100BaseT

An alternate term for fast Ethernet, an upgraded standard for connecting computers into a local area network (LAN). 100BaseT Ethernet can transfer data at a peak rate of 100 Mbps. It is also more expensive and less common than 10BaseT.

Also see 10BaseT.

10BaseT

The most common form of Ethernet is called 10BaseT, which denotes a peak transmission speed of 10 Mbps using copper twisted-pair cable. Ethernet is a standard for connecting computers into a local area network (LAN). The maximum cable distance is 100 meters (325 feet), the maximum devices per segment is 1, and the maximum devices per network are 1024.

Also see 100BaseT.

access (verb)

To read data from or write data to a storage device, such as a computer or server.

access (noun)

Authorization to read or write data. Most operating systems allow you to define different levels of access, depending on job responsibilities.

action

The operation to be performed when:

Actions typically include clean and deliver, quarantine, delete, or deliver/transfer anyway. Delivering/transferring anyway is not recommended—delivering a virus-infected message or transferring a virus-infected file can compromise your network.

Also see target and notification.

activate

To enable your software after completion of the registration process. Trend Micro products will not be operable until product activation is complete. Activate during installation or after installation (in the management console) on the Product License screen.

Activation Code

A 37-character code, including hyphens, that is used to activate Trend Micro products. Here is an example of an Activation Code: SM-9UE7-HG5B3-8577B-TD5P4-Q2XT5-48PG4

Also see Registration Key.

active FTP

Configuration of FTP protocol that allows the client to initiate handshaking signals for the command session, but the host initiates the data session.

ActiveUpdate

A Trend Micro utility that enables on-demand or background updates to the virus pattern file and scan engine, as well as the anti-spam rules database and anti-spam engine.

ActiveUpdate is a function common to many Trend Micro products. Connected to the Trend Micro update website, ActiveUpdate provides up-to-date downloads of virus pattern files, scan engines, and program files via the Internet or the Trend Micro Total Solution CD.

ActiveX

A type of open software architecture that implements object linking and embedding, enabling some of the standard interfaces, such as downloading of web pages.

ActiveX malicious code

An ActiveX control is a component object embedded in a web page which runs automatically when the page is viewed. ActiveX controls allow web developers to create interactive, dynamic web pages with broad functionality such as HouseCall, Trend Micro's free online scanner.

Hackers, virus writers, and others who want to cause mischief or worse may use ActiveX malicious code as a vehicle to attack the system. In many cases, the web browser can be configured so that these ActiveX controls do not execute by changing the browser's security settings to high.

address

Refers to a networking address (see IP address) or an email address, which is the string of characters that specify the source or destination of an email message.

administrator

Refers to system administrator; the person in an organization who is responsible for activities such as setting up new hardware and software, allocating user names and passwords, monitoring disk space and other IT resources, performing backups, and managing network security.

administrator account

A user name and password that has administrator-level privileges.

administrator email address

The address used by the administrator of your Trend Micro product to manage notifications and alerts.

adware

Advertising-supported software in which advertising banners display while the program is running. Adware that installs a backdoor; tracking mechanism on the user's computer without the user's knowledge is called spyware.

alert

A message intended to inform a system's users or administrators about a change in the operating conditions of that system or about some kind of error condition.

anti-relay

Mechanisms to prevent hosts from piggybacking through another host’s network.

antivirus

Computer programs designed to detect and clean computer viruses.

archive

A single file containing one or (usually) more separate files plus information to allow them to be extracted (separated) by a suitable program, such as a .zip file.

attachment

A file attached to (sent with) an email message.

audio/video file

A file containing sounds, such as music, or video footage.

authentication

The verification of the identity of a person or a process. Authentication ensures that digital data transmissions are delivered to the intended receiver. Authentication also assures the receiver of the integrity of the message and its source (where or whom it came from).

The simplest form of authentication requires a user name and password to gain access to a particular account. Authentication protocols can also be based on secret-key encryption, such as the Data Encryption Standard (DES) algorithm, or on public-key systems using digital signatures.

