text:
Manchester United shrugged off the loss of star man Nani to claim a very impressive UEFA Champions League win over Bursaspor.
Second-half goals from
United manager Sir Alex Ferguson said Fletcher's goal early in the second half had proved decisive. "From that point on we were basically in control of the match," Ferguson said. "They had a couple of half chances and you can never be sure. But the second goal killed the match."
And, as Nani is already rated doubtful to face Wolves on Saturday after limping off with a groin injury midway through the opening period, Ferguson must have been delighted that two of his back-up wide-men followed up Fletcher's opener - only his second Champions League goal in his 50th appearance in the competition - to seal a comfortable win.
Already without 10 players on this trip, including the rested
As the
Not that Nani had actually been too threatening on this occasion. It was Obertan, making only his second start of the season, who took that role, providing the well executed pass which gave lone frontman Dimitar Berbatov his clearest sight of goal. Unfortunately for United, the Bulgarian's well-struck effort flew straight at his fellow countryman
Bursaspor were marginally more dangerous, with
Rather than feel sorry for themselves, United used the interval to refocus. Within two minutes it had paid dividends. A concerted period of pressure around the Bursaspor box resulted in
Given his mounting injury problems, it was perhaps no surprise Ferguson opted to replace Fletcher not long afterwards after his fellow Scot had taken an awkward-looking tumble by the touchline. Bebe was introduced to provide more width, although containing Sen appeared to be the key to a United victory and
But any doubt over the outcome was ended 17 minutes from time when Park released Obertan, who intelligently stepped inside Ali Tandogan before crashing a shot into the roof of the Bursaspor net. It was a neat way to claim his first United goal and on their next attack, the visitors had another with Bebe running on to Scholes' brilliantly disguised pass before calmly finishing from 10 yards.
Ferguson must have been as delighted with the scorers as the score. Given the state of his medical room, two of his unsung heroes may have a big part to play in the coming weeks.


text:
Thanks for redeeming.{{else}}
Success! Thanks for repurchasing.{{/if}} {{else}} {{#if Expired}}
Increase my visibility!{{else}} {{#if IsMultiPack}}
{{#if HasMultiPack}} You have {{MultiPackCount}} top spot(s) left. Now loading you into the search listings... {{else}} You have used all top spots. Now loading you into the search listings... {{/if}}{{else}}
We are loading you into the search listing pages...{{/if}} {{/if}} {{/if}} {{/if}}
{{Current}} just saw you!{{/if}} {{#if LastTopSpotPurchaseIsMulti }} {{#if HasAnyTopSpot}}
{{#if HasFreeTopSpot }} {{ UnclaimedTopSpotFree }} Free {{/if}} {{#if HasPaidTopSpot }} {{#if HasFreeTopSpot }} & {{/if}} {{ MultiPackCount }} {{/if}} Top Spot{{#if Plural}}s{{/if}} Left{{else}}
0 Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{else}} {{#if HasFreeTopSpot }}
{{ UnclaimedTopSpotFree }} Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{/if}} {{else}} {{#if HasResults}}
{{Current}} see you now!{{else}} {{/if}} {{/if}}
You can now invite anyone to meet at your favorite Starbucks.
Limited-time feature
29 year old woman | Houston, TX, USA | Seeking men 25-35 within 50 miles
I believe that happy girls are the prettiest girls." -Audrey Hepburn
I'm an outgoing, sometimes quirky, girl who loves my family and friends more than most anything. I was born and raised in Houston and I love exploring the city- there's so many places to discover no matter how long you've lived here. I love it! I have a bit of a time consuming job which can make it difficult to meet new people so I thought this might be a fun (and interesting, haha) way to meet new people. I'm a pretty motivated/ambitious girl and that's something that I look for in someone I'm with. My faith and relationship with God is also very important to me.
Coffee and conversation , Dining out , Fishing/Hunting , Movies/Videos , Music and concerts , Exploring new areas , Nightclubs/Dancing , Religion/Spiritual , Travel/Sightseeing , Watching sports
Dancing, Skiing, Yoga
I like Dogs
I currently spend WAY too much time on petfinder.com...can I just adopt them all??
Middle of the Road
Seattle, Colorado, the hill country...also love the Greek Islands, Germany Around town? El Tiempo, Red Mango (I do get smoothie cravings), Memorial Park on occasion, Torchy's, the Heights, browsing in the vintage stores on Westheimer
Texas A&M University, College Station, TX
Tex Mex and margaritas, road trips (I have so many good stories from these), midnight movie showings, Colorado, the water-spending time on the coast, snow skiing...I also miss hunting and having a deer lease to go to.
Mmmm let's see...happy hour with friends, spending time with my family down on the water, reading a new book, watching dumb reality tv (yeah, yeah...I know!), being sarcastic :), traveling!
Safe Haven....I also just realized that every movie based on a Nicholas Sparks book has the same cover photo. Google it. It's kind of strange.
Z{{Cta}} {{#if HasMoreInfo}} ?{{CtaSecondary}} {{/if}}
|What she is looking for
|5'4" (162cms)
|5'8" (172cms) to 8'11" (271cms)
|Body type:
|About average
|No preference
|No preference
|Dark brown
|No preference
|No Way
|No Way
|Social Drinker
|No preference
|Medical / Dental / Veterinary / Fitness
|No preference
I'm a doctor (currently in my residency) and I love it!
|I'll tell you later
|No preference
|Never Married
|No preference
|Have kids:
|Wants kids:
|No preference
|White / Caucasian
|Latino / Hispanic, White / Caucasian
I'm mostly a mix of Native American, German, French....I'm told my skin tone is mostly from my French roots? My Grandpa just told us we were all Heinz 57 :)
|Christian / Protestant
|No preference
|PhD / Post Doctoral
|No preference

subset: commoncrawl


text:
I have gotten them since I was a teenager and they were not much of a concern for me until 12 years ago when I was diagnosed with OCD. My OCD focused mostly on a fear of spreading the virus to my eyes or genitals, I also just worried that I was somehow contacting herpes out on the world on surfaces. I worked really hard on this with a cognitive behavioral therapist and got a lot better when it came to worrying about spreading the virus on me. However I knew I might have anxiety about giving it to my baby when I had a baby, and now it's happening! My son is four weeks old and I have asked the pediatrician about this three times now. I was told that as long as I didn't have an open sore it was safe to kiss him (even though I just don't kiss him at all because I am just too scared to - I am aware there is something called asymtomatic shedding, though I've been told shedding happens less and less frequently the longer you've had the virus in your system. Daddy kisses him though - but I even worry about Daddy kissing him right after Daddy's kissed me). But then today my lip started to feel a little weird (I think they are just dry) and I realized I wished I had asked more questions, like what should I do if he touches a sore on my face if I have one (since babies flail their arms around and touch their faces a lot - and the concern is mostly that he would put it in his eyes). The nurse I spoke to said to just wash his hands with soap and water.
Anyway, I take Lexapro to help me, and I have a psychiatrist and a therapist but I was just wodnering if anyone on the board gets cold sores and can perhaps share that they have not given the virus to their kids or that they don't worry about it as much as me - anything reassuring.
I hope I didn't frighten anyone else by posting this. I should really be accepting the words of the doctor and the nurse but am just taking the worries too far because cold sores are a trigger for me. When I was diagnosed with OCD I was doing excessive handwashing (and always do to some extent when I get a cold sore even now, even though I am a lot better about it) and I obviously cannot start excessively washing my baby or avoiding holding him for fear of contaminating him. I want to get a handle on this so I can enjoy my baby and not be constantly worrying.


text:
Winston Yellen indulges his synthpop impulses on this standalone track.
Released Albums
Unreleased Albums
Night Beds premiere new song "Me, Liquor & God" — listen
by Josh Terry
on December 09, 2014, 3:20pm
Listen: Night Beds' alluring new song, "Head For The Hills"
Plus, new tour dates with Lord Huron.
by Josh Terry
on January 14, 2014, 1:17pm
See unused album artwork for Bon Iver, Phosphorescent, Foxygen, and others
Artist Daniel Murphy shares alternative artwork from his collection.
by Ben Kaye
on December 23, 2013, 6:15pm
The Top 10 Moments of Forecastle 2013
A Cyborg Hunter S. Thompson, two sets by the Lips, Big Boi's golden throne…
by Zach Hart and Kenny Bloggins
on July 18, 2013, 11:15am
Album Review: Night Beds – Country Sleep
A cathartic listening experience for some, and a collegiate romp for others.
by Erin Manning
on February 14, 2013, 12:00am
Le Guess Who? Festival expands 2012 lineup
One of the leading Dutch festivals piles on the talent.
on October 09, 2012, 6:18pm


text:
Within the University structure, the Rod Library is part of the Academic Affairs division, under the direction of the Provost and Vice President of Academic Affairs. The Library is organized into five departments that report to the Dean of Library Services. Some departments consist of multiple service units. The Library's administrative organization is presented visually in the Organization Chart (pdf).
