng)驅(qū)動(dòng)器所有硬盤所有網(wǎng)絡(luò)驅(qū)動(dòng)器所有可移動(dòng)驅(qū)動(dòng)器所有硬盤所有網(wǎng)絡(luò)驅(qū)動(dòng)器啟發(fā)式分析禁用低中僅掃描新增或修改過(guò)的文件++—復(fù)合文件掃描—掃描嵌入式OLE對(duì)象掃描新的壓縮文件掃描新安裝包掃描所有嵌入式OLE對(duì)象掃描模式智能智能智能掃描技術(shù)iSwift技術(shù)iChecker技術(shù)iSwift技術(shù)iChecker技術(shù)iSwift技術(shù)iChecker技術(shù)暫停任務(wù)———KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows對(duì)象排除KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows應(yīng)用程序排除KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows應(yīng)用程序排除進(jìn)程排除1.路徑排除2.暫停文件反病毒3.KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows病毒掃描任務(wù)

掃描被文件反病毒跳過(guò)的文件

掃描系統(tǒng)內(nèi)存

掃描啟動(dòng)扇區(qū)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描設(shè)置KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描范圍KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows標(biāo)準(zhǔn)對(duì)象掃描KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows帳戶KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描計(jì)劃KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描計(jì)劃KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描計(jì)劃KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描計(jì)劃KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows一般掃描任務(wù)設(shè)置KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows本地掃描任務(wù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows通過(guò)策略管理本地病毒掃描任務(wù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows集中使用掃描任務(wù)

組任務(wù)—關(guān)鍵區(qū)域掃描—完全掃描

指定計(jì)算機(jī)的任務(wù)—掃描某臺(tái)特定計(jì)算機(jī)—掃描某幾臺(tái)選定計(jì)算機(jī)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows標(biāo)準(zhǔn)組任務(wù)計(jì)劃—每個(gè)星期五19:00—運(yùn)行錯(cuò)過(guò)的任務(wù)掃描對(duì)象————系統(tǒng)內(nèi)存啟動(dòng)對(duì)象啟動(dòng)扇區(qū)操作系統(tǒng)路徑安全級(jí)別—推薦KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows標(biāo)準(zhǔn)組任務(wù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows高級(jí)清除技術(shù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows啟動(dòng)高級(jí)清除技術(shù)的條件

桌面發(fā)現(xiàn)感染文件

感染文件已經(jīng)被運(yùn)行

注冊(cè)表中設(shè)定了自動(dòng)啟動(dòng)被感染文件KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows啟動(dòng)高級(jí)清除技術(shù)的條件提示用戶操作進(jìn)入操作系統(tǒng)保護(hù)模式嘗試清除掃描內(nèi)存開(kāi)機(jī)啟動(dòng)程序掃描重新啟動(dòng)計(jì)算機(jī).5.6.KL002.98.KasperskyEndpointKaspersky?EndpointKL002.98SecurityforWindows第三章. 網(wǎng)絡(luò)保護(hù)保護(hù)管理Kaspersky?SecurityforWindows第三KL002.98.KasperskyEndpointSecurityforWindows網(wǎng)絡(luò)保護(hù)目標(biāo)

在惡意程序滲透的早期階段進(jìn)行阻止

阻止網(wǎng)絡(luò)攻擊

預(yù)防網(wǎng)絡(luò)惡意程序傳播及預(yù)防數(shù)據(jù)泄露KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保護(hù)組件

郵件反病毒

網(wǎng)頁(yè)反病毒（WebAnti-Virus）

即時(shí)通訊反病毒（IMAnti-Virus）

反網(wǎng)絡(luò)攻擊

防火墻KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)絡(luò)流量監(jiān)測(cè)Web流量網(wǎng)絡(luò)流量IM流量郵件流量郵件反病毒程序及服務(wù)即時(shí)通訊反病毒防火墻反網(wǎng)絡(luò)攻擊NDIS過(guò)濾網(wǎng)頁(yè)反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows端口監(jiān)控KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows端口監(jiān)控KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows郵件反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows啟發(fā)式分析KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows附件過(guò)濾KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)頁(yè)反病毒

阻止訪問(wèn)危險(xiǎn)網(wǎng)站

掃描通過(guò)HTTP協(xié)議下載的對(duì)象KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)頁(yè)反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows即時(shí)通訊反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows即時(shí)通訊反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows反網(wǎng)絡(luò)攻擊KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows防火墻

阻止未授權(quán)網(wǎng)絡(luò)的連接計(jì)算機(jī)