Also see public-key encryption and digital signature.

binary

A number representation consisting of zeros and ones used by practically all computers because of its ease of implementation using digital electronics and Boolean algebra.

block

To prevent entry into your network.

bridge

A device that forwards traffic between network segments based on data link layer information. These segments have a common network layer address.

browser

A program which allows a person to read hypertext, such as Internet Explorer. The browser gives some means of viewing the contents of nodes (or pages) and of navigating from one node to another. A browser acts as a client to a remote web server.

cache

A small fast memory, holding recently accessed data, designed to speed up subsequent access to the same data. The term is most often applied to processor-memory access, but also applies to a local copy of data accessible over a network etc.

case-matching

Scanning for text that matches both words and case. For example, if dog is added to the content-filter, with case-matching enabled, messages containing Dog will pass through the filter; messages containing dog will not.

cause

The reason a protective action, such as URL-blocking or file-blocking, was triggered. This information appears in log files.

clean

To remove virus code from a file or message.

client

A computer system or process that requests a service of another computer system or process (a server) using some kind of protocol and accepts the server's responses. A client is part of a client-server software architecture.

client-server environment

A common form of distributed system in which software is split between server tasks and client tasks. A client sends requests to a server, according to some protocol, asking for information or action, and the server responds.

compressed file

A single file containing one or more separate files plus information to allow them to be extracted by a suitable program, such as WinZip.

configuration

Selecting options for how your Trend Micro product will function, for example, selecting whether to quarantine or delete a virus-infected email message.

content filtering

Scanning email messages for content (words or phrases) prohibited by your organization’s Human Resources or IT messaging policies, such as hate mail, profanity, or pornography.

content violation

An event that has triggered the Content Filtering policy.

cookie

A mechanism for storing information about an Internet user, such as name, preferences, and interests, which is stored in your web browser for later use. The next time you access a website for which your browser has a cookie, your browser sends the cookie to the web server, which the web server can then use to present you with customized web pages. For example, you might enter a website that welcomes you by name.

daemon

A program that is not invoked explicitly, but lies dormant waiting for some condition(s) to occur. The perpetrator of the condition need not be aware that a daemon is lurking.

damage routine

The destructive portion of virus code, also called the payload.

Data Loss Prevention (DLP)

A scan filter that determines if data being transferred contains sensitive information as defined by the administrator using templates, expressions, and keyword lists.

default

A value that pre-populates a field in the management console interface. A default value represents a logical choice and is provided for convenience. Use default values as-is, or change them.

De-Militarized Zone (DMZ)

From the military term for an area between two opponents where fighting is prevented. DMZ Ethernets connect networks and computers controlled by different bodies. They may be external or internal. External DMZ Ethernets link regional networks with routers.

Denial of Service (DoS) attack

Group-addressed email messages with large attachments that clog your network resources to the point where messaging service is noticeably slow or even stopped.

dialer

A type of Trojan that when executed, connects the user's system to a pay-per-call location in which the unsuspecting user is billed for the call without his or her knowledge.

digital signature

Extra data appended to a message which identifies and authenticates the sender and message data using a technique called public-key encryption.

Also see public-key encryption and authentication.

directory

A node, which is part of the structure in a hierarchical computer file system. A directory typically contains other nodes, folders, or files. For example, C:\Windows is the Windows directory on the C:\ drive.

directory path

The subsequent layers within a directory where a file can be found, for example, the directory path for the ISVW for SMB Quarantine directory is:

disclaimer

A statement appended to the beginning or end of an email message, that states certain terms of legality and confidentiality regarding the message.

domain (administrative)

A group of computers sharing a common database and security policy.

domain name

The full name of a system, consisting of its local host name and its domain name, for example, tellsitall.com. A domain name should be sufficient to determine a unique Internet address for any host on the Internet. This process, called name resolution, uses the Domain Name System (DNS).

Domain Name System (DNS)

A general-purpose data query service chiefly used on the Internet for translating host names into IP addresses.

Domain Name System (DNS) resolution

When a DNS client requests host name and address data from a DNS server, the process is called resolution. Basic DNS configuration results in a server that performs default resolution. For example, a remote server queries another server for data on a machine in the current zone. Client software on the remote server queries the resolver, which answers the request from its database files.

DOS virus

Also referred to as COM and EXE file infectors. DOS viruses infect DOS executable programs- files that have the extensions *.COM or *.EXE. Unless they have overwritten or inadvertently destroyed part of the original program's code, most DOS viruses try to replicate and spread by infecting other host programs.

download (noun)

Data that has been downloaded, for example, from a website via HTTP.

download (verb)

To transfer data or code from one computer to another. Downloading often refers to transfer from a larger host system (especially a server or mainframe) to a smaller client system.

dropper

Droppers are programs that serve as delivery mechanisms to carry and drop viruses, Trojans, or worms into a system.

encryption

Encryption is the process of changing data into a form that can be read only by the intended receiver. To decipher the message, the receiver of the encrypted data must have the proper decryption key. In traditional encryption schemes, the sender and the receiver use the same key to encrypt and decrypt data. Public-key encryption schemes use two keys: a public key, which anyone may use, and a corresponding private key, which is possessed only by the person who created it. With this method, anyone may send a message encrypted with the owner's public key, but only the owner has the private key necessary to decrypt it. PGP (Pretty Good Privacy) and DES (Data Encryption Standard) are two of the most popular public-key encryption schemes.