Access Services
The Access Services Department is responsible for circulation and shelving of library materials, interlibrary loan services, course reserves, and photocopying services.
Collection Management and Special Services
The Collection Management & Special Services Department is responsible for selection of all materials added to the library's collections, management and evaluation of the encumbrance and expenditure of the library materials budget, liaison with teaching faculty to monitor campus needs, preparation of reports on library resources and services, and pursuit of cooperative collection development projects with other state institutions of higher education.
Dean's Office
The Dean's Office provides administrative, fiscal, and cross-departmental support to the various library departments, under the direction of the Dean of Library Services.
Library Information Technologies
Library Information Technologies is responsible for maintaining and enhancing library technology infrastructure, supporting public access to library electronic resources, providing direct technical assistance to library personnel, communicating with library personnel and patrons about technology changes, and planning for and evaluating emerging technologies.
Reference and Instructional Services
The Reference and Instructional Services Department is responsible for assisting library users with research and information needs, assisting users with electronic resources, providing instruction in the use of library resources, developing reference and other collections, and helping develop and maintain electronic and other information needs.
Technical Services
The Technical Services Department is divided into three main sections; Acquisitions, Financial/Supplies, and Ordering/Cataloging. The Acquisitions Section acquires material in all formats and languages for locations throughout the Rod Library; processes all incoming and outgoing mail for the Library; maintains accurate records for the check-in and withdrawal of periodicals, newspapers and serials; claims titles not received; and prepares material for binding, including theses and dissertations.


text: The wiki last edited by Merovin on 12/07/13 03:40PM View full history The one friend Spike has made at the Mosaic Asylum has been staked. Bad for her- but even worse for the guy who staked her. It's an all-out prison-style battle royale as Spike gets revenge the only way he knows how- with insults, fists and sharp objects. But when Mosaic's dirty little secret comes to light, it looks like Spike is going to have to call in some outside help to save the day.


text:
In the prior art of computer security by default programs are allowed to do whatever they like to other programs or to their data files or to critical files of the operating system, which is as absurd as letting a guest in a hotel bother other guests as he pleases, steal their property or copy it or destroy it, or have free access to the hotel's management resources. The present concept is based on automatic segregation between programs. This is preferably done by creating automatically an unlimited number of Virtual Environments (VEs) with virtual sharing of resources, so that the programs in each VE think that they are alone on the computer, and (unless explicitly allowed by the user) any changes that they think they made in virtually shared resources are in reality only made in their own VE, while the user preferably has an integrated view of the computer.
1. A security system for computers that does not depend on information about the specific identities of malicious programs, wherein said computers are at least one of a personal computer, a network server, a cellular phone, a palm pilot, a car computer, and/or other computerized gadget, comprising at least one of:
a. A system for automatic segregation between programs that is applied to at least one of the hard disks and other non-volatile storage devices;
b. An independent device that is adapted to notice and intercept whenever the amount of data actually sent out from a computer does not fit the amount reported by at last one of: the Security System installed on the computer, and the communications software of the computer;
c. A system for preventing malicious software from falsifying the user's input;
d. A security system wherein in an organization the Security System of the central authority and/or of the system administrator and/or a gateway computer through which the other computers access the web—automatically checks at least once in a while if the Security System is functioning properly on the other computers;
e. A security system and/or firewall that prevents applications and/or drivers from accessing directly at all or at least without user permission the hardware ports of and/or the actual device drivers that physically access at least one of the communication channels and the storage devices;
f. A security system and/or fireball that prevents applications and/or drivers from accessing without user permission also USB devices;
g. A security system and/or firewall that prevents applications and/or drivers from accessing without user permission also at least one of Bluetooth communication devices, infra-red, and other wireless communication channels;
h. A security system and/or firewall that prevents applications and/or drivers from accessing without user permission at least one of Fax sending functions and other TAPI functions;
i. A security system wherein at least one general trusted area and at least one non-trusted area are enforced by creating at least two Virtual Environments (VEs), one for the trusted area and one for the non-trusted area, and enforcing the virtual sharing of resources between them, so that each VE sees only itself and the OS;
i. A security system wherein separate VEs with virtual sharing are used to enforce better segregation between users, so that each user has at least one VE of his/her own, and/or to enforce different profiles or configurations for the same users.
2-18. (canceled)
19. The system of
20-66. (canceled)
67. A security system and/or firewall that asks the user for confirmation when at least one of the following activities occur:
a. Multiple E-mails are being sent out consecutively;
b. The e-mail message or messages include an attachment or attachments which are executable files.
68. (canceled)
69. The system of
a. The user sees also the merged view of the list of installed programs in the Windows start menu and/or of any other resources;
b. When viewing the directory structure itself the user sees only the merged view of normal directories and/or files and/or other resources, as they would be if there was no actual segregation to virtual environments;
c. At least in one mode the user and/or the administrator can see, in addition or instead of the merged view of the file system, the additional directories or subdirectories and/or files that are needed for the actual implementation and/or enforcing of the virtual environments, and/or the user and/or the administrator can switch back and forth between a mode where they are hidden and a mode where they are revealed;
d. In the variations and/or in the modes where the user and/or the administrator is shown virtual files as if they really exist in the OS scope there is at least an indication near each such file and/or directory if it is a real file or a virtual file, and/or the user can see by clicking on the file and/or by the color of the file name or icon or other indication to which VE it really belongs;
e. The Security system includes also its special disk repair and/or rescuer and/or maintenance utilities and/or can interfere in the operation of other such utilities so that questions can be displayed to the user through the merged view;
f. If a process in memory or a program on the disk or other non-volatile storage changes, it is automatically transferred to another Virtual Environment;
g. If a program lets the user choose from a menu to reopen a recent file or a program needs to re-access recently accessed files, the Security System automatically allows the program to reopen a limited number of the last files that it was allowed to open, for a limited time.
70. The system of claim 6919 wherein when running virus-scan programs, at least one of the following features exists:
a. The virus-scan program can access freely all the real files and directories, including files and/or directories created for the implementation of Copy-On-Write or of sub-VEs;
b. When the anti-virus program reports a virus or asks the user for a confirmation for deleting a virus, the user can be exposed also to the special files and/or directories;
c. The Security System comes with its own special anti-virus program or programs, or it interferes whenever the anti-virus program wants to show the user any of these special files or directories, and then the security system can answer automatically instead of the user and/or questions can be displayed to the user through the merged view;
d. The Security System lets the antivirus run automatically each time on the next VE, seeing each time only the scope of that VE;
e. The Security System ruins either a special antivirus or interferes when the antivirus shows results and then reports the results to the users in terms of VE's, and/or can ask the user if he want to remove the virus or remove the entire VE.
71. The system of
a. The Security System is able to cause installed programs to automatically uninstall themselves virtually, so that the uninstalling program doesn't really uninstall, but the security system tracks the steps of the attempted uninstall and thus can learn about the associated files and directories and/or other resources;
b. The Security system can use various heuristics in order to define the boundaries of VE's of programs that were already installed before the Security System, and these heuristics include automatically limiting them by default to their default directories and subdirectories;
c. In an organization one computer can be used for learning all of the segregation rules and virtual environment parameters for each program, and this knowledge can be transferred to all the other computers in the organization, without the need to install the Security System before the other applications in the other computers.
72. (canceled)
73. The system
a. There is no real connection between the two objects other than their internal communication stream;
b. The security system filters or controls the communication between the two objects;
c. The visual integration is implemented with the aid of a graphical proxy, which makes a combination of programs look as if they are integrated, while in reality they run in different VEs;
d. Each COM (Component Object Module) server is allowed to run only in one VE, thus avoiding the situation where the same COM server could be giving services at the same time to programs that are on separate VEs.
74. (canceled)
75. The security system of
76. The system of
a. Hooking also the lower-level functions and preventing applications from calling them not through the normal kernel interfaces;
b. Hooking also the lower-level functions and preventing applications from calling them without user permission, at least the first time they do it;
c. Limiting the types of hardware that installed drivers can access.
77. A security system wherein in an organization the Security System of the central authority and/or of the system administrator and/or a gateway computer through which the other computers access the web—automatically checks at least once in a while if the Security System is functioning properly on the other computers.
78. The system of
79. (canceled)
80. (canceled)
81. The system of
82. The system of
83. (canceled)
84. The system of claims 19 wherein OS services are handled by at least one of the following ways:
a. At least some of the services are duplicated so that each VE has a different copy of the thread or process of the service that is running for that VE;
b. At least some of the services are initially duplicated only into stubs or empty shells for each VE in order not to use up resources before they are needed, and the stub or shell is loaded with actual resources only when it becomes needed;
c. At least some of the services, instead of being duplicated, are regarded as an extension of the OS and thus treated like other shared resources.