阻止應(yīng)用程序的未授權(quán)網(wǎng)絡(luò)活動(dòng)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows設(shè)置KL002.98.KasperskyEndpointKaspersky?EndpointKL002.98SecurityforWindows第四章. 主動(dòng)防御保護(hù)管理Kaspersky?SecurityforWindows第四KL002.98.KasperskyEndpointSecurityforWindows系統(tǒng)監(jiān)控

記錄應(yīng)用程序活動(dòng)

阻止危險(xiǎn)行為

回滾惡意軟件所作操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows數(shù)據(jù)源

klif.sys驅(qū)動(dòng)

防火墻

系統(tǒng)監(jiān)控模塊KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows設(shè)置KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKaspersky?EndpointKL002.98SecurityforWindows第五章. 威脅診斷保護(hù)管理Kaspersky?SecurityforWindows第五KL002.98.KasperskyEndpointSecurityforWindows本地事件

檢測(cè)威脅

選擇操作

操作結(jié)果KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows本地事件KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows事件類型

嚴(yán)重事件

錯(cuò)誤

警告

信息KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows事件保存到服務(wù)器KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows事件保存到服務(wù)器KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows病毒報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows過(guò)濾有問(wèn)題的計(jì)算機(jī)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows感染最嚴(yán)重的計(jì)算機(jī)報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows被感染的計(jì)算機(jī)用戶報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)絡(luò)攻擊報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)絡(luò)攻擊報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows報(bào)告參數(shù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保存報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows發(fā)送報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows發(fā)送報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows計(jì)算機(jī)狀態(tài)

狀態(tài)—保護(hù)情況指示

可能的情況———正常警告嚴(yán)重KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows狀態(tài)與威脅處理有關(guān)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows全局保護(hù)狀態(tài)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows根據(jù)狀態(tài)選擇計(jì)算機(jī)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows備份存儲(chǔ)區(qū)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows隔離KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows未處理的對(duì)象KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows對(duì)象存儲(chǔ)參數(shù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows集中存儲(chǔ)管理

只有對(duì)象信息會(huì)被發(fā)送

服務(wù)器端啟動(dòng)的命令是在客戶端計(jì)算機(jī)上執(zhí)行的KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows集中存儲(chǔ)管理KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows集中存儲(chǔ)管理KL002.98.KasperskyEndpointKaspersky?EndpointKL002.98SecurityforWindows第六章. 保護(hù)狀態(tài)診斷保護(hù)管理Kaspersky?SecurityforWindows第六KL002.98.KasperskyEndpointSecurityforWindows保護(hù)狀態(tài)診斷主要工具—狀態(tài)—基于數(shù)據(jù)同步—獨(dú)立于事件可能的情況———正常警告嚴(yán)重KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows啟用/禁用狀態(tài)條件KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows狀態(tài)繼承KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows一般狀態(tài)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows計(jì)算機(jī)選擇KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows計(jì)算機(jī)選擇操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保護(hù)狀態(tài)報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保護(hù)狀態(tài)統(tǒng)計(jì)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows狀態(tài)改變?cè)騅L002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows狀態(tài)改變?cè)騅L002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows狀態(tài)重置到正常

消除導(dǎo)致?tīng)顟B(tài)改變的原因———啟用保護(hù)處理未處理的對(duì)象更新數(shù)據(jù)庫(kù)

下一次同步后，狀態(tài)會(huì)改變KL002.98.KasperskyEndpoint卡巴斯基Windows端點(diǎn)安全第一章.KasperskyEndpointSecurity10.0基礎(chǔ)–管理篇

實(shí)驗(yàn)6：創(chuàng)建任務(wù)和策略第二章.文件系統(tǒng)保護(hù)第三章.網(wǎng)絡(luò)保護(hù)

