text:
Patent US7797747 - Detection of malicious code in non-paged pool unused pages - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inPatentsSubsets of non-paged pool unused pages entries are flushed from a translation lookaside buffer (TLB). An attempt to access malicious code within a not present page within the non-paged pool unused pages is made, e.g., by malicious code. The attempt to access the page generates a page fault, which is...http://www.google.com/patents/US7797747?utm_source=gb-gplus-sharePatent US7797747 - Detection of malicious code in non-paged pool unused pagesAdvanced Patent SearchTry the new Google Patents, with machine-classified Google Scholar results, and Japanese and South Korean patents.Publication numberUS7797747 B1Publication typeGrantApplication numberUS 11/359,235Publication dateSep 14, 2010Filing dateFeb 21, 2006Priority dateFeb 21, 2006Fee statusPaidPublication number11359235, 359235, US 7797747 B1, US 7797747B1, US-B1-7797747, US7797747 B1, US7797747B1InventorsPeter FerrieOriginal AssigneeSymantec CorporationExport CitationBiBTeX, EndNote, RefManPatent Citations (5), Non-Patent Citations (4), Referenced by (14), Classifications (8), Legal Events (2) External Links: USPTO, USPTO Assignment, EspacenetDetection of malicious code in non-paged pool unused pages
US 7797747 B1Abstract
Subsets of non-paged pool unused pages entries are flushed from a translation lookaside buffer (TLB). An attempt to access malicious code within a not present page within the non-paged pool unused pages is made, e.g., by malicious code. The attempt to access the page generates a page fault, which is detected. The page is scanned for malicious code and a determination is made that the page contains malicious code. Protective action is taken to protect a host computer system from the malicious code. Accordingly, malicious code in a page marked not present, i.e., in a page that ordinarily would not be scanned for malicious code, is detected and defeated.
executing, on a processor, a malicious code detection application wherein said executing comprises:
determining non-paged pool unused pages in a non-paged pool,
wherein non-paged pool pages in said non-paged pool are not swapped to and from pagefiles;
said non-paged pool pages are non-paged pool used pages and said non-paged pool unused pages;
selecting a subset of said non-paged pool unused pages;
flushing non-paged pool unused pages entries corresponding to said subset from a translation lookaside buffer (TLB);
detecting a page fault associated with an attempted access to a page
determining whether the page is within the non-paged pool unused pages in said non-paged pool;
determining whether said page contains malicious code upon finding that the page is within the non-paged pool unused pages in said non-paged pool; and
taking protective action, upon finding that the page contains malicious code, to protect a computer system from said malicious code.
2. The computer-implemented method of claim 1 further comprising determining whether additional flushes of said translation lookaside buffer are necessary.
3. The computer-implemented method of claim 1 further comprising repeatedly performing said determining, said selecting, and said flushing.
4. The computer-implemented method of claim 1 further comprising repeatedly performing said determining whether additional flushes of said translation lookaside buffer are necessary, said selecting, and said flushing until all entries in said translation lookaside buffer are flushed.
5. The computer-implemented method of claim 1 further comprising hooking a page fault handler to facilitate said detecting.
6. The computer-implemented method of claim 1 wherein an entry corresponding to said page has been flushed from said translation lookaside buffer in said flushing.
7. The computer-implemented method of claim 6 wherein said entry mapped a virtual address to a physical page address of said page.
8. The computer-implemented method of claim 1 wherein said determining whether said page is within said non-paged pool unused pages comprises determining whether a virtual address of said page matches any of virtual addresses of said non-paged pool unused pages.
9. The computer-implemented method of claim 1 wherein upon a determination that said page is within said non-paged pool unused pages, said determining whether said page contains malicious code further comprises determining whether said page is unassigned.
10. The computer-implemented method of claim 9 wherein said determining whether said page is unassigned comprises determining whether a virtual address of said page matches any of virtual addresses of unassigned pages of said non-paged pool unused pages.
11. The computer-implemented method of claim 9 wherein upon a determination that said page is not unassigned, said determining whether said page contains malicious code further comprises scanning said page for malicious code.
12. The computer-implemented method of claim 1 further comprising providing a notification that said protective action has been taken.