85. The system
a. Only one or a few special applications which are part of the OS or of the Security system are allowed to run such indexing on the entire computer, and normal applications which are limited to their own VE can only create and/or use such index in their own VE;
b. There is only one or more global indexes that are conducted by the appropriate OS or security application, and in this index or indexes each file or resource has a code or mark that indicates the VE to which it belongs, and when accessing this index only the files or other elements that belong to the appropriate VE or VEs are made visible.
86. The system of
87. (canceled)
88. The system of
a. In addition to the normal division into users, so that once the user enters the computer in the Special VE that he/she desires, he/she can still use within it a system of normally defined users and administrator;
b. Integrated with the OS, so that the experience of division into users and administrator is the same, but the higher separation is enforced by the use of VEs with virtual sharing.
89. The security system of
90. The security system of
91. The security system of
92. (canceled)
93. The security system of
a. Which programs have been given temporary access rights to the communication channels;
b. How long ago the temporary or non-temporary permission was given;
c. How much data that program has already sent out and/or received during the current Internet session and/or for a certain time period.
1. Field of the invention
The present invention relates to security in computers (including personal computers, servers, or other computerized gadgets, as explained in the definitions) and more specifically to a powerful comprehensive generic Security System and method for computers, based on automatic segregation between programs.
2. Background
Malicious software attacks on personal computers and/or servers (especially through the Internet) are becoming more and more common and more and more dangerous. According to recent study by the American CSI research institute (The Computer Security Institute), during the last year alone approximately 50 percent of the largest American companies were attacked by at least one malicious Internet software, with an average damage of about 500,000 USD per attack.
For example, according to various estimates, the total damage accrued in 2002 as a result of computer attacks is said to be approximately $47 billion. This high figure confirms that despite the market being inundated with protection techniques, there is still a very real threat with no concrete and lasting solution. In addition, for example a new report by Symantec released on Oct. 2, 2003 found that the number of computers inflicted by malicious software with backdoors that allow remote control or stealing of information has increased by 50% during the first half of 2003.
As the attacks for example by the "I LOVE YOU" virus and its derivatives demonstrate, which affected almost instantly tens of millions of computers and caused estimated damages of more than 10 billion dollars—the conventional anti-virus programs and their methods are inadequate to handle such threats because they are dependent on past familiar code patterns of known malicious software instead of trying to prevent in advance all kinds of attacks in principle. Such attacks are enabled because of an almost infinite number of loopholes and vulnerabilities in operating systems, by the fact that far too many processes occur under the surface without the user's knowledge, and by badly-engineered applications. These loopholes and vulnerabilities include for example:
2. The readiness of certain applications to execute Macro commands or scripts or applets or other executable attachments from incoming e-mail messages or web pages without any warning and without asking for the user's authorization, and without checking what these executables or scripts try to do (if allowed to run).
Unless these vulnerabilities and loopholes are treated on the most thorough and basic level, and since the Internet keeps growing at an exponential rate and more and more businesses are becoming dependent on it—such attacks may increase in the near future to the point of almost unlimited damages to a very large percent of the computers that are connected to the Internet.
Other methods such as for example packet filtering are also limited in principle, since the rules of which packets to accept or not may contain for example subjective decisions based on trusting certain sites or certain applications. However, once security is breached for any reason, for example due to an error or intended deception, a hostile application may take over the computer or server or the entire network and create unlimited damages (directly or by opening the door to additional malicious applications), which until detected might be already too late to repair. For example, a self-resendable via e-mail macro-virus (such as for example "I LOVE YOU" and its derivatives and similar viruses) can arrive from your best and most trusted friends after their own computer has been compromised. Also, filtering for allowed types of protocols such as for example FTP versus SMTP and so on can be rendered useless by programs that encrypt or disguise a given protocol type to appear as another. Another major limitation of packet filtering is that it can't be relied upon to scan for stolen data in packets, since malicious applications can encrypt the data and/or disguise it to look like something else, so as to appear for example as a gif image.
Antiviruses and firewalls are also not effective against security holes for example in browsers or e-mail programs or in the operating system itself. According to an article in ZDnet from Jan. 24, 2001, security holes in critical applications are discovered so often that just keeping up with all the patches is impractical. Also, without proper generic protection for example against Trojan horses, which can identify any malicious program without prior knowledge about it, even VPNs (Virtual Private Networks) and other forms of data encryption, including digital signatures, are not really safe because the info can be stolen before or below the encryption.
Even attempts to monitor in some ways a certain group of specifically marked executables or applications are limited by nature, because the security breaches can come from many other directions. For example, A Trojan horse may already be lurking in the system for a long time and then suddenly create tremendous damage before being detected, or enter the system any time new applications are installed from any source.
On the other hand, attempts for example to disallow completely any script within e-mail attachments to execute creates too many restrictions and doesn't separate between safe scripts that the user may want to run and scripts that actually try to perform malicious acts.
The present invention is a novel concept which tries to go deeply into the roots of the causes of above described problems and thus to eliminate completely the above-described problems by creating what is to the best of our knowledge a very powerful, comprehensive, general and generic Security System for computers. This System and method is adapted to protect computers (which may include for example personal computers, servers, and other devices or gadgets with one or more processor that can run programs, as explained below in the definitions) against all kinds of malicious programs that may steal information and/or cause damages including for example changes of data, deletion of data, interfering with function, and so on (such as for example Viruses, Vandals, Trojan horses, Worms, Macro viruses and Malicious e-mails). The system and method can be used in many operating systems, such as for example various platforms of Microsoft Windows, Linux, Macintosh, or other operating systems, eventhough the preferred embodiments use mainly the terminology of Windows, which is the most common and familiar operating system.
The most important principles and objects of this protection system preferably include:
The above protection system is preferably comprised of the following main elements:
The main functions performed by Security System:
The main logic behind the rules that define appropriate versus suspect behavior is preventing as much as possible all the elements and activities that are required by malicious programs in order to be able steal any data or do any damage or propagate themselves. The Security System preferably uses a set of heuristics and basic rules for defining suspicious or potentially dangerous activities that are automatically suitable for most users. By using the general default rules and adding to them for example statistical analysis of normal system and applications behavior and what is learned from the user's responses to authorization requests, the Security System quickly learns what is considered reasonable or well-behaved behavior of programs on the user's personal computer or server. Preferably, some of the learning is performed in advance for each operating system and is included in the distribution database, so that the system that is installed by the user has already learned various rules that are relevant by default to most users of that operating system. The security rules and functions performed by the Security System preferably include at least some of the following:
Therefore, the present invention offers the following main advantages over the prior art:
As explained below, the automatic segregation is preferably done by creating automatically an unlimited number of Virtual Environments (VEs) with virtual sharing of resources, so that preferably the programs in each VE think that they are alone on the computer, and preferably (unless explicitly allowed by the user) any changes that they think they made in virtually shared resources are in reality only made in their own VE (preferably through Copy-On-Write), while the user preferably has an integrated view of the computer with all the programs installed on it.
Clarification and Definitions
Throughout the patent when variations or various solutions are mentioned, it is also possible to use various combinations of these variations or of elements in them, and when combinations are used, it is also possible to use at least some elements in them separately or in other combinations. These variations are preferably in different embodiments. In other words: certain features of the invention, which are described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention, which are described in the context of a single embodiment, may also be provided separately or in any suitable sub-combination.
Many times for simplicity of understanding we use terms that are most commonly used within Microsoft Windows environment (which is the most common operating system for personal computers), so it should be kept in mind that in other operating systems such as for example Linux or Macintosh some of these might have different names, somewhat different implementations, etc., although the principles are similar.
As used throughout the present specifications and claims, the following words have the indicated meanings:
"Program", "executable" or "application" is any file or area in memory that contains executable commands, such as for example .exe or .com files, batch files, various Macro files, etc.
"Macro" is an executable written usually in a scripting language and executed by a complex application, such as for example Microsoft's Outlook or Word.
"DLL" is a dynamic link library. This term is common for example in all versions of the Windows operating system. In other operating systems it might have different names but the principle is similar. In general it is a term for a set of routines that can be called from executables, loaded and linked into them during run time.
"Device driver" or "Driver" is a software component that allows an operating system to communicate with one or more specific hardware devices attached to a computer, such as for example a hard disk controller, network card or display card. However, this can include also any software component running in the privileged mode—in the Kernel.
"OS" or "operating system" is software responsible for controlling the allocation and usage of computer hardware resources such as for example memory, CPU time, disk space, and peripheral hardware devices.
"IRQ" or "Interrupt request line" is a hardware line over which a hardware device, such as for example an input/output port, keyboard, or disk drive, can send interrupt requests to the central processing unit (CPU). Interrupt request lines are built into the computer's internal hardware and are assigned different levels of priority so that the CPU can determine the sources and relative importance of incoming service requests. IRQ is an Intel concept to rank Hardware and Software requests according to their importance.