實(shí)驗(yàn)7：配置防火墻第四章.主動(dòng)防御第五章.威脅診斷第六章.保護(hù)狀態(tài)診斷卡巴斯基Windows端點(diǎn)安全–管理篇 實(shí)驗(yàn)6：創(chuàng)建任務(wù)和卡巴斯基Windows端點(diǎn)安全–管理篇第一章.第二章.第三章.第四章.第五章.KasperskyEndpoint文件系統(tǒng)保護(hù)網(wǎng)絡(luò)保護(hù)主動(dòng)防御威脅診斷Security10.0第六章.保護(hù)狀態(tài)診斷卡巴斯基Windows端點(diǎn)安全–管理篇第一章.KaspeKaspersky?EndpointKL002.98SecurityforWindows第一章. KasperskyEndpoint保護(hù)管理Security10.0Kaspersky?SecurityforWindowsKL002.98.KasperskyEndpointSecurityforWindows保護(hù)組件文件系統(tǒng)保護(hù)—文件反病毒—掃描任務(wù)網(wǎng)絡(luò)保護(hù)及網(wǎng)絡(luò)流量掃描—————郵件反病毒網(wǎng)頁(yè)反病毒即時(shí)通訊反病毒反網(wǎng)絡(luò)攻擊防火墻主動(dòng)防御—系統(tǒng)監(jiān)控KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows如何在管理組中創(chuàng)建新的組KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows右擊管理組點(diǎn)屬性就可以創(chuàng)建一個(gè)新的組KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindowsKasperskyEndpointSecurity10.0策略KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindowsKasperskyEndpointSecurity10.0策略KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows父組和子組策略屬性繼承關(guān)系父組策略子組策略客戶端計(jì)算機(jī)設(shè)置強(qiáng)制應(yīng)用強(qiáng)制應(yīng)用KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows禁用繼承KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows右擊點(diǎn)屬性配置掃描任務(wù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保護(hù)設(shè)置-啟用保護(hù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保護(hù)設(shè)置-自我保護(hù)設(shè)置KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows檢查威脅類型KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows卡巴斯基安全網(wǎng)絡(luò)KasperskySecurityNetworkKL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows卡巴斯基安全網(wǎng)絡(luò)KasperskySecurityNetworkKasperskyLab服務(wù)器KSN云端KasperskySecurityCenterKSN代理客戶端計(jì)算機(jī)本地KSN緩存KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindowsKSN代理KL002.98.KasperskyEndpoint實(shí)驗(yàn)6創(chuàng)建任務(wù)和策略實(shí)驗(yàn)6Kaspersky?EndpointKL002.98SecurityforWindows第二章. 文件系統(tǒng)保護(hù)保護(hù)管理Kaspersky?SecurityforWindows第二KL002.98.KasperskyEndpointSecurityforWindows文件系統(tǒng)保護(hù)惡意程序文件反病毒反病毒掃描硬盤KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows文件反病毒

攔截文件操作

清除文件感染

文件反病毒為反病毒保護(hù)的主要組件之一KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描技術(shù)

特征碼分析

啟發(fā)式分析

KSN數(shù)據(jù)庫(kù)對(duì)比分析KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描算法感染特征碼分析正常正常感染啟發(fā)式分析正常感染正常感染KSN本地緩存KSN本地緩存無(wú)記錄無(wú)記錄正常感染正常感染KSN云端KSN云端無(wú)記錄或無(wú)連接無(wú)記錄或無(wú)連接KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows標(biāo)準(zhǔn)安全級(jí)別低級(jí)別推薦級(jí)別高級(jí)別文件類型依據(jù)擴(kuò)展名掃描文件依據(jù)文件格式掃描掃描全部文件保護(hù)范圍所有可移動(dòng)驅(qū)動(dòng)器所有硬盤所有網(wǎng)絡(luò)驅(qū)動(dòng)器所有可移動(dòng)驅(qū)動(dòng)器所有硬盤所有網(wǎng)絡(luò)驅(qū)動(dòng)器所有可移動(dòng)驅(qū)動(dòng)器所有硬盤所有網(wǎng)絡(luò)驅(qū)動(dòng)器啟發(fā)式分析禁用低中僅掃描新增或修改過(guò)的文件++—復(fù)合文件掃描—掃描嵌入式OLE對(duì)象掃描新的壓縮文件掃描新安裝包掃描所有嵌入式OLE對(duì)象掃描模式智能智能智能掃描技術(shù)iSwift技術(shù)iChecker技術(shù)iSwift技術(shù)iChecker技術(shù)iSwift技術(shù)iChecker技術(shù)暫停任務(wù)———KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows對(duì)象排除KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows應(yīng)用程序排除KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows應(yīng)用程序排除進(jìn)程排除1.路徑排除2.暫停文件反病毒3.KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows病毒掃描任務(wù)

掃描被文件反病毒跳過(guò)的文件

掃描系統(tǒng)內(nèi)存

掃描啟動(dòng)扇區(qū)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描設(shè)置KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描范圍KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows標(biāo)準(zhǔn)對(duì)象掃描KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows帳戶KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描計(jì)劃KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描計(jì)劃KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描計(jì)劃KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows掃描計(jì)劃KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows一般掃描任務(wù)設(shè)置KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows本地掃描任務(wù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows通過(guò)策略管理本地病毒掃描任務(wù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows集中使用掃描任務(wù)