13. The computer-implemented method of claim 1 wherein a page table entry associated with said page comprises physical page address bits and a present bit, said physical page address bits comprising a valid physical page address, a value within said present bit indicating that said page is not present, said page being a not present page in said non-paged pool unused pages.
a memory having stored therein a malicious code detection application; and
a processor coupled to said memory, wherein execution of said malicious code detection application generates a method comprising:
15. A computer-program product comprising a computer readable medium containing computer program code comprising:
a malicious code detection application for determining non-paged pool unused pages in a non-paged pool,
said malicious code detection application further for selecting a subset of said non-paged pool unused pages;
said malicious code detection application further for flushing non-paged pool unused pages entries corresponding to said subset from a translation lookaside buffer (TLB);
said malicious code detection application further for detecting a page fault associated with an attempted access to a page
said malicious code detection application further for determining whether the page is within the non-paged pool unused pages in said non-paged pool;
said malicious code detection application further for determining whether said page contains malicious code upon finding that the page is within the non-paged pool unused pages in said non-paged pool; and
said malicious code detection application further for taking protective action, upon finding that the page contains malicious code, to protect a computer system from said malicious code.
The present invention relates to computer system security. More particularly, the present invention relates to a system and method of detecting malicious code in a computer system.
An antivirus scanner, sometimes called memory scanner, scans memory of a computer system to detect malicious code. A trade-off exists between the amount of memory scanned and the speed at which the memory is scanned.
Generally, the greater the amount of memory scanned, the higher is the likelihood that the antivirus scanner will detect malicious code within memory. Stated another way, the greater the amount of memory scanned, the less likely it is that malicious code will be in a memory area that is not scanned. Accordingly, it is desirable to scan as much memory as possible.
Conversely, the greater the amount of memory scanned, the longer it takes for the antivirus scanner to complete the scan. Thus, to increase the speed at which the antivirus scanner scans the memory while at the same time minimizing the likelihood of not scanning a memory area that contains malicious code, only memory areas, e.g., pages, that are likely to contain malicious code are scanned.
To identify memory areas that are likely to contain malicious code, the page tables are interrogated by the antivirus scanner to determine which pages are likely to contain malicious code, e.g., existing pages which are valid.
The antivirus scanner then scans the pages likely to contain malicious code. However, if the malicious code is in a page that is not scanned, the malicious code goes undetected.
In accordance with one embodiment of the present invention, subsets of non-paged pool unused pages entries are flushed from the translation lookaside buffer (TLB). An attempt to access malicious code within a not present page within the non-paged pool unused pages is made, e.g., by malicious code. For example, the entry, which mapped the virtual address to the physical page address of the page, has been flushed from the translation lookaside buffer as discussed above. Further, the page table entry associated with the page indicates that the page is not present.
Thus, the attempt to access the page generates a page fault, which is detected. The page is scanned for malicious code and a determination is made that the page contains malicious code. Protective action is taken to protect the host computer system from the malicious code. Accordingly, malicious code in a page marked not present, i.e., in a page that ordinarily would not be scanned for malicious code, is detected and defeated.
FIG. 1 is a diagram of a client-server system that includes a malicious code detection application executing on a host computer system in accordance with one embodiment of the present invention;
FIG. 2 is a block diagram of a kernel address space of a memory of the host computer system of the client-server system of FIG. 1 in accordance with one embodiment of the present invention;
FIG. 3 is a flow diagram of a translation lookaside buffer (TLB) flush operation in accordance with one embodiment of the present invention; and
FIG. 4 is a flow diagram of a malicious code detection operation 400 in accordance with one embodiment of the present invention.
In accordance with one embodiment, referring to FIGS. 2 and 3 together, subsets of non-paged pool unused pages entries are flushed from a translation lookaside buffer (TLB) 228 (OPERATION 308). Non-paged pool unused pages 208 would not contain valid content under ordinary circumstances. Accordingly, flushing the non-paged pool unused pages entries from translation lookaside buffer 228 does not result in any adverse consequences such as a performance penalty in one embodiment. However, to avoid any unwanted or unforeseen consequences such as a performance penalty, only a subset, i.e., not all, of the non-paged pool unused pages entries are flushed at any one time.
Referring now to FIGS. 2 and 4 together, an attempt to access malicious code 232 within a not present page 230 within non-paged pool unused pages 208 is made, e.g., by malicious code. For example, the entry, which mapped the virtual address to the physical page address of page 230, has been flushed from translation lookaside buffer 228 as discussed above. Further, the page table entry associated with page 230 indicates that page 230 is not present.