"User" or "users" as used throughout the text are always meant interchangeably to be either user or users. The user or users can be for example the individual user of a computer or computers or a corporation or organization that uses the computers. Therefore, preferably various types of authorizations for example can be given either by the individual user of the computer or for example by the security administrator of the company, or any combination of these. For example some companies might want to give full authority on critical issues only to the system administrator, while others might want to let the employees or certain employees have much more direct control.
"User authorization" as used throughout the text can include also of course additional guidance and options.
"Database" or "Databases" as used throughout the text are always meant interchangeably to be either database or databases.
"Network" as used throughout the text is always interchangeable as either network or networks and represents a connection from a computer (as defined below) by any way to one or more computers or any other compatible communication device.
"File" is one or more areas on one or more disks and may have a definition in the FAT that may be represented as a name, directory, etc. and may have other parameters.
"Registry" is one or more files that may contain operating system and other program settings and mainly managed by the operating system.
"Computer" can refer to a personal computer or workstation or server, or any automated device or gadget with one or more processor or CPU, capable of more than simple arithmetic functions. This can include for example also cellular phones and portable computing devices such as for example a palm pilot. This can include also, for example, computers in cars, which may for example become very important as cars become more automated or even capable of automatic driving, since if hackers are able to damage them for example by Internet or satellite connection, it might even cause life-threatening malfunctions. Other examples can be computers in satellites (In which case, user authorization, when needed, preferably should be requested remotely by encrypted communication with user remote verification), sensitive computer systems in airplanes, etc. So, eventhough we give the examples usually from a PC and Windows perspective, similar principles can be applied also to palm devices, cellular phones, and other types of computerized devices. Also, "computer" or "computers" as used throughout the text are always meant interchangeably to be either computer or computers. Therefore, whenever the word "computer" or "computers" is used throughout the text of this patent, including the claims, it can mean any of the above defined devices.
"Server" is a computer on a network that is running software that provides data and services to clients over the network. The term server can also apply to a software process that similarly sends information to clients and that appears on the same computer as a client process, or even within the same application.
"Kernel" is the portion of the operating system that manages and controls access to hardware resources. It performs for example: thread scheduling and dispatching, interrupt and exception handling, and multiprocessor synchronization.
"DMA" is Direct Memory Access.
"Image Loading" as used throughout the text refers to an executable code that is being loaded for execution or unloaded/terminated.
"Hooked function" as used throughout the text refers to an executable filtering code placed between the calling code and called function and thus has the ability for example to monitor and/or intercept and/or redefine the function that is being hooked.
"API" stands for Application Programming Interface.
"Disk" or "disks" is short for "hard disk" or "hard disks", unless indicated otherwise. "Disk" or "disks" or "hard disk" or "hard disks" can mean interchangeably either single or plural.
It is to be understood that in the preferred embodiments hard disks are just an example of the storage devices or storage media which the patent summary and other parts of the patent refer to. So throughout the patent, including the claims, where disks are mentioned, it can also refer to other non-volatile storage devices that exist or may exist in the future, such as for example Magnetic RAM (MRAM), or other types of secondary memory which have or will have a similar function to a hard-disk. Similarly, whenever files or directories are mentioned it can also be files or directories on such other non-volatile storage devices.
All of the descriptions in this and other sections are intended to be illustrative and not limiting.
Referring to
The Security System is preferably comprised of the following main elements:
The Security System may also include (as another possible variation) an optional hardware element (800) shown in more detail in
Further referring to
As explained in the beginning of the clarification section, any feature or element of the above features or elements or at least some of them, like other features or elements described in this application, can be used also independently of the other features or elements. Among other things, this system and method are important for example for the prevention of theft of highly sensitive codes, such as for example private encryption keys or credit card details. This is important because in the USA a recent legislation regards digital signatures as no less obligating than handwritten signatures, and in other countries there are similar legislations in process. One of the biggest service suppliers in this area bragged that it could take almost infinite time to break the private keys in these digital signatures, but ignored the simple fact that there is no need to break the keys since it is much easier to steal them, for example by a Trojan horse arriving by e-mail or through a web page by exploiting various loopholes in browsers or e-mail programs. Since such a signature can be compelling in any kind of contract, including wills and huge real estate deals especially in places where it comes with a non-repudiation policy, it is clear that the damage from stolen keys can be enormous. This is especially dangerous since many times such private keys are generated and stored for example by the browsers. By enforcing the rules, such as the automatic segregation rules and requesting authorization from the user about any access to any communication channels, such theft can be thoroughly avoided. However, in the cases where the keys are generated or stored by the browsers, preferably additional rules are used in order to identify the directories where these keys are held, otherwise accessing the keys by the browser would be within the browser's default authorization. Also, preferably, in this case the Security System also learns various characteristics of the way the user is normally accessing the keys, so that when sudden unusual characteristics are apparent, preferably a special interception and warning can be issued. Even if hardware cards, such as for example smart cards, are used for storing the encryption keys, these keys might still be stolen by Trojans for example by overwriting parts of the programs that access these cards or by monitoring the data in memory while it is being generated by these programs. Another possible variation is that, preferably in addition, preferably the user can keep various different keys, preferably each limited to one or more specific purposes (for example one only good for communications with the USPTO, one only good for a certain type of documents, one only good for certain types of authorizations, one good only for authorizing expenses up to $1000, etc), so that even if keys are stolen then they preferably cannot be used without knowing the limitations of each key and cannot do damage beyond their limited abilities. The list or lists of limitations are preferably kept in an isolated separate place with encryption, or for example are kept only at a separate authority, for example the authority that issued each key.
In cellular phones, for example, eventhough they usually don't have yet sophisticated or sensitive operating systems and file systems compared to Windows, for example, and the operating system is usually EPROMM based, still at least some of the principles of the present system and method can be applied, such as for example:
More technical details are described in the following figures.
A preferable way of viewing and/or modifying the database of authorizations is for example in the form of a table which lists the names and preferably various identification marks of applications allowed to access communication channels (and preferably possibly also a list of which channels), or to exceed their natural environments, or to have any other privileges which normal applications do not have by default, and lists which such privileges they have been given. Some activities might remain unallowed to any applications, such as for example trapping the keyboard device in order to catch keystrokes. Preferably this table includes also various statistical data about the behavior of each program, as explained before. In an organization where most control is in the hands of the system administrator, preferably the security system installed on each computer still runs a similar table and maintains a similar database, however the system can limit what the employee can change without the administrator's authorization. In such an organization, preferably on the administrator's computer this table contains also additional information and controls, such as for example the list of computers connected to the system within the organization, preferably with a unique identifier to each computer, and preferably with additional statistical information on the behavior of each computer in the list, so that preferably the system can automatically alert the administrator for example whenever a computer in the system starts to deviate significantly from its normal behavior, such as for example unusual disk activity or unusual communications activity. Such data is preferably also logged. Preferably the communication between the administrator's computer and the employees' computers is encrypted and secure. Preferably, in addition to this, the Security System on the administrator's computer constantly sends short communications at short intervals to the other computers in the system in order to be able to notice quickly for example if the Security System on any computer has been damaged or disabled. Preferably, this short communication can contain for example special codes with different keys for each computer, so that only an active Security System can respond to it properly, and so that a different response will come from a working computer where the Security System has been disabled or is not working properly (including for example if the computer was booted from a diskette instead of the hard disk), and no response from a computer that is turned off for example. U.S. application 20030055962 by Gregor Freund, filed Aug. 30, 2001 (3 months after the above feature was already included in our PCT/IL 01/00487, for which the present application is a CIP) and published Mar. 20, 2003, describes similarly such querying by a gateway computer to check if the individual computers have a properly working security system, and uses this information to block computers that have not responded properly from access to the Internet through the gateway. However, intercepting or blocking communication attempts in cases of unauthorized or suspect activities is clearly one of the options available for action—as mentioned already in many other places in our PCT, including interception at the gateway. Of course other actions are also possible, such as for example checking preferably immediately what is going on in the computers that have not responded properly (for example by sending someone immediately to this computer or computers and/or for example sending some signal that can temporarily deactivate the system on the computer, which is done preferably by a secret driver that is preferably installed in the OS and can respond to the special deactivation code), since as explained above in clause 4 of the reference to
Referring to
Referring to
Preferably the monitoring hardware mainly monitors access to storage devices (especially hard disk controller) and access to network devices (such as for example modem, network cards, etc.). Preferably, the monitoring hardware has an interface (811) for transfer of information from the Security System's software (104) to said hardware element (800) (such as for example through accessing read and/or write ports in said hardware element (800)) and for immediate feedback to the Security System's software (104) (such as for example through accessing read and/or write ports in said hardware element (800), through interrupts, etc.) so that it can alert the Security System's software (104) to any events that have been defined in the built-in local database (806). The comparison of events between the software monitoring and the hardware monitoring can preferably be done by either the hardware element (800), by the software part of the Security System (104) or by both. When either the hardware element (800) or the Security System's software decides that unknown access has been made to the above monitored hardware without apparent corresponding event on the top system level as monitored by the Security System software (104), the event is intercepted and reported. Monitoring and catching these events enables the Security System to further close any remaining loopholes in the operating system and programs that may override agents hooking, and ultimately even catch and intercept even backdoors in the operating system if they exist.