組任務(wù)—關(guān)鍵區(qū)域掃描—完全掃描

指定計(jì)算機(jī)的任務(wù)—掃描某臺(tái)特定計(jì)算機(jī)—掃描某幾臺(tái)選定計(jì)算機(jī)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows標(biāo)準(zhǔn)組任務(wù)計(jì)劃—每個(gè)星期五19:00—運(yùn)行錯(cuò)過(guò)的任務(wù)掃描對(duì)象————系統(tǒng)內(nèi)存啟動(dòng)對(duì)象啟動(dòng)扇區(qū)操作系統(tǒng)路徑安全級(jí)別—推薦KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows標(biāo)準(zhǔn)組任務(wù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows高級(jí)清除技術(shù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows啟動(dòng)高級(jí)清除技術(shù)的條件

桌面發(fā)現(xiàn)感染文件

感染文件已經(jīng)被運(yùn)行

注冊(cè)表中設(shè)定了自動(dòng)啟動(dòng)被感染文件KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows啟動(dòng)高級(jí)清除技術(shù)的條件提示用戶操作進(jìn)入操作系統(tǒng)保護(hù)模式嘗試清除掃描內(nèi)存開(kāi)機(jī)啟動(dòng)程序掃描重新啟動(dòng)計(jì)算機(jī).5.6.KL002.98.KasperskyEndpointKaspersky?EndpointKL002.98SecurityforWindows第三章. 網(wǎng)絡(luò)保護(hù)保護(hù)管理Kaspersky?SecurityforWindows第三KL002.98.KasperskyEndpointSecurityforWindows網(wǎng)絡(luò)保護(hù)目標(biāo)

在惡意程序滲透的早期階段進(jìn)行阻止

阻止網(wǎng)絡(luò)攻擊

預(yù)防網(wǎng)絡(luò)惡意程序傳播及預(yù)防數(shù)據(jù)泄露KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保護(hù)組件

郵件反病毒

網(wǎng)頁(yè)反病毒（WebAnti-Virus）

即時(shí)通訊反病毒（IMAnti-Virus）

反網(wǎng)絡(luò)攻擊

防火墻KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)絡(luò)流量監(jiān)測(cè)Web流量網(wǎng)絡(luò)流量IM流量郵件流量郵件反病毒程序及服務(wù)即時(shí)通訊反病毒防火墻反網(wǎng)絡(luò)攻擊NDIS過(guò)濾網(wǎng)頁(yè)反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows端口監(jiān)控KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows端口監(jiān)控KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows郵件反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows啟發(fā)式分析KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows附件過(guò)濾KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)頁(yè)反病毒

阻止訪問(wèn)危險(xiǎn)網(wǎng)站

掃描通過(guò)HTTP協(xié)議下載的對(duì)象KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)頁(yè)反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows安全級(jí)別KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows即時(shí)通訊反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows即時(shí)通訊反病毒KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows反網(wǎng)絡(luò)攻擊KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows防火墻

阻止未授權(quán)網(wǎng)絡(luò)的連接計(jì)算機(jī)

阻止應(yīng)用程序的未授權(quán)網(wǎng)絡(luò)活動(dòng)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows設(shè)置KL002.98.KasperskyEndpointKaspersky?EndpointKL002.98SecurityforWindows第四章. 主動(dòng)防御保護(hù)管理Kaspersky?SecurityforWindows第四KL002.98.KasperskyEndpointSecurityforWindows系統(tǒng)監(jiān)控

記錄應(yīng)用程序活動(dòng)

阻止危險(xiǎn)行為

回滾惡意軟件所作操作KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows數(shù)據(jù)源

klif.sys驅(qū)動(dòng)

防火墻

系統(tǒng)監(jiān)控模塊KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows設(shè)置KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows配置排除規(guī)則KL002.98.KasperskyEndpointKaspersky?EndpointKL002.98SecurityforWindows第五章. 威脅診斷保護(hù)管理Kaspersky?SecurityforWindows第五KL002.98.KasperskyEndpointSecurityforWindows本地事件

檢測(cè)威脅

選擇操作

操作結(jié)果KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows本地事件KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows事件類型

嚴(yán)重事件

錯(cuò)誤

警告

信息KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows事件保存到服務(wù)器KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows事件保存到服務(wù)器KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows病毒報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows過(guò)濾有問(wèn)題的計(jì)算機(jī)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows感染最嚴(yán)重的計(jì)算機(jī)報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows被感染的計(jì)算機(jī)用戶報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)絡(luò)攻擊報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows網(wǎng)絡(luò)攻擊報(bào)告KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows報(bào)告參數(shù)KL002.98.KasperskyEndpointKL002.98.KasperskyEndpointSecurityforWindows保存報(bào)告KL002.98.KasperskyEndpointK