End User License Agreement (EULA)

An End User License Agreement or EULA is a legal contract between a software publisher and the software user. It typically outlines restrictions on the side of the user, who can refuse to enter into the agreement by not clicking I accept during installation. Clicking I do not accept will, of course, end the installation of the software product.

Many users inadvertently agree to the installation of spyware and adware into their computers when they click I accept on EULA prompts displayed during the installation of certain free software.

Ethernet

A local area network (LAN) technology invented at the Xerox Corporation, Palo Alto Research Center. Ethernet is a best-effort delivery system that uses CSMA/CD technology. Ethernet can be run over a variety of cable schemes, including thick coaxial, thin coaxial, twisted pair, and fiber optic cable. Ethernet is a standard for connecting computers into a local area network. The most common form of Ethernet is called 10BaseT, which denotes a peak transmission speed of 10 Mbps using copper twisted-pair cable.

EXE file infector

An executable program with a .exe file extension.

Also see DOS virus.

Executable and Linkable Format (ELF)

An executable file format for Unix and Linux platforms.

executable file

A binary file containing a program in machine language which is ready to be executed (run).

exploit

An exploit is code that takes advantage of a software vulnerability or security hole. Exploits are able to propagate into and run intricate routines on vulnerable computers.

false positive

An email message that was caught by the spam filter and identified as spam, but is actually not spam.

file

An element of data, such as an email message or HTTP download.

file-infecting virus

File-infecting viruses infect executable programs (generally, files that have extensions of .com or .exe). Most such viruses simply try to replicate and spread by infecting other host programs, but some inadvertently destroy the program they infect by overwriting a portion of the original code. A minority of these viruses are very destructive and attempt to format the hard drive at a predetermined time or perform some other malicious action.

In many cases, a file-infecting virus can be successfully removed from the infected file. However, if the virus has overwritten part of the program's code, the original file will be unrecoverable

file name extension

The portion of a file name (such as .dll or .xml) which indicates the kind of data stored in the file. Apart from informing the user what type of content the file holds, file name extensions are typically used to decide which program to launch when a file is run.

file type

The kind of data stored in a file. Most operating systems use the file name extension to determine the file type. The file type is used to choose an appropriate icon to represent the file in a user interface, and the correct application with which to view, edit, run, or print the file.

File Transfer Protocol (FTP)

A client-server protocol which allows a user on one computer to transfer files to and from another computer over a TCP/IP network. Also refers to the client program the user executes to transfer files.

filtering, dynamic

IP service that can be used within VPN tunnels. Filters are one way GateLock controls traffic from one network to another. When TCP/IP sends data packets to the firewall, the filtering function in the firewall looks at the header information in the packets and directs them accordingly. The filters operate on criteria such as IP source or destination address range, TCP ports, UDP, Internet Control Message Protocol (ICMP), or TCP responses. Also see tunneling and Virtual Private Network (VPN).

firewall

A gateway machine with special security precautions on it, used to service outside network (especially Internet) connections and dial-in lines.

Frequently Asked Questions (FAQ)

A list of questions and answers about a specific topic.

gateway

An interface between an information source and a web server.

grayware

A category of software that may be legitimate, unwanted, or malicious. Unlike threats such as viruses, worms, and Trojans, grayware does not infect, replicate, or destroy data, but it may violate your privacy. Examples of grayware include spyware, adware, and remote access tools.

group file type

Types of files that have a common theme, for example:

Graphical User Interface (GUI)

The use of pictures rather than just words to represent the input and output of a program. This contrasts with a command line interface where communication is by exchange of strings of text.

hacking tool

Tools such as hardware and software that enables penetration testing of a computer system or network for the purpose of finding security vulnerabilities that can be exploited.

hard disk (or hard drive)

One or more rigid magnetic disks rotating about a central axle with associated read/write heads and electronics, used to read and write hard disks or floppy disks, and to store data. Most hard disks are permanently connected to the drive (fixed disks) though there are also removable disks.

header (networking definition)

Part of a data packet that contains transparent information about the file or the transmission.

heuristic rule-based scanning

Scanning network traffic, using a logical analysis of properties that reduces or limits the search for solutions.

host

A computer connected to a network.

hub

This hardware is used to network computers together (usually over an Ethernet connection). It serves as a common wiring point so that information can flow through one central location to any other computer on the network thus enabling centralized management. A hub is a hardware device that repeats signals at the physical Ethernet layer. A hub retains the behavior of a standard bus type network (such as Thinnet), but produces a star topology with the hub at the center of the star. This configuration enables centralized management.