Thus, the attempt to access page 230 generates a page fault, which is detected (OPERATION 406). Page 230 is scanned for malicious code (OPERATION 414) and a determination is made that page 230 contains malicious code 232 (OPERATION 416). Protective action is taken (OPERATION 418) to protect the host computer system from malicious code 232. Accordingly, malicious code 232 in a page 230 marked not present, i.e., in a page that ordinarily would not be scanned for malicious code, is detected and defeated.
More particularly, FIG. 1 is a diagram of a client-server system 100 that includes a malicious code detection application 106 executing on a host computer system 102 in accordance with one embodiment of the present invention.
Host computer system 102, sometimes called a client or user device, typically includes a central processing unit (CPU) 108, sometimes called a processor 108, an input/output (I/O) interface 110, and a memory 114. Host computer system 102 further includes standard devices like a keyboard 116, a mouse 118, a printer 120, and a display device 122, as well as one or more standard input/output (I/O) devices 123, such as a compact disk (CD) or DVD drive, floppy disk drive, or other digital or waveform ports for inputting data to and outputting data from host computer system 102.
In one embodiment, malicious code detection application 106 is loaded into host computer system 102 via I/O device 123, such as from a CD, DVD, or floppy disk containing malicious code detection application 106.
Host computer system 102 is coupled to a server system 130 of computer system 100 by a network 124. Server system 130 typically includes a display device 132, a processor 134, a memory 136, and a network interface 138. Additional computer systems such as a hacker, e.g., a second, computer system 104 are also associated with network 124.
Malicious code detection application 106 is stored, for example, in memory 114 of host computer system 102 and executed on host computer system 102.
The particular type of and configuration of host computer system 102, server system 130, and hacker computer system 104 are not essential to this embodiment of the present invention.
In one embodiment, for example, memory 114 includes a page-based virtual memory system that uses pages, e.g., 4096 byte memory areas. More particularly, some computing environments such as Windows® NT and Windows® 2000 provide page-based virtual memory management schemes that permit programs to realize a 4 GB (gigabyte) virtual memory address space. When the computer system processor is running in virtual memory mode, all addresses are assumed to be virtual addresses and are translated, or mapped, to physical addresses in main memory each time the processor executes a new instruction to access memory. Translated addresses, i.e., cross-referenced virtual addresses and physical addresses, are sometimes called a mapping. One example of a mapping is a page table.
Conventionally, the 4 GB virtual memory address space is divided into two parts: a lower 2 GB user address space, also referred to as user mode address space or ring 3, available for use by a program; and, a high 2 GB system address space, also referred to as kernel mode address space or ring 0, reserved for use by the operating system.
In Windows® NT and Windows® 2000, memory is divided into equal portions termed pages. For example, on 32-bit Intel architectures, also known as IA32, pages are 4 KB in size, whereas Windows® 2000 on an Alpha CPU would use 8 KB pages.
FIG. 2 is a block diagram of a kernel address space 200 of memory 114 of host computer system 102 of client-server system 100 of FIG. 1 in accordance with one embodiment of the present invention. Referring now to FIGS. 1 and 2 together, kernel address space 200, e.g., the upper 2 GB of memory 114, is divided into a paged pool 202 and a non-paged pool 204.
Paged pool 202 includes pages, e.g., 4096 byte memory areas, that are paged. As is well known to those of skill in the art, in a page-based virtual memory system, the hard disk of the computer system is used to store unneeded pages in physical memory in one or more files, e.g., called pagefiles. Pagefiles represent pages of content, e.g., data, that are not currently being used, but may be needed spontaneously at anytime. By swapping pages to and from pagefiles, e.g., by moving content from physical memory to the hard disk and vice versa, pages of memory are made available to applications on demand. Accordingly, much more virtual memory is provided to an application than the available physical memory. One example of physical memory is random access memory (RAM), sometimes called nonpersistent memory.
Thus, paged pool 202 is the pool, sometimes called collection, of pages that can be paged, i.e., swapped to and from pagefiles. Conversely, non-paged pool 204 is the pool, sometimes called collection, of pages that are not paged, i.e., not swapped to and from pagefiles. Stated another way, non-paged pool 204 is the pool of pages that must remain in physical memory.
In one embodiment, anything in the kernel address space, e.g., drivers, can declare itself either paged or non-paged. Drivers thus use paged pool 202 and non-paged pool 204 for dynamic memory allocation in accordance with this embodiment.