Referring to
Referring to
Referring to
If the user wants to run for example a virus-scan program, which preferably has no VE limitations, then (apart from the fact that the user or for example the administrator needs to give it these access rights, as explained below), preferably the virus-scan program can access freely all the real files and directories, including for example files and/or directories created for the implementation of Copy-On-Write or of sub-VEs. This is desirable, since the user should preferably know of any known viruses that exist on the computer, even if they are in a limited VE or for example sub-VE or for example Copy-On-Write file (or other special files or directories that are needed for the implementation of the VEs), since the user (or the administrator) might for example at least in some cases want to remove the entire infected VE (for example if it is a directory and/or other resources that belongs to the virus itself). This is also preferable as an additional precaution, since the user might for example inadvertently give a virus access rights outside its VE or be for example cheated by misleading questions in the dialogue box as explained in the reference to
For the implementation of the VE segregation preferably the Security System is the first thing installed after the operating system, and the security system preferably relies mainly on identifying if the user or the program initiated each security-sensitive action in order to decide automatically if to allow it or not, as explained in the reference to
Another possible variation is that the Security System and/or for example the Operating system can also alert the user and/or automatically prevent or take action for example if a malicious program tries to misuse for example the CPU resources and/or the free RAM memory and/or the free space of the disk (and/or other non-volatile storage devices) and/or for example creates on purpose an artificial load on disk activity, etc., since taking over one or more of these resources on purpose can easily cripple the system or freeze it or even crush it. This can be done for example by at least one of the following ways: Taking over the free disk space and/or creating false load on the disk activity can be prevented for example by a default quota for each newly installed application and/or for each VE (which preferably can be easily changed by the user if needed), and/or for example by detecting automatically suspect behaviors such as for example duplicating junk into large areas, rewriting again and again large areas or the same areas, etc. However, since such a malicious program can write data which cannot normally be identified as junk, preferably the identification is based mainly on statistical analysis of typical disk activities, so that for example sudden large usage of disk space preferably in combination with unusual various patterns or parameters of the activities or behaviors can be preferably identified as suspect. Similar analysis can be applied also to other resources, such as for example CPU, network or memory. Since it is very hard to decide automatically when a certain use of CPU or RAM resources is legitimate or not, preferably the Security System and/or the Operating System automatically shows to the user (and/or for example to the administrator in an organization, preferably with an indication of the relevant computer) for example on some part of the screen, for example whenever any of these resources become too low (preferably over a certain minimal period, so that normal short bursts do not create false alarms), or whenever significant deviations from normal statistics in these resources are detected, which applications are taking up most of these resources, preferably sorted in descending order of the resource consumption, and preferably also the percent they are using, and preferably also, to the extent possible, what they are doing, at least in general (preferably the VE of these processes is also indicated, so that the user can see easily if for example more than one program in a certain VE are involved in these activities). Similarly, the system preferably shows the user and/or the administrator also the programs that take most of the Internet bandwidth, preferably also in descending order, so that the user and/or administrator can easily notice for example if some program has unexpectedly started to take over the bandwidth without any apparent justification. And since an entire VE can preferably be removed by the user (and/or for example by the administrator if it is an organization) preferably instantly and without leaving any traces, as soon as such a problem is discovered it can preferably be instantly solved by simply removing the problematic VE, for example by a simple click of the mouse. However, like the other things that can preferably instantly also be undone (as explained in the section that deals with undo), preferably any deletion of a VE can also be instantly undone at least for a certain time period, so that if for example an entire VE is deleted by mistake, this can be instantly corrected. Another possible variation is to automatically detect suspect activities such as for example entering the CPU into useless loops or other suspect cyclic activities, etc. (However, such activities are preferably automatically detected by hardware in the CPU itself since that is much more efficient than having a software detect this). Also, preferably the OS or the Security System requests authorization from the user if a program requests Real-time Priority (or any other priority that can significantly slow down other processes), at least the first time it tries to get such priority or for example every time unless the user gives it such a privilege from then on.
If shared drives are allowed for example in a network, preferably either only the user is allowed to access files on shared drives on other computers, or for example each program is allowed to see and access in each shared drive only the same VE that it has on its own computer, so that for example it can see only corresponding subdirectories on the other computers or for example it can see only files and/or directories (and/or other resources) which it created or was given access to, so that the remote shared drive is regarded like any other local drive on the system. Another possible variation is that it can see the corresponding subdirectories only on shared drives that have the same drive letters as the drive or drives on which its own VE resides. As explained above in the reference to
Since all new programs are installed in their own VE (except when explicitly requested otherwise by the user), it becomes very easy to undo (or at least remove) any installation that has gone bad, for example because of some bug in the operating system or in the program or because it is a malicious program. So the user can very easily request an undo of the installation. However, if the user requests the undo after additional programs have been installed who's VE is for example based in part on the previous VE, then preferably either they are removed too, or for example the security system is able to automatically restore them after removing the problematic program with its VE. Another possible variation is that even if the user for example allows a newly installing program to inherit or overwrite an existing VE, the security system preferably first creates a virtual private environment copy of the modified directories (like described for example in Feature number 8 of the reference to
Another issue is handling various OS services, such as for example print spoolers, MAPI, Windows installer, etc. Since services can work for multiple VEs at the same time and it is also difficult to know for which VE the service is working at a given moment, this might create a security risk, since for example a buffer overflow or other problems in one of the services could cause data to leak between different VEs. In order to solve this preferably at least some services are duplicated so that each VE has a different copy of the thread or process of the service that is running for that VE. However, for efficiency reasons, preferably these services are initially duplicated only into stubs or empty shells (preferably created for example by fork) for each VE in order not to use up resources before they are needed, and preferably the stub or shell is loaded with actual resources only when it becomes needed. This is also one of the possible variations that can be used for example for forcing the VE segregation also on various drivers. Another possible variation is of course that at least some of the services, instead of being duplicated, are regarded as an extension of the OS and thus are preferably treated like other shared resources. This is preferably done at least with specific services which are an integral part of the OS (Such as for example the server and the RPC) and which preferably have a well-known operation. Preferably at least some of the duplication of services is initiated by duplicating for example the services.exe utility of the OS itself during the booting.
Another issue is that in the new Longhorn Microsoft intends to add extensive indexing of files and their contents and/or of other resources on the entire computer, so that the user will be able to carry on efficient searches in a way similar to Internet search engines, and various applications will probably be able to create and/or use these searchable indexes. However, this feature of course may cause conflicts with the requirements of the automatic segregation. Of course, preferably this is solved according to the above described rules and principles, so that preferably only one or a few special applications which are preferably part of the OS or of the Security system are allowed to run such indexing on the entire computer, and preferably normal applications which are limited to their own VE can only create and/or use such index or indexes in their own VE. However, if the Indexing is done for example by special OS applications, then this means that these applications preferably create a separate index for each VE, in addition the global index which is available at the OS view. However this might create some efficiency problems for example when various merges are used, since for each merged view different indexes would have to be merged. Another possible variation is that there is only one or more global indexes that are conducted for example by the appropriate OS or security application, and in this index or indexes preferably each file or resource has a code or mark that indicates the VE to which it belongs, and preferably when accessing this index only the files or other elements that belong to the appropriate VE or VEs are made visible. Of course various combinations of the above and other variations can also be used.
In order to make this more efficient in organizations (for example when installing the security system on computers that already have other software installed on them), preferably one computer can be used for example for learning all of the segregation rules and virtual environment parameters for each program, and this knowledge can be transferred to all the other computers in the organization, without the need to install the Security System before the other applications in the other computers. This last option is preferably used for example in organizations that want to install the security system on computers that are already installed with various programs after the Operating System. So preferably that one computer is installed from the beginning with the security system before any other program is installed on the OS, and then preferably all the other programs that are installed on computers in the organization are installed on it in order to learn the basic rules automatically so that they can be transferred to the other computers in the organization. Another possible variation is that if the Security System is installed on a computer that already has other programs installed on it after the OS, then preferably the Security System is able to cause preferably each installed program to automatically uninstall itself, preferably one program at a time, except that this uninstall is preferably virtual, so that the uninstalling program preferably doesn't really uninstall or doesn't really change anything, but the security system tracks the steps of the attempted uninstall and thus can learn about the associated files and directories and/or other resources, and can preferably move them or parts of them for example to virtual directories and/or files when needed. Of course, this might not work for programs where there is no uninstall information, so as explained above, preferably the Security system can also use various heuristics in order to define the boundaries of VE's of programs that were already installed before the Security System. Of course, if the security system is made part of the operating system itself (for example integrated into it by Microsoft, in case of a Microsoft OS such as windows), then the security system is by definition installed always during the installation of the operating system in all new computers that install this new OS, so by definition it is automatically installed before any other program. Preferably, in this case it is also installed for example before any applications that can access the Internet even if those applications are considered an integral part of the Operating system, such as for example MSIE, Microsoft Media Player, etc., so that for example the VE of these applications can be automatically determined during their installation. Another possible variation is that the security system is installed for example BEFORE the operating system or before most other parts of it. Of course various combinations of the above and other variations can also be used, as explained above. In addition, in systems that are always connected to the Internet even without opening or closing a connection Icon (such as for example some of the ADSL and/or Cable modem systems) there is a problem that the OS might open the connection for example between the network card and the modem for example sometime during the booting process, before the boot has finished and before a normal firewall program is typically even started. This has the danger of leaving the system open to outside attacks even during the boot process itself. So another advantage of the current System is that if it is integrated in the OS and/or is loaded before it then of course it can catch anything even before the boot of the OS itself is complete.