Hypertext Transfer Protocol (HTTP)

The client-server TCP/IP protocol used on the World Wide Web for the exchange of HTML documents. It conventionally uses port 80.

Hypertext Transfer Protocol Secure (HTTPS)

A variant of HTTP used for handling secure transactions.

ICSA

ICSA Labs is an independent division of TruSecure Corporation. For over a decade, ICSA has been the security industry’s central authority for research, intelligence, and certification testing of products. ICSA Labs sets standards for information security products and certifies over 90% of the installed base of antivirus, firewall, IPSec, cryptography, and PC firewall products in the world today.

image file

A file containing data representing a two-dimensional scene, in other words, a picture. Images are taken from the real world, for example, via a digital camera, or they may be generated by computer using graphics software.

incoming

Email messages or other data routed into your network.

installation script

The installation screens used to install Unix versions of Trend Micro products.

IntelliScan

IntelliScan is a Trend Micro scanning technology that optimizes performance by examining file headers using true-file type recognition, and scanning only file types known to potentially harbor malicious code. True-file type recognition helps identify malicious code that can be disguised by a harmless extension name.

Internet

A client-server hypertext information retrieval system, based on a series of networks connected with routers. The Internet is a modern information system and a widely accepted medium for advertising, online sales, and services, as well as university and many other research networks. The World Wide Web is the most familiar aspect of the Internet.

Internet Protocol (IP)

An Internet standard protocol that defines a basic unit of data called a datagram. A datagram is used in a connectionless, best-effort, delivery system. The Internet protocol defines how information gets passed between systems across the Internet.

interrupt

An asynchronous event that suspends normal processing and temporarily diverts the flow of control through an interrupt handler routine.

Describes known viruses that are actively circulating.

Also see in the zoo.

Describes known viruses that are currently controlled by antivirus products.

Also see in the wild.

intranet

Any network which provides similar services within an organization to those provided by the Internet outside it, but which is not necessarily connected to the Internet.

IP

Internet Protocol—See IP address.

IP address

Internet address for a device on a network, typically expressed using dot notation such as 123.123.123.123.

IP gateway

Also called a router, a gateway is a program or a special-purpose device that transfers IP datagrams from one network to another until the final destination is reached.

IT

Information technology, to include hardware, software, networking, telecommunications, and user support.

Java applets

Java applets are small, portable Java programs embedded in HTML pages that can run automatically when the pages are viewed. Java applets allow web developers to create interactive, dynamic web pages with broader functionality.

Authors of malicious code have used Java applets as a vehicle for attack. Most web browsers, however, can be configured so that these applets do not execute; sometimes by simply changing browser security settings to high.

Java file

Java is a general-purpose programming language developed by Sun Microsystems. A Java file contains Java code. Java supports programming for the Internet in the form of platform-independent Java applets. (An applet is a program written in Java programming language that can be included in an HTML page. When you use a Java-technology enabled browser to view a page that contains an applet, the applet’s code is transferred to your system and is executed by the browser’s Java Virtual Machine.)

Java malicious code

Virus code written or embedded in Java.

Also see Java file.

JavaScript virus

JavaScript is a simple programming language developed by Netscape that allows web developers to add dynamic content to HTML pages displayed in a browser using scripts. Javascript shares some features of Sun Microsystems Java programming language, but was developed independently.

A JavaScript virus is a virus that is targeted at these scripts in the HTML code. This enables the virus to reside in web pages and download to a user’s desktop through the user’s browser.

Also see VBscript virus.

joke program

An executable program that is annoying or causes users undue alarm. Unlike viruses, joke programs do not self-propagate and should simply be removed from your system.

keylogger

Keyloggers are programs that catch and store all keyboard activity. There are legitimate keylogging programs that are used by corporations to monitor employees and by parents to monitor their children. However, criminals also use keystroke logs to sort for valuable information such as logon credentials and credit card numbers.

Kilobyte (KB)

1024 bytes of memory.

license

Authorization by law to use a Trend Micro product.

license certificate

A document that proves you are an authorized user of a Trend Micro product.