In accordance with one embodiment, the operating system is queried to determine the starting address of non-paged pool 204, i.e., where non-paged pool 204 starts, and the size of non-paged pool 204, using any one of a number of techniques depending upon the particular operating system. For example, the operating system calculates the partitioning of paged pool 202 and non-paged pool 204 depending upon the physical memory size and this information is queried. In another example, the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
contains the values “PagedPoolSize”, “NonPagedPoolSize”. These values allow a user to set specific allocation for paged pool 202 and non-paged pool 204.
Within non-paged pool 204 are used pages 206 and unused pages 208. Used pages 206 are pages that are in use, e.g., that have a page table entry with a valid physical page address and are marked as present. For example, used pages 206 contain content, e.g., drivers, that is being used. Although used pages 206 are illustrated as a single contiguous block in FIG. 2 for simplicity of illustration, it is to be understood that typically used pages 206 are not all contiguous, but are distributed within non-paged pool 204.
Within used pages 206 are page tables 210. Page tables 210 include page table entries, a first page table entry 212 being illustrated. A page table entry identifies the location of a page associated with the page table entry, the page's protection, the page's backing pagefile, and the state of the page.
To illustrate, the first five, i.e., the five most significant, bits of page table entry 212 are protection bits 214. Protection bits 214 are dedicated to page protection for the page associated with page table entry 212, the page sometimes being called a page table entry page.
The next 20 bits following protection bits 214 of page table entry 212 are physical page address bits 216. If the page associate with page table entry 212 is resident in physical memory, the value within physical page address bits 216 represents the physical page address of the page in physical memory. If the page associated with page table entry 212 is paged to the hard disk, the value within physical page address bits 216 represents the offset into the appropriate pagefile to locate the page.
Generally, if there is a non-zero value, sometimes called a valid physical page address, within physical page address bits 216, the page associated with page table entry 212 is assigned. In one embodiment, a page is assigned if the virtual address of the page is mapped to a physical page address in physical memory or to a pagefile on the hard disk. Conversely, if the value within physical page address bits 216 is zero, i.e., all 20 bits of physical page address bits 216 contain a zero, sometimes called an invalid physical page address, the page is unassigned. A page is unassigned if the virtual address of the page is not mapped to a physical page address in physical memory or to a pagefile on the hard disk.
The next four bits following physical page address bits 216 of page table entry 212 are pagefile bits 218. Pagefile bits 218 are used to indicate which pagefile backs the page associated with page table entry 212.
The final three bits, i.e., the three least significant bits, of page table entry 212 are state bits 220. The value within state bits 220 indicates the state of the page associated with page table entry 212 The least significant bit of state bits 220 is a present bit 222. The value within present bit 222 determines whether the page associated with page table entry 212 is present or not. In one embodiment, a page is present if it is a valid page, e.g., a legitimate page that may or may not contain content. For example, a page is present if the value within present bit 222 is a one (1). Conversely, a page is not present if it is an invalid page, e.g., not a valid page. For example, a page is not present if the value within present bit 222 is a zero (0).
Although page tables 210 are illustrated as being in non-paged pool 204, in another embodiment, page tables 210 are in paged pool 202 or are distributed between paged pool 202 and non-paged pool 204 depending upon the particular operating system.
Unused pages 208 are pages that are not in use, e.g., that have a page table entry with an invalid physical page address or are marked as not present. For example, unused pages 208 do not, or at least should not, contain content or are otherwise unused. Although unused pages 208 are illustrated as a single contiguous block in FIG. 2 for simplicity of illustration, it is to be understood that typically unused pages 208 are not all contiguous, but are distributed within non-paged pool 204.
Unused pages 208 include unassigned pages 224 and not present pages 226. Unassigned pages 224 are pages that have not been assigned. Further, not present pages 226 are pages that are not present. Although unused pages 208, unassigned pages 224, and not present pages 226 are illustrated as single contiguous blocks in FIG. 2 for simplicity of illustration, it is to be understood that typically unused pages 208, unassigned pages 224, and not present pages 226 are not all contiguous, but are distributed within non-paged pool 204.