Referring to
Preferably if the user drags a file between different VEs it causes the receiving VE to access the dragged-and-dropped file, as if the user allowed it though the dialogue box. Similarly, with file completion objects, such as for example start→run menu, this preferably works normally when used for example from the OS explorer, but when normal programs use this interface they can preferably query only their own VE, and for that a layer of secured object is preferably added. In other words, if a program tries to use this interface, preferably the Security System takes control over this interface, like it does for example with the dialogue box. Similarly, if a program such as for example Microsoft Word or a compiler lets the user choose from a menu to reopen a recent file, this creates the problem that the program might open a file without authorization by the user, since in this case there is no dialogue box. To solve this, one possible variation is that the security system takes control of this too and/or monitors it and thus checks for example if the user really clicked on the file shown to him, or for example the security system overrides this interface with its own implementation of it, however these two solutions might be problematic since unlike the file completion this is not a standard interface. Another possible variation, which is more preferable, is that the Security System for example automatically allows the program to reopen the last N files that it was allowed to open, for example the last 5 files, or any other reasonable number. However, this has the problem that if the program, for example Word, allows the user to pick one of 6 or more files, then if the user picks for example the 6th or 7th file then the Security System will not allow the access (Preferably by telling Word that the path or file does not exist) and Word will report to the user that the file is not found or the path does not exist, etc. A similar solution is preferably used if for example a browser or a download utility is allowed to automatically complete an interrupted download of one or more files without asking the user explicitly again which files to access. Preferably the security system takes into account also the time that elapsed since the last time that these files were opened by that program and/or for example the time since the last time the user explicitly allowed to open them for example through the dialogue box. Preferably if the executable code of such a program has changed for any reason, it automatically looses these reopen rights, and/or is automatically transferred to another VE, as described for example in the reference to
Similarly, if the user activates a program from a command line with one or more parameters that contain a file name or a path, it is preferably regarded by the security system as if the user entered the file name or path from the dialogue box, as is dictated by the above explained principle of regarding user input in a command line as a user authorized activity. Similarly, of course, if the user opens for example a DOS or CMD window and is for example in directory e:\ttt and activates for example the command fgrep.com which is for example in I:\util (and which is found for example according to the "path" searching sequence defined in autoexec.bat), and the file name to be searched is given to fgrep.com as a parameter, the Security System again preferably regards it as a permission by the user to i:\fgrep.com to search the requested file on e:\ttt. Another possible variation is that preferably at least some semantic parsing is done on the command line parameters. On the other hand for example fgrep.com or any other DOS program might for example ask the user which file or files to open, and use for that question for example any graphic or textual format that it pleases. In this case, the Security system preferably handles this in a way similar to the dialogue box, so that for example textual questions and responses are monitored by the security system (for example by monitoring the text screen and preferably including semantic analysis of the displayed text), and graphical questions are for example blocked, and/or other limitations are imposed on programs that user them. Another possible variation is that when the user has to answer DOS programs about file access, he for example clicks on the mouse and thus activates for example the dialogue box that is controlled by the security system.
As explained for example in clause 8 of the reference to
The possible relationships between resources between 2 VEs for example regarding files are:
When there are multiple sharing relations there may be a problem that there can be multiple versions of the same file, for example because of the Copy-on-Write or because of multiple installations of the same file in the same virtual place (for example in c: or in c:windows), and therefore there can be dilemmas which version should be regarded as the most relevant, which are preferably solved by defining hierarchical scopes of view. For example, if one or more VEs virtually change an existing file for example in c:\ by copy-on-write, according to the above explanations and principles as explained already in other places in this application, the user of course preferably sees in c:\ the original unchanged file, since that file is changed for the user only if the user himself initiates the access to the file or allows a program in a VE to access it for example through the dialogue box. (In other words the first default scope is the OS level). Similarly, if for example a program from some VE creates a real file in c: (which means that the user allowed it for example through the dialogue box), then that file is of course seen by the user since it is at the OS scope. On the other hand, if one or more VEs create a virtual file for example in c:\ that exists really only in their own VE, then preferably either the user does not see that file in c:\, or the user can see in c:\ a version of the file according to the order of scopes, so that for example if the file exists in one of the VEs that are created at the administrator level, then preferably the user will see that version of the file, and if the file exists only in one of the VEs that were created in the user level then preferably the user will see that version of the file. Within the administrator level and within the user level, if the file exists in more than one VE, then preferably an additional internal hierarchy of scopes is used, so that for example the version shown will be the version that was most recently updated or for example the earliest version or for example the version of the most recently installed VE, or for example the version from the earliest installed VE. However, allowing the user to see the virtual file as if it really exists in c:\ is at least sometimes less preferable since at least sometimes it can create inconsistency and confusion: In this case for example if the user has an autoexec file of even just two lines, and a virus virtually modifies it through copy-on-write into its own VE, then preferably the user of course sees only the original autoexec file and not the modified file, and this real autoexec file of course takes effect in the user's scope. On the other hand, according to this variation, if the user had previously no other autoexec file then the user will suddenly see the autoexec file of the virus's VE, although it will have no real effect on the OS scope. An even worse problem could occur if for example there are at least some VEs that contain viruses or other malicious programs which decide every day (or for example every hour or any other period) to create and then erase again various files for example in c:\ or for example in c:\windows. This would mean that although there is no real damage in the OS scope, the user might constantly see files appearing and disappearing at least in the shared area of the OS. Another problem that can happen for example if the user did not have an autoexec file and is shown the virtual autoexec file created by a virus as if it exists in c:\, is that the user might for example regard it by mistake as valid file and for example edit it or for example rename it or copy it or for example copy parts of it by cut and paste and then use for example a dangerous part of it in another file (If the user edits it then preferably the real file remains in the VE where it exists, however, if the user for example copies it or a part of it then there is a problem that the new copy could be the real OS scope). Therefore as explained above another possible variation is that the user does not see the virtual file as if it exists in c: or does not see it at least in some cases. Anyway, in the variations and/or in the modes where the user and/or the administrator is shown such virtual files as if they really exist in the OS scope, preferably there is at least a preferably clear indication near each such file (and/or directory) if it is a real file or a virtual file, and/or the user can see for example by clicking on the file and/or for example by the color of the file name (or icon) and/or by other indication to which VE it really belongs (The name of the VE is preferably the name of the main directory of that VE). As explained above in the reference to
Similarly, if the user deletes the file, for example c:\autoexec.bat, then one possible variation is that it is deleted only in the OS scope. Another possible variation is that it is deleted also in all the other VE's where another copy of the file exists for example at a result of Copy-on-Write, or for example to leave at least some of the other copies of the file, at least in some cases. However, this is less preferable since deleting for example the autoexec file in some other VE might cause the programs there not to function properly. On the other hand, if the user changes the file, then preferably it is changed only in the real file at the OS scope.
