طريقة عمل الساندوكس الخاص بالأفاست Avast Sandbox

[‏windows 8]

[ , حل , ] , طريقة , عمل , الساندوكس , الخاص , بالأفاست , Avast , Sandbox

طريقة عمل الساندوكس الخاص بالأفاست Avast Sandbox

السلام عليكم و رحمة الله و بركاته
أثناء تصفحي للنت وجدت الأسباب التي تجعل أفاست يفتح الملفات في السانبوكس أوتوماتيكا :6:

و هذه الأسباب موجودة في الموقع الأصلي لأفاست و أيضا خاصة بالسانبوكس في افاست آخر نسخة التي هي 7.0.1474 .

فقررت طرحها لعل أحد المحترفين يقوم بمعرفة طرق تخطي الساندبوكس للافاست من خلال إستغلال هته المعلومات .
مع العلم أن في الافاست آخر نسخة هناك ملفات يفتحها في وضع السانبوكس أوتوماتيكا و أخرى لا يفتحها في وضع السانبوكس أوتوماتكا بل إختياريا .

المعلومات :

Several reasons why we activate the AutoSandbox

:

Static analysis finds the file suspicious
Static analyses checks file content and looks for suspicious strings in file headers similar in virus definitions. Main static analysis reasons are:

Application is not signed
It’s not mandatory to have a signed application, but signed software is statistically less likely to be harmful.

Use of executable file encryption/compression
App writers and installers(self extracts) like executable compression/encryption because it makes reverse engineering more difficult. But, it is also used by malware to hide from antivirus scanners. A compressed/encrypted file without a digital signature is doubly suspect.

The file prevalence/reputation is low
All new unknown files are potentially dangerous. Whenever they have become widespread, there will not be a reason to AutoSandbox them anymore.

The file origin/source is suspicious
Freewebs and some file distribution servers have a reputation for paying less attention to the quality and origin of their software than official distribution servers. This is a long-run issue of reputation and income management.

The file is executed from a remote/removable media
Running an application from the USB drive may cause the AutoSandbox dialogue box to appear –but the same app from your local hard drive may not. That is because many harmful apps are spread through removable media, increasing the odds of potential danger.

Generic heuristics/suspicious context
Invalid digital signatures
Suspicious file names
And there are more…
The guiding principle is that we secure your computer not only from known viruses/malware but also from viruses/malware which have not yet been uncovered.
So, the next time if you see an AutoSandbox popup appearing for your new application, read the message carefully. If you are not sure, run the app first in the AutoSandbox to prevent potential damage.

و الآن نأتي لمصدر المعلومات :

https://blog.avast.com/2012/03/20/au...u-annoying-me/

و أتمنى التفاعل مع الموضوع

.
.
.
.
.
:6:

المصدر: development-point - للمزيد تابع : الأرشيف

---

'vdrm ulg hgshk],;s hgohw fhgHthsj Avast Sandbox F pg D