In one embodiment, processor 108 of host computer system 102 includes a translation lookaside buffer (TLB) 228. Translation lookaside buffer 228, sometimes called an internal or on-chip cache, is a buffer that is used to access the location of a physical address. Specifically, translation lookaside buffer 228 is used to provide a direct connection, sometimes called mapping or translation, between frequently used virtual addresses and their corresponding physical page addresses. Using translation lookaside buffer 228, i.e., a hardware component, to translate a virtual address is much faster than using both the page directory and page tables to translate the virtual address using software.
Each entry in translation lookaside buffer 228 includes a virtual address and a corresponding page table entry to identify the page associated with the virtual address. Each time a virtual address is translated to a physical page address, an entry is added to translation lookaside buffer 228, the entry including the translated virtual address and the associated page table entry.
The manufacturer of CPU 108 provides the algorithms for the order in which entries are flushed, sometimes called invalidated, from translation lookaside buffer 228. In one example, an entry in translation lookaside buffer 228 is marked to be persistent in translation lookaside buffer 228, i.e., to never be flushed from translation lookaside buffer 228, absent an explicit instruction to do so.
For example, in Intel's Pentium pro processor, the page global enable (PGE) flag in register CR4 and the global (G) flag of a page-directory or page-table entry (bit 8) can be used to prevent an entry in translation lookaside buffer 228 from being flushed. The page global enable (PGE) flag is described in IA-32 Intel® Architecture Software Developer's Manual, Volume 3: System Programming Guide, June 2005, page 3-47, which is herein incorporated by reference in its entirety.
However, malicious code can access a page in which the malicious code is located such that an entry corresponding to the page in which the malicious code is located is added to translation lookaside buffer 228. Further, malicious code marks the entry in translation lookaside buffer 228 associated with the page in which the malicious code is located to be persistent, such that the entry is not flushed from translation lookaside buffer 228. Next, the malicious code marks the page in the associated page table entry as being not present. Any conventional memory scanner thus relying upon page tables 210 to determine which pages should be scanned will not scan the page in which the malicious code is located as the page is marked as not present, and thus would not contain valid content under normal circumstances. In one embodiment, malicious code is any computer program, module, set of modules, or code that enters a computer system environment without an authorized user's knowledge and/or without an authorized user's consent.
To illustrate, a page 230 in which malicious code 232 is located is accessed. This causes an entry to be added to translation lookaside buffer 228, the entry translating the virtual address of page 230 to the physical page address of page 230. Malicious code then marks the page table entry associated with page 230 in page tables 210 to indicate that page 230 is not present. Thus, page 230 is not indicated in page tables 210 as being in used pages 206. However, page 230 can still be accessed using translation lookaside buffer 228 to translate the virtual address of page 230 to the corresponding physical page address.
FIG. 3 is a flow diagram of a translation lookaside buffer (TLB) flush operation 300 in accordance with one embodiment of the present invention. Referring now to FIG. 3, from an ENTER OPERATION 302, flow moves to a DETERMINE NON-PAGED POOL UNUSED PAGES OPERATION 304. In DETERMINE NON-PAGED POOL UNUSED PAGES OPERATION 304, the non-paged pool unused pages are determined. The non-paged pool unused pages are the subset of unused pages in the non-paged pool, e.g., unused pages 208 in non-paged pool 204.
For example, the non-paged pool, e.g., non-paged pool 204, is determined. Illustratively, the starting virtual address of non-paged pool 204, and, optionally, the size of non-paged pool 204, are determined as described above.
The page table entries associated with the pages within non-paged pool 204 are then queried, sometimes called inspected, to determine whether the pages are used pages, e.g. used pages 206, or unused pages, e.g., unused pages 208. For example, if the page table entry contains a valid physical page address and the page is marked as present as discussed above, the page is within used pages 206. Conversely, if the page table entry contains an invalid physical page address or the page is marked as not present as discussed above, the page is within unused pages 208.
From DETERMINE NON-PAGED POOL UNUSED PAGES OPERATION 304, flow moves to a SELECT SUBSET OF NON-PAGED POOL UNUSED PAGES OPERATION 306. In SELECT SUBSET OF NON-PAGED POOL UNUSED PAGES OPERATION 306, a subset of the non-paged pool unused pages determined in DETERMINE NON-PAGED POOL UNUSED PAGES OPERATION 304 is selected. Any one of a number of techniques can be used to select the subset. For example, in one embodiment, pages within the non-paged pool unused pages are randomly selected. In another example, pages within the non-paged pool unused pages are deterministically selected, i.e., nonrandomly, for example, in a linear fashion.