Similar principles preferably apply for the VE's point of view. For example, if VE1 has a write access to several other VEs (for example VE2,VE3 and VE4 in
This is similar to the merge that the user can preferably see, except that the user and preferably for example explorer and regedit and/or other designed GUI utilities (which preferably have no VE limitations), can preferably see a merge of the same resource from all the VEs at least within the user scope (for example if he has less then root privileges) (for example the registry, file system and/or other resources). This merged view by the user while each application runs in its own VE helps to keep the transparency to the user. Preferably when the system boots, for example, preferably for example the startup files that were installed by all the VE's are started, (preferably being normally merged) except that each runs in his own VE. However, as explained above in the reference to
Preferably the divergence between the real directory structure (that includes for example copy-on-write files and sub-VE directories) and the merged view is kept at a necessary minimum, so that for example when a newly installing program requests to create a new directory and the user allows it, preferably the requested directory is really created at the requested path. (Another possible variation is to create the new directory only virtually, which has the advantage of allowing easier management, however that could make the divergence much bigger and is therefore less preferable). As explained above in the reference to
On the other hand, when dealing for example with copy-on-write versions of the autoexec file, the situation is different, since if programs from various VEs make changes in it, then preferably each change or addition takes effect only within the VE that made it, which can be more problematic. In addition, for example in Windows XP and NT the autoexec file is typically only activated when the user activates a DOS or CMD window or only if the user manually activates it after entering the window. However, for example in Windows 98 or Windows-Me the autoexec file is activated before the Windows loads and takes effect globally. Therefore, one possible solution that is good for both of these types of Windows is that each line (or for example each command within a line in the autoexec file) has a mark (for example within the file or elsewhere) which indicates to which VE it belongs (or for example this is the result of a merged view of the virtual autoexec files), and preferably when executing the autoexec file each program or command will be run within the limitations of the VE that added it to the autoexec file. (In other words, for example in systems like Windows 98 and Windows ME one of the possible variations is that the commands in the merged autoexec file are preferably executed automatically, but preferably each command is executed within the limitations of the VE that added it to the autoexec file, and of course the autoexec file has to be executed only after the Security System is already running). Another possible variation that is relevant for example for windows XP and NT is that when the user enters a DOS or CMD window, the relevant autoexec is automatically executed when the user activates some program that needs it, and preferably all the programs that are activated by it are then limited to the VE of that program. In this variation, if the user for example then activates again the same program or another program in the same VE then the relevant autoexec file is not reactivated but remains in effect from the previous time, and only activating a program from a different VE causes another relevant autoexec to be activated if it exists or is needed. In other words, the rule in this variation is preferably that whenever a program is activated within the DOS or CMD window, if there is an autoexec file that is associated with this VE, it is activated unless it is already active.
Referring to
Referring to
Preferably only by explicit permission from the user can the program see other programs or directories or their data or access other system resources. Referring to
While the invention has been described with respect to a limited number of embodiments, it will be appreciated that many variations, modifications, expansions and other applications of the invention may be made which are included within the scope of the present invention, as would be obvious to those skilled in the art.
Referenced by
Original Image


text:
East Gippsland Shire Flood Emergency Plan - 2012
East_Gippsland_Municipal_Emergency_Management_Plan.pdf (PDF 1Mb)
East Gippsland Fire Management Plan 2011 (PDF 14.7Mb)
Municipal Council Neighbourhood Safer Places Plan – East Gippsland Shire Council
(PDF 183Kb)
These plans may also be viewed at any East Gippsland Shire Council Service Centre, Library or Outreach Centre. To locate your nearest centre, please contact Council.
Type the code from the image
Rate this page - was the information useful to you?


text:
PRLog - Feb. 18, 2013 - Peveril Homes has, this week, launched a campaign with wings, in a bid to encourage the birds of Belper to pay a flying visit to its development.
Marie Burrows is looking after the wildlife, at Beaurepaire at Alton Manor
The leading local housebuilder is keen to look after the wildlife surrounding its sites and has fitted bird-feeders on the trees of its Beaurepaire at Alton Manor development.
Angela Thomas, marketing manager for Peveril Homes, comments: "We recognise that the winter can be a challenging time for our feathered friends, especially when the ground is frozen and the availability of food becomes even more difficult.
"We hope that, by installing feeders, we are going some way towards helping local bird populations to survive, through what has been one of the coldest winters for 100 years, and setting a good example to our residents, who we hope will follow suit and make this an even more popular activity."
Beaurepaire is situated off Nailers Way, in Belper, and offers buyers a selection of attractive and affordable three- and four-bedroom detached and semi-detached homes which start from as little as £167,950; with a 100-per-cent part exchange available, now couldn't be a better time to buy.
The development is ideally located to access the county's capital city, Derby. For travelling further afield, the nearby A6 and A38 offer convenient links to the UK's road network, while Derby boasts a mainline railway station, with direct routes to London St Pancras International.
To find out more about the properties available at Beaurepaire at Alton Manor, visit the development 11am–5pm, Thursday–Monday:


text:
Select Local Merchants
Detroit ZooRead MoreWithin the Detroit Zoo's 125 acres, more than 2,500 animals call naturalistic habitats home. But amid California newts, gila monsters, bald eagles, and lions, one animal stands a neck above the rest. That's because the zoo's Giraffe Encounter allows visitors to get up close and personal with these mammals, giving them a supervised opportunity to feed them special giraffe food.8450 West 10 Mile RoadRoyal Oak, MI US
African Safari Wildlife ParkRead MoreVehicles leisurely roll across African Safari Wildlife Park's landscape, yielding to a host of friendly creatures. Camels, giraffes, zebras, forest-dwelling bongos, Asian sika deer, and Scottish highland cows await you. Guests can hold cups filled with feed, which exotic muzzles devour, and a walking area provides an up-close look at enclosed species such as the rare white alligator. Warm-weather months bring out additional activities, including animal rides, pig races, and educational animal shows where guests can interact with small animals. Food and beverages from African Safari's ice-cream shop and snack bar help sate midday hungers caused by watching a guanaco sneeze.267 S Lightner Rd.Port Clinton, OH US
The Pumpkin FactoryRead MoreThose who love fall know that full immersion is the best way to get into the spirit of the season. The Pumpkin Factory just happens to be the perfect place to plunge into all things autumnal, welcoming visitors with an array of fall-themed activities including a pumpkin patch, corn maze, hay rides and a haunted house. Once twisting stalk has been traversed and every pumpkin has been inspected and assessed for its potential carvability, kids can expel excess energy by jumping in a giant inflated spider house or by exchanging tin can recipes with the resident goats in the nearby petting farm. And, if all that activity works up an appetite, the farm's country store sells a number of delectable, seasonal treats, including pumpkin pie, donuts, caramel apples and apple cider.48651 Harris RdBelleville, MI US
Diehls Orchard & Cider MillsRead MoreLeaves crunch underfoot as fluffy white clouds hang in a blue sky between long rows of apple trees. It's simple pleasures such as these that add warmth to autumn and lead people in droves to Diehl's Orchard and Cider Mill. There, fresh jonamac, honeycrisp, and golden delicious fruits hang, begging to be plucked, while hot cinnamon donuts refuel guests and pair expertly with swigs of apple cider. In fact, Diehl's loves this beverage so much, that they celebrate it every year with their late-September Ciderfest. But apples and apple accessories aren't the only stars at this orchard. Guests can also get lost in the one-mile corn maze, ride along the fields in a hay-filled wagon, roast hot dogs over a campfire, and conjure up metaphors for society with the farm animals.1479 Ranch RdHolly, MI US
Great Lakes Zoological SocietyRead MoreWhile visiting the Great Lakes Zoological Society's indoor reptile zoo, guests take in animal sights that tend to deceive at first glance. A rough-barked indoor tree, upon closer inspection, may actually be a snake craftily blending in. Lizards, tortoises, and tarantulas populate similar enclosures, resting atop logs suspended over ponds or within forest-floor greenery. The nonprofit indoor zoo houses more than 100 animals representing over 70 species, including reptiles, amphibians, insects, arachnids, and birds, that help teach visitors about their habitats. Along the way, guides invite visitors to meet colorful residents such as a reticulated python weighing over 150 pounds, two 90-pound Sulcata tortoises, and monitor lizards that extend over 5 feet. Zoo staff members also lead groups deeper into the study of their creatures during classroom visits, where children learn about ecological conservation, how to identify dangerous animals, and the proper way to give a snake a handshake as they touch and handle some reptiles. On-staff instructors also teach group classes in subjects such as animal medicating, handling, and reptile husbandry. The nonprofit occasionally places its animals up for adoption, and works toward conservation efforts by rehabilitating, breeding, and rereleasing native Michigan species and global endangered species.6885 Jackson RdAnn Arbor, MI US
Colasanti's Tropical GardensRead MoreThe Experience For just a moment, visitors to Colasanti's Tropical Gardens might believe they've been whisked away to Madagascar: the call of ring-tailed lemurs and the squawk of parrots echoes around acres of exotic plants. And yet this tropical locale is nestled much closer to home?just outside of Kingsville. The 35-acre family farm keeps visitors entertained year-round with 15 temperature-controlled greenhouses filled with flowering equatorial plants and cacti, a petting farm that brings kids face-to-face with foreign animals without having to go through an ambassador, and carnival attractions. The Highlights Petting farm home to pygmy goats, llamas, ring-tailed lemur, and a 10-foot alligator (admission fee required) Kid-friendly rides, mini-golf, and indoor playground Arcade room with more than 40 video games Restaurant serving famous broasted chicken, pizza, fresh donuts, and peach drink Home decor and collectibles shop Exotic flowering and tropical plants Who They Are In 1924, at the age of 22, Italian-born Aleutario Colasanti followed his dreams of a better life to Kingsville. Facing anti-immigrant sentiments and financial trouble, Alex only worked harder to eke out a living as a farmer. On a fateful trip to Detroit in 1932, he met?and fell in love with?Emma Colagiavanni. Despite her parents' protests, they eloped and started a family, and in 1941, they settled on what would soon become the Colasanti farm. Beginning with just one greenhouse and a small fruit stand, the family's operation grew over the next 30 years to host vegetables, exotic fruit trees, and a conspicuous lack of albatrosses. Though Alex and Emma have since passed, their legacy lives on through their grandchildren and the expansive Colasanti's Tropical Gardens.1550 Rd. 3 EKingsville, ON CA


text:
There isn't anyone named Bing or Ruth in the band called Bing & Ruth, but their name is as mysterious as their sound.