Lightweight Directory Access Protocol (LDAP)

An internet protocol that email programs use to locate contact information from a server. For example, suppose you want to locate all persons in Boston who have an email address containing the name Bob. An LDAP search would enable you to view the email addresses that meet this criteria.

link (also called hyperlink)

A reference from some point in one hypertext document to some point in another document or another place in the same document. Links are usually distinguished by a different color or style of text, such as underlined blue text. When you activate the link, for example, by clicking on it with a mouse, the browser displays the target of the link.

listening port

A port utilized for client connection requests for data exchange.

load balancing

Load balancing is the mapping (or re-mapping) of work to processors, with the intent of improving the efficiency of a concurrent computation.

Local Area Network (LAN)

Any network technology that interconnects resources within an office environment, usually at high speeds, such as Ethernet. A local area network is a short-distance network used to link a group of computers together within a building. 10BaseT Ethernet is the most commonly used form of LAN. A hardware device called a hub serves as the common wiring point, enabling data to be sent from one machine to another over the network. LANs are typically limited to distances of less than 500 meters and provide low-cost, high-bandwidth networking capabilities within a small geographical area.

log storage directory

Directory on your server that stores log files.

logic bomb

Code surreptitiously inserted into an application or operating system that causes it to perform some destructive or security-compromising activity whenever specified conditions are met.

macro

A command used to automate certain functions within an application.

MacroTrap

A Trend Micro utility that performs a rule-based examination of all macro code that is saved in association with a document. macro virus code is typically contained in part of the invisible template that travels with many documents (.dot, for example, in Microsoft Word documents). MacroTrap checks the template for signs of a macro virus by seeking out key instructions that perform virus-like activity—instructions such as copying parts of the template to other templates (replication), or instructions to execute potentially harmful commands (destruction).

macro virus

Macro viruses are often encoded as an application macro and included in a document. Unlike other virus types, macro viruses aren't specific to an operating system and can spread via email attachments, web downloads, file transfers, and cooperative applications.

Mail Transfer Agent (MTA)

The program responsible for delivering email messages.

Also see SMTP server.

malware (malicious software)

Programming or files that are developed for the purpose of doing harm, such as viruses, worms, and Trojans.

management console

The user interface for your Trend Micro product.

mass mailer (also known as a Worm)

A malicious program that has high damage potential, because it causes large amounts of network traffic.

Media Access Control (MAC) address

An address that uniquely identifies the network interface card, such as an Ethernet adapter. For Ethernet, the MAC address is a 6 octet address assigned by IEEE. On a LAN or other network, the MAC address is a computer's unique hardware number. (On an Ethernet LAN, it's the same as the Ethernet address.) When you're connected to the Internet from your computer (or host as the Internet protocol thinks of it), a correspondence table relates your IP address to your computer's physical (MAC) address on the LAN. The MAC address is used by the Media Access Control sublayer of the Data-Link Control (DLC) layer of telecommunication protocols. There is a different MAC sublayer for each physical device type.

Megabyte (MB)

1024 kilobytes of data.

Microsoft Office file

Files created with Microsoft Office tools such as Excel or Microsoft Word.

Millions of bits per second (Mbps)

A measure of bandwidth in data communications.

mixed threat attack

Complex attacks that take advantage of multiple entry points and vulnerabilities in enterprise networks, such as the Nimda or Code Red threats.

Network Address Translation (NAT)

A standard for translating secure IP addresses to temporary, external, registered IP address from the address pool. This allows Trusted networks with privately assigned IP addresses to have access to the Internet. This also means that you don’t have to get a registered IP address for every machine in your network.

network virus

A type of virus that uses network protocols, such as TCP, FTP, UDP, HTTP, and email protocols to replicate. Network viruses often do not alter system files or modify the boot sectors of hard disks. Instead, they infect the memory of client machines, forcing them to flood the network with traffic, which can cause slowdowns or even complete network failure.

notification

(Also see action and target)

A message that is forwarded to one or more of the following:

The purpose of the notification is to communicate that a prohibited action has taken place, or was attempted, such as a virus being detected in an attempted HTTP file download.

offensive content

Words or phrases in messages or attachments that are considered offensive to others, for example, profanity, sexual harassment, racial harassment, or hate mail.

online help

Documentation that is bundled with the GUI.

open source

Programming code that is available to the general public for use or modification free of charge and without license restrictions.

operating system

The software which handles tasks such as the interface to peripheral hardware, scheduling tasks, and allocating storage. In this documentation, the term also refers to the software that presents a window system and graphical user interface.

outgoing

Email messages or other data leaving your network, routed out to the Internet.

parameter

A variable, such as a range of values (a number from 1 to 10).

partition

A logical portion of a disk.