From SELECT SUBSET OF NON-PAGED POOL UNUSED PAGES OPERATION 306, flow moves to a FLUSH SUBSET FROM TRANSLATION LOOKASIDE BUFFER OPERATION 308. In FLUSH SUBSET FROM TRANSLATION LOOKASIDE BUFFER OPERATION 308, the subset selected in SELECT SUBSET OF NON-PAGED POOL UNUSED PAGES OPERATION 306 is flushed from the translation lookaside buffer. More particularly, if there are any translation lookaside buffer entries corresponding to the pages selected from the non-paged pool unused pages, the entries are flushed, i.e., removed or invalidated, from the translation lookaside buffer. Thus, it is to be understood that flushing of a page from the translation lookaside buffer means to flush the translation lookaside buffer entry that maps the virtual address of the page from the translation lookaside buffer.
In one embodiment, the INVLPG instruction with the exact addresses of the subset is used to flush the subset of non-paged pool unused pages from the translation lookaside buffer. The INVLPG instruction is described in IA-32 Intel® Architecture Software developers manual, Volume 2A: Instruction set reference, A-M, June 2005, page 3-473, herein incorporated by reference in its entirety.
As discussed above, non-paged pool unused pages would not contain valid content under ordinary circumstances. Accordingly, flushing non-paged pool unused pages from the translation lookaside buffer should not result in any adverse consequences such as a performance penalty in one embodiment. However, to avoid any unwanted or unforeseen consequences such as a performance penalty, only a subset, i.e., not all, of the non-paged pool unused pages are flushed at any one time.
From FLUSH SUBSET FROM TRANSLATION LOOKASIDE BUFFER OPERATION 308, flow moves to an ADDITIONAL FLUSHES CHECK OPERATION 310. In ADDITIONAL FLUSHES CHECK OPERATION 310, a determination is made as to whether additional flushes of the translation lookaside buffer should be performed, e.g., are necessary.
If a determination is made that no additional flushes are necessary, flow moves to an EXIT OPERATION 312.
Conversely, if a determination is made that an additional flush is necessary, flow returns from ADDITIONAL FLUSHES CHECK OPERATION 310 to DETERMINE NON-PAGED POOL UNUSED PAGES OPERATION 304. In accordance with this embodiment, OPERATIONS 304, 306, 308, and 310 are repeated until a determination is made that no additional flushes are necessary in ADDITIONAL FLUSHES CHECK OPERATION 310, and flow moves to and exits at EXIT OPERATION 312. By repeatedly performing OPERATIONS 304, 306, and 308, the entire set of entries associated with the non-paged pool unused pages are flushed from the translation lookaside buffer.
FIG. 4 is a flow diagram of a malicious code detection operation 400 in accordance with one embodiment of the present invention. Referring now to FIGS. 2 and 4 together, from an ENTER OPERATION 402, flow moves to a HOOK PAGE FAULT HANDLER OPERATION 404. In HOOK PAGE FAULT HANDLER OPERATION 404, the page fault handler, e.g., an exception handler, is hooked. More particularly, a page fault is an interrupt (or exception) raised by the hardware, e.g., CPU 108, when a program accesses a page that is not mapped in physical memory. A page fault handler is a function that trys to handle the page fault by making the page accessible at a location in physical memory or terminating the program in case it is an illegal access.
Hooking is accomplished according to a variety of techniques, as is well known in the art. To illustrate, the page fault handler is hooked to facilitate interception of invocation of, e.g., calls to, the page fault handler. In one embodiment, the page fault handler is hooked by inserting a jump instruction directly into the page fault handler.
As is well known to those of skill in the art, a system service table, sometimes called a dispatch table or a system call table, relates system calls to specific addresses within an operating system kernel. In one embodiment, a hooked system service table redirects calls to the page fault handler. For example, the hooked system service table redirects page fault handler calls to a module of malicious code detection application 106 instead of directing the call to the page fault handler.
From HOOK PAGE FAULT HANDLER OPERATION 404, flow moves to a PAGE FAULT CHECK OPERATION 406. In PAGE FAULT CHECK OPERATION 406, a determination is made as to whether a page fault has occurred. Illustratively, a page fault has occurred and an attempt to invoke, e.g., a call to, the page fault handler is detected as discussed above.