Monday, June 29: American Landscapes - Featuring Lanterna in Concert
To celebrate Independence Day, Echoes takes a trek across American Landscapes. Centering the show will be a live performance by Ambient Americana duo Lanterna. Surrounding this live performance will be a soundscape of music evoking American landscapes.


text:
Warriors of Sharia law are hidden within the 'Horse of Doom'
To The Daily Sun,
Today a Trojan Horse stands outside the halls of Congress. Hidden within are warriors of chaos cloaked in religion. A democratic Republic ruled by secular law is targeted. Sympathizers are readying.
America, man our battle stations! If you survive the Republic's death at the hands of the administration, surely you will not escape the warriors of Sharia law hidden within the "Horse of Doom."
It's "teamsters" lull indifference, unconcern, distracting us from 24/7 vigilance. This mesmerizing "gift" is about to disembark its deadly cargo. All who dwell in freedom's light — beware.
Ward H. Flanders
Last Updated on Thursday, 31 July 2014 11:24
Hits: 149
Help put on the 3rd Annual 'Book-It!' 5K Road Race in Meredith
To The Daily Sun,
The Friends of the Meredith Library are seeking sponsorship and volunteers for the third annual "Book-It!" 5K Road Race being held on Saturday, Aug. 30, at Community Park in Meredith. This popular family event attracts more than 100 runners and walkers each year. All proceeds from the race are used to support the Meredith Public Library.
Sponsors of $100 or more will be listed on the hi-tech shirts worn by the racers, on signage at the event, on the race website (mplbook-it.weebly.com) and in all public relation materials. To donate and be included on the shirts, please contact us by Aug. 10.
We would like to thank those who have already donated: Gold Sponsor, The Fitness Edge; Silver Sponsors, Miracle Farms Landscape Contractors, Overhead Door Options Inc.; Bronze Sponsors, Chippers, DES Home Repair and Remodeling, E.M. Heath Inc., Middleton Building Supply Inc. and Phu Jee Chinese Cuisine.
Beverly Heyduk
Friends of the Meredith Library
Last Updated on Wednesday, 30 July 2014 11:28
Hits: 168
Progressives want all Americans to have VA-type health care
To The Daily Sun,
John Morrissey's letter of July 23 supporting Nick Vazzana's candidacy was amusing. While Vazzana may have been a successful entrepreneur as he claims, Vazzana also supports President Obama's policies which have killed more good jobs than it has created, made middle income Americans poorer, and widened the gap between our rich and poor.
Morrissey apparently likes Common Core which is another one-size-fits-all Washington-driven program to control education, indoctrinate children with the proper "progressive" views, and reward special interest groups.
Perhaps Morrissey is demonstrating his learning of Common Core math when he (incorrectly) asserts that before Obamacare one quarter (about 78 million) of our population was uninsured. The generally accepted, although overstated, number of uninsured Americans at the time of Obamacare's passage was about 45 million people, less than 15 percent. One-third of the 45 million were illegal aliens (who President Obama said would not get Obamacare), one-third were people who could afford but chose not to purchase health insurance, and about one-third were people who could not afford the high priced health insurance which meets the government requirements imposed to benefit bureaucrats and special interests.
Addressing the problem that 5 percent of our population could not afford health insurance did not require an Obamacare-like solution which drives up costs, reduces health care choices for most people, and puts Washington bureaucrats in charge of our health care.
Before Obamacare we were the center for innovation in health care (Obamacare's regulations and taxes will hurt this). Most of us know people who survived illnesses that would have killed them just a few years ago. The U.S. health care system is the world's best, or nearly the best in responsiveness to health problems.
Critics of our health care system point to the World Health Organization, and similar organizations, which bias their evaluations in favor of single-payer, central-controlled healthcare systems such as that provided in the U.S. by the Veterans Administration.
The ultimate goal for "progressives" like President Obama is a VA-type of health care system for all Americans because it gives the government control over everything related to your health.
The VA health care system has had problems for decades. Certainly some good care is provided. But now we find that patients are put on hidden waiting lists, patients who complain are neglected, and records are falsified so employees get raises and bonuses. Our pre-Obamacare system is much more responsive to patients.
I agree with Morrissey that we need to "restore the American dream." But big government controls and solutions, as exemplified by the results of President Obama's actions, are obstacles rather than aids to people achieving their American dreams.
Don Ewing
Last Updated on Wednesday, 30 July 2014 11:04
Hits: 197
If anyone should be deported, it should be members of Congress
To The Daily Sun,
Are we being invaded?
Yes, by hordes of 7- to 15-year-old children from Central America. Beware as they are armed with spitballs and are scared stiff. They have ridden on the tops of railroad cars for thousands of miles just to get here to be safe from the drug lords at home. In some cases they will be killed if they go home or they will be forced to work as mules carrying drugs. In most cases they will be deported and sent back. There must be a better answer than that.
If there was oil to be had down there it would be a no brainer and our answer would be there. Just ask the Cheney/Bush cartel. But no oil, so who cares and what to do with them if they stay here?
We don't have the resources or places to house them do we? Well, we do but we won't even spend those on our own people. We already have thousands in need, if you are to believe the news lately. We even turn Detroit, if you haven't heard about it. We will waste billions trying to keep health care away from those who need it. We will waste more closing down the government if we don't get our way. We will spend more time pointing fingers of blame at each other than trying to fix the problem.
The GOP has spent more time attacking the president instead of earning its pay. All they are doing is stalling until the next elections. Ted Cruz, the antipatriot, from Texas tries to blame Obama for everything possible from A to Z. Izza spends all his time attacking on the other front. Good military move, but they are attacking and dividing their own country. Sounds like treason to me. This is how we have lost respect in the world.
Other countries see our lack of respect and wonder why they should respect Obama. It wasn't to long ago the described patriotic and "popular" Congress has vowed not to allow the president to accomplish anything. They must be proud.
If anyone should be deported it should be many members of the House and Senate. The GOP has spent the last few years quietly building from the ground up rearranging voting districts and voting rules so they will be able to slide into power in the mid-term elections. We need to keep both Maggie and Jeanne in office. So, get out the vote in 2014.
Jon Hoyt
Last Updated on Wednesday, 30 July 2014 11:01
Hits: 207
This administration has a death plan for us and our country
To The Daily Sun,
Death Notice: Ours!
Do we prefer not to be advised by our doctor of their diagnostic expectation of our remaining life span? Given the extent of many illnesses, is this why we refuse to acknowledge that this administration has a death plan for us and our country?
Regardless of your attitude to this threat we have arrived again at 1776 — the only possible answer to 2014.
Ward H. Flanders
Last Updated on Wednesday, 30 July 2014 10:56
Hits: 102


text:
Bristol Post list all of the motoring businesses in Bristol. If you are looking for anything motoring in the local area such as Car & Van hire or MOT Testing Centres then you can find a good business and deal with Bristol Post!
Why not list your Bristol business on Bristol Post?
Address: 56 Willis Road, Kingswood, Bristol, , Kingswood, BS15 4SS
Address: 36 Fairford Close, Kingswood, Bristol, BS15 4QE
Address: 6 Fairlawn, Liden, Swindon, SN3 6ET
Address: , , Kingswood, BS15 4SS
Address: St Lawrence Crescent, , Shaftesbury, SP7 8EG
Address: 21 Oak Court, Grove Park Road, WESTON-SUPER-MARE, BS23 2LA
Address: Hartcliffe Rocks Way, , Bristol, BS40 9YR
Address: 87 County Street, , Bristol, BS4 3AG
Address: 5-7 Waverley Road, , Bristol, BS6 6ES
Address: Bridgwater Court, Oldmixon Crescent, WESTON-SUPER-MARE, BS24 9AY
Address: 33 Buller Road, , BRISTOL, BS4 2LN
Address: 135 High Street, , Bristol, BS16 5HQ
Address: Unit 1 Canons Yard Industrial Estate, Station Road, Swindon, SN4 7SP
Address: 71 High Street, , Bristol, BS49 4DW
Address: Trymside, Sea Mills, BRISTOL, BS9 2HB
Address: 59 Sedgebrook, , Swindon, SN3 6EZ
Address: 24 Bruce Avenue, , Bristol, BS5 6EF
Address: Oakwood Park, Lodge Causeway, Bristol, BS16 3JA