Also see sector, which is a physical portion of a disk.

passive FTP

Configuration of FTP protocol that allows clients within your local area network to initiate the file transfer, using random upper port numbers (1024 and above).

password cracker

An application program that is used to recover a lost or forgotten password. These applications can also be used by an intruder to gain unauthorized access to a computer or network resources.

pattern file (also known as Official Pattern Release)

The pattern file, as referred to as the Official Pattern Release (OPR), is the latest compilation of patterns for identified viruses. It is guaranteed to have passed a series of critical tests to ensure that you get optimum protection from the latest virus threats. This pattern file is most effective when used with the latest scan engine.

payload

Payload refers to an action that a virus performs on the infected computer. This can be something relatively harmless, such as displaying messages or ejecting the CD drive, or something destructive, such as deleting the entire hard drive.

policies

Policies provide the initial protection mechanism for the firewall, allowing you to determine what traffic passes across it based on IP session details. They protect the Trusted network from outsider attacks, such as the scanning of Trusted servers. Policies create an environment in which you set up security policies to monitor traffic attempting to cross your firewall.

port

A logical channel or channel endpoint in a communications system, used to distinguish between different logical channels on the same network interface on the same computer. Each application program has a unique port number associated with it.

protected network

A network protected by IWSA (InterScan web Security Appliance).

proxy

A process providing a cache of items available on other servers which are presumably slower or more expensive to access.

proxy server

A World Wide Web server which accepts URLs with a special prefix, used to fetch documents from either a local cache or a remote server, then returns the URL to the requester.

public-key encryption

An encryption scheme where each person gets a pair of keys, called the public key and the private key. Each person's public key is published while the private key is kept secret. Messages are encrypted using the intended recipient's public key and can only be decrypted using his or her private key.

Also see authentication and digital signature.

purge

To delete all, as in getting rid of old entries in the logs.

quarantine

To place infected data such as email messages, infected attachments, infected HTTP downloads, or infected FTP files in an isolated directory (the Quarantine Directory) on your server.

queue

A data structure used to sequence multiple demands for a resource when mail is being received faster than it can be processed. Messages are added at the end of the queue, and are taken from the beginning of the queue, using a FIFO (first-in, first-out) approach.

recipient

The person or entity to whom an email message is addressed.

registration

The process of identifying yourself as a Trend Micro customer, using a product Registration Key, on the Trend Micro Online Registration screen.

Registration Key

A 22-character code, including hyphens, that is used to register in the Trend Micro customer database. Here is an example of a Registration Key: SM-27RT-UY4Z-39HB-MNW8

Also see Activation Code

relay

To convey by means of passing through various other points.

remote access tool (RAT)

Hardware and software that allow a legitimate system administrator to manage a network remotely. However, these same tools can also be used by intruders to attempt a breach of your system security.

removable drive

A removable hardware component or peripheral device of a computer, such as a zip drive.

replicate

To self-reproduce. As used in this documentation, the term refers to viruses or worms that can self-reproduce.

router

This hardware device routes data from a local area network (LAN) to a phone line's long distance line. Routers also act as traffic cops, allowing only authorized machines to transmit data into the local network so that private information can remain secure. In addition to supporting these dial-in and leased connections, routers also handle errors, keep network usage statistics, and handle security issues.

scan

To examine items in a file in sequence to find those that meet a particular criteria.

scan engine

The module that performs antivirus scanning and detection in the host product to which it is integrated.

script

A set of programming commands that, once invoked, can be executed together. Other terms used synonymously with “script” are “macro” or “batch file.”

sector

A physical portion of a disk.

Also see partition, which is a logical portion of a disk.

seat

A license for one person to use a Trend Micro product.

Secure Socket Layer (SSL)

Secure Socket Layer (SSL), is a protocol designed by Netscape for providing data security layered between application protocols (such as HTTP, Telnet, or FTP) and TCP/IP. This security protocol provides data encryption, server authentication, message integrity, and optional client authentication for a TCP/IP connection.

server

A program which provides some service to other (client) programs. The connection between client and server is normally by means of message passing, often over a network, and uses some protocol to encode the client's requests and the server's responses. The server may run continuously (as a daemon), waiting for requests to arrive, or it may be invoked by some higher-level daemon which controls a number of specific servers.

server farm

A server farm is a network where clients install their own computers to run web servers, e-mail, or any other TCP/IP based services they require, making use of leased permanent Internet connections with 24-hour worldwide access. Instead of expensive dedicated-line connections to various offices, servers can be placed on server farm networks to have them connected to the Internet at high-speed for a fraction of the cost of a leased line.

shared drive

A computer peripheral device that is used by more than one person, thus increasing the risk of exposure to viruses.

signature

Also see virus signature.

signature-based spam detection

A method of determining whether an email message is spam by comparing the message contents to entries in a spam database. An exact match must be found for the message to be identified as spam. Signature-based spam detection has a nearly zero false positive rate, but does not detect “new” spam that isn’t an exact match for text in the spam signature file.