Illustratively, paying particular attention to FIG. 2, an attempt to access page 230 containing malicious code 232 is made. Performance of translation lookaside buffer flush operation 300 of FIG. 3 as described above has flushed the entry from translation lookaside buffer 228 which mapped the virtual address to the physical page address of page 230. Further, as discussed above, the page table entry in page tables 210 associated with page 230 indicates that page 230 is not present. Thus, a page fault is raised and this page fault is detected in PAGE FAULT CHECK OPERATION 406. Generally, the page fault handler is hooked in HOOK PAGE FAULT HANDLER OPERATION 404 to facilitate detection of the page fault in PAGE FAULT CHECK OPERATION 406.
Paying particular attention to FIG. 4, if a determination is made that a page fault has not occurred in PAGE FAULT CHECK OPERATION 406, flow returns (remains) at PAGE FAULT CHECK OPERATION 406. Conversely, if a determination is made that a page fault has occurred in PAGE FAULT CHECK OPERATION 406, flow moves to a PAGE WITHIN NON-PAGED POOL UNUSED PAGES CHECK OPERATION 408.
In PAGE WITHIN NON-PAGED POOL UNUSED PAGES CHECK OPERATION 408, a determination is made as to whether the page associated with the page fault is within the non-paged pool unused pages. For example, the virtual address of the page associated with the page fault is compared to the virtual addresses of the non-paged pool unused pages. If a match occurs with any of the virtual addresses of the non-paged pool unused pages, a determination is made that the page is within the non-paged pool unused pages. Conversely, if a match does not occur, a determination is made that the page is not within the non-paged pool unused pages.
If a determination is made that the page associated with the page fault is not within the non-paged pool unused pages, flow moves to and exits at an EXIT OPERATION 410 or returns to PAGE FAULT CHECK OPERATION 406 and awaits the next page fault. In this case, the page fault is not associated with malicious code within the non-paged pool unused pages.
Conversely, if a determination is made that the page associated with the page fault is within the non-paged pool unused pages, flow moves to a PAGE UNASSIGNED CHECK OPERATION 412. To illustrate, paying particular attention again to FIG. 2, a determination is made that page 230 associated with the page fault is within unused pages 208 of non-paged pool 204.
Paying particular attention to FIG. 4, in PAGE UNASSIGNED CHECK OPERATION 412, a determination is made as to whether the page associated with the page fault is an unassigned page. For example, the virtual address of the page associated with the page fault is compared to the virtual addresses of the unassigned pages of the non-paged pool unused pages. If a match occurs with any of the virtual addresses of the unassigned pages, a determination is made that the page is unassigned. Conversely, if a match does not occur, a determination is made that the page is not unassigned, sometimes called assigned.
If a determination is made that the page associated with the page fault is unassigned, flow moves to and exits at EXIT OPERATION 410 or returns to PAGE FAULT CHECK OPERATION 406. In this case, because the page is unassigned, a physical page address for the page attempting to be accessed is unobtainable, i.e., it is not readily possible to determine which page is attempting to be accessed. Accordingly, flow exits at EXIT OPERATION 410 or returns to PAGE FAULT CHECK OPERATION 406 and awaits the next page fault.
Conversely, if a determination is made that the page associated with the page fault is not unassigned, i.e., is a not present page, flow moves to a SCAN PAGE FOR MALICIOUS CODE OPERATION 414. In this case, the page associated with the page fault is available, although it is marked as not present. To illustrate, referring again to FIG. 2, a determination is made that page 230 is not within unassigned pages 224, i.e., is within not present pages 226.
Referring again to FIG. 4, in SCAN PAGE FOR MALICIOUS CODE OPERATION 414, the page is scanned for malicious code. Illustratively, the page is scanned for known malicious code signatures, heuristically or otherwise. To illustrate, paying particular attention again to FIG. 2, page 230 is scanned.
Referring again to FIG. 4, from SCAN PAGE FOR MALICIOUS CODE OPERATION 414, flow moves to a PAGE CONTAINS MALICIOUS CODE CHECK OPERATION 416. In PAGE CONTAINS MALICIOUS CODE CHECK OPERATION 416, a determination is made as to whether the page contains malicious code based on the scan of the page performed in SCAN PAGE FOR MALICIOUS CODE OPERATION 414.