Also see rule-based spam detection.

Also see false positive.

Simple Mail Transfer Protocol (SMTP)

A protocol used to transfer electronic mail between computers, usually over Ethernet. It is a server-to-server protocol, so other protocols are used to access the messages.

Simple Mail Transfer Protocol (SMTP) server

A server that relays email messages to their destinations.

Simple Network Management Protocol (SNMP)

A protocol that supports monitoring of devices attached to a network for conditions that merit administrative attention.

Simple Network Management Protocol (SNMP) trap

A trap is a programming mechanism that handles errors or other problems in a computer program. An SNMP trap handles errors related to network device monitoring.

Also see SNMP.

spam

Unsolicited email messages meant to promote a product or service.

spyware

Advertising-supported software that typically installs tracking software on your system, capable of sending information about you to another party. The danger is that users cannot control what data is being collected, or how it is used.

subnet mask

In larger networks, the subnet mask lets you define subnetworks. For example, if you have a class B network, a subnet mask of 255.255.255.0 specifies that the first two portions of the decimal dot format are the network number, while the third portion is a subnet number. The fourth portion is the host number. If you do not want to have a subnet on a class B network, you would use a subnet mask of 255.255.0.0.

A network can be subnetted into one or more physical networks which form a subset of the main network. The subnet mask is the part of the IP address which is used to represent a subnetwork within a network. Using subnet masks allows you to use network address space which is normally unavailable and ensures that network traffic does not get sent to the whole network unless intended. Subnet masks are a complex feature, so great care should be taken when using them.

Also see IP address.

target

The scope of activity to be monitored for a violating event, such as a virus being detected in an email message. For example, you could target virus scanning of all files passing into and out of your network, or just files with a certain file name extension.

(Also see action and notification)

Telnet

The Internet standard protocol for remote login that runs on top of TCP/IP (Transmission Control Protocol/Internet Protocol). This term can also refer to networking software that acts as a terminal emulator for a remote login session.

top-level domain

The last and most significant component of an Internet fully qualified domain name, the part after the last .. For example, host wombat.doc.ic.ac.uk is in top-level domain uk (for United Kingdom).

Total Solution CD

A CD containing the latest product versions and all the patches that have been applied during the previous quarter. The Total Solution CD is available to all Trend Micro Premium Support customers.

traffic

Data flowing between the Internet and your network, both incoming and outgoing.

Transmission Control Protocol (TCP)

A communications protocol which allows computers with different operating systems to communicate with each other. Controls how data is transferred between computers on the Internet.

trigger

An event that causes an action to take place. For example, your Trend Micro product detects a virus in an email message. This may trigger the message to be placed in quarantine, and a notification to be sent to the system administrator, message sender, and message recipient.

Trojan Horse

A malicious program that is disguised as something benign. A Trojan is an executable program that does not replicate, but instead, resides on a system to perform malicious acts, such as opening a port for an intruder.

true-file type

Used by IntelliScan, a virus scanning technology, to identify the type of information in a file by examining the file headers, regardless of the file name extension (which could be misleading).

trusted domain

A domain from which your Trend Micro product will always accept messages, without considering whether the message is spam. For example, a company called Dominion, Inc. has a subsidiary called Dominion-Japan, Inc. Messages from dominion-japan.com are always accepted into the dominion.com network, without checking for spam, since the messages are from a known and trusted source.

trusted host

A server that is allowed to relay mail through your network because they are trusted to act appropriately and not, for example, relay spam through your network.

tunneling

A method of sending data that enables one network to send data via another network’s connections. Tunneling is used to get data between administrative domains which use a protocol that is not supported by the internet connecting those domains.

With VPN tunneling, a mobile professional dials into a local Internet Service Provider's Point of Presence (POP) instead of dialing directly into their corporate network. This means that no matter where mobile professionals are located, they can dial a local Internet Service Provider that supports VPN tunneling technology and gain access to their corporate network, incurring only the cost of a local telephone call.

When remote users dial into their corporate network using an Internet Service Provider that supports VPN tunneling, the remote user as well as the organization knows that it is a secure connection. All remote dial-in users are authenticated by an authenticating server at the Internet Service Provider's site and then again by another authenticating server on the corporate network. This means that only authorized remote users can access their corporate network, and can access only the hosts that they are authorized to use.

tunnel interface

A tunnel interface is the opening, or doorway, through which traffic to or from a VPN tunnel passes. A tunnel interface can be numbered (that is, assigned an IP address) or unnumbered. A numbered tunnel interface can be in either a tunnel zone or security zone. An unnumbered tunnel interface can only be in a security zone that contains at least one security zone interface. The unnumbered tunnel interface borrows the IP address from the security zone interface.

Also see Virtual Private Network (VPN).

tunnel zone

A tunnel zone is a logical segment that hosts one or more tunnel interfaces. A tunnel zone is associated with a security zone that acts as its carrier.

Universal Resource Locator (URL)

A standard way of specifying the location of an object, typically a web page, on the Internet, for example, www.trendmicro.com. The URL maps to an IP address using DNS.

VBscript virus

VBscript (Microsoft Visual Basic scripting language) is a simple programming language that allows web developers to add interactive functionality to HTML pages displayed in a browser. For example, developers might use VBscript to add a Click Here for More Information button on a web page.

A VBscript virus is a virus that is targeted at these scripts in the HTML code. This enables the virus to reside in web pages and download to a user’s desktop through the user’s browser.

Also see JavaScript virus.

virtual IP address (VIP address)

A VIP address maps traffic received at one IP address to another address based on the destination port number in the packet header.

Virtual Local Area Network (VLAN)

A logical (rather than physical) grouping of devices that constitute a single broadcast domain. VLAN members are not identified by their location on a physical subnetwork but through the use of tags in the frame headers of their transmitted data. VLANs are described in the IEEE 802.1Q standard.

Virtual Private Network (VPN)

A VPN is an easy, cost-effective and secure way for corporations to provide telecommuters and mobile professionals local dial-up access to their corporate network or to another Internet Service Provider (ISP). Secure private connections over the Internet are more cost-effective than dedicated private lines. VPNs are possible because of technologies and standards such as tunneling and encryption.

virtual router

A virtual router is the component of Screen OS that performs routing functions. By default, Trend Micro GateLock supports two virtual routers: Untrust-VR and Trust-VR.

virtual system

A virtual system is a subdivision of the main system that appears to the user to be a stand-alone entity. Virtual systems reside separately from each other in the same Trend Micro GateLock remote appliance; each one can be managed by its own virtual system administrator.

virus

A computer virus is a program – a piece of executable code – that has the unique ability to infect. Like biological viruses, computer viruses can spread quickly and are often difficult to eradicate.

In addition to replication, some computer viruses share another commonality: a damage routine that delivers the virus payload. While payloads may only display messages or images, they can also destroy files, reformat your hard drive, or cause other damage. Even if the virus does not contain a damage routine, it can cause trouble by consuming storage space and memory, and degrading the overall performance of your computer.

virus kit

A template of source code for building and executing a virus, available from the Internet.

virus signature

A virus signature is a unique string of bits that identifies a specific virus. Virus signatures are stored in the Trend Micro virus pattern file. The Trend Micro scan engine compares code in files, such as the body of an email message, or the content of an HTTP download, to the signatures in the pattern file. If a match is found, the virus is detected, and is acted upon (for example, cleaned, deleted, or quarantined) according to your security policy.

virus trap

Software that helps you capture a sample of virus code for analysis.

virus writer

Another name for a computer hacker, someone who writes virus code.

web

The World Wide Web, also called the web or the Internet.

web server

A server process running at a website which sends out web pages in response to HTTP requests from remote browsers.

wildcard

A term used in reference to content filtering, where an asterisk (*) represents any characters. For example, in the expression *ber, this expression can represent barber, number, plumber, timber, and so on. The term originates from card games, in which a specific card, identified as a wildcard, can be used for any number or suit in the card deck.

working directory

The destination directory in which the main application files are stored, such as /etc/iscan/iwss.

workstation (also known as client)

A general-purpose computer designed to be used by one person at a time and which offers higher performance than normally found in a personal computer, especially with respect to graphics, processing power and the ability to carry out several tasks at the same time.

worm

A self-contained program (or set of programs) that is able to spread functional copies of itself or its segments to other computer systems.

zip file

A compressed archive (in other words, “zip file) from one or more files using an archiving program such as WinZip.

Zip of Death

A zip (or archive) file of a type that when decompressed, expands enormously (for example 1000%) or a zip file with thousands of attachments. Compressed files must be decompressed during scanning. Huge files can slow or stop your network.

zone

A zone can be a segment of network space to which security measures are applied (a security zone), a logical segment to which a VPN tunnel interface is bound (a tunnel zone), or a physical or logical entity that performs a specific function (a function zone).