If a determination is made that the page does not contain malicious code, flow moves from PAGE CONTAINS MALICIOUS CODE CHECK OPERATION 416 and exits at EXIT OPERATION 410 or returns to PAGE FAULT CHECK OPERATION 406 and awaits the next page fault. In this event, the page attempting to be accessed does not contain malicious code and thus flow exits at EXIT OPERATION 410 or returns to PAGE FAULT CHECK OPERATION 406.
Conversely, if a determination is made that the page contains malicious code, flow moves from PAGE CONTAINS MALICIOUS CODE CHECK OPERATION 416 to a TAKE PROTECTIVE ACTION OPERATION 418. Paying particular attention to FIG. 2, a determination is made that page 230 contains malicious code 232 in PAGE CONTAINS MALICIOUS CODE CHECK OPERATION 416, and thus flow moves to TAKE PROTECTIVE ACTION OPERATION 418.
In TAKE PROTECTIVE ACTION OPERATION 418, protective action is taken to protect the host computer system from the malicious code. Illustratively, the malicious code is prevented from being executed or accessed. The malicious code is quarantined or deleted in one embodiment. The program attempting to access the malicious code containing page is terminated in one embodiment. Although various examples are provided, other protective actions can be taken depending on the particular implementation. In one embodiment, the user of the host computer system is asked for permission prior to taking protective action. To illustrate, referring again to FIG. 2, malicious code 232 is deleted.
From TAKE PROTECTIVE ACTION OPERATION 418, flow moves optionally to a NOTIFY OPERATION 420 (or to EXIT OPERATION 410/PAGE FAULT CHECK OPERATION 406 if NOTIFY OPERATION 420 is not performed). In optional NOTIFY OPERATION 420, the user of host computer system 102 (FIG. 1), and/or a system administrator of the network, e.g., network 124, are notified of a malicious code detection on host computer system 102. In one embodiment, a record or error message is generated and provided to the user and/or system administrator. In one embodiment, the notification identifies the particular malicious code and/or any protective action taken.
The user and/or administrator are notified using any one of a number of techniques, e.g., by using a pop up window, by generating an e-mail, by writing to a file and/or otherwise by logging the event. Further, in one embodiment, a notification is provided to a security center. From optional NOTIFY OPERATION 420, processing transitions to EXIT OPERATION 410, or returns to PAGE FAULT CHECK OPERATION 406 and awaits the next page fault.
Accordingly, an attempt to access malicious code within a not present page within the non-paged pool unused pages is made, e.g., by malicious code. Performance of translation lookaside buffer flush operation 300 of FIG. 3 as described above has flushed the entry, which mapped the virtual address to the physical page address of the page, from the translation lookaside buffer. Further, the page table entry associated with the page indicates that the page is not present.
Referring again to FIG. 1, although malicious code detection application 106 is referred to as an application, this is illustrative only. Malicious code detection application 106 should be capable of being called from an application or the operating system. In one embodiment, an application is generally defined to be any executable code. Moreover, those of skill in the art will understand that when it is said that an application or an operation takes some action, the action is the result of executing one or more instructions by a processor.
While embodiments in accordance with the present invention have been described for a client-server configuration, an embodiment of the present invention is carried out using any suitable hardware configuration or means involving a personal computer, a workstation, a portable device, or a network of computer devices. Other network configurations other than client-server configurations, e.g., peer-to-peer, web-based, intranet, and internet network configurations, are used in other embodiments.
As illustrated in FIG. 1, this medium belongs to the computer system itself. However, the medium is also removed from the computer system. For example, malicious code detection application 106 is stored in memory that is physically located in a location different from processor 108, e.g., memory 136 of server system 130. Processor 108 should be coupled to the memory 136. This could be accomplished in a client-server system, or alternatively via a connection to another computer via modems and analog lines, or digital interfaces and a digital carrier line.
More specifically, in one embodiment, host computer system 102 and/or server system 130 is a portable computer, a workstation, a two-way pager, a cellular telephone, a digital wireless telephone, a personal digital assistant, a server computer, an Internet appliance, or any other device that includes components that execute malicious code detection application 106 in accordance with at least one of the embodiments as described herein. Similarly, in another embodiment, host computer system 102 and/or server system 130 is comprised of multiple different computers, wireless devices, cellular telephones, digital telephones, two-way pagers, personal digital assistants, server computers, or any desired combination of these devices that are interconnected to perform the methods as described herein.
In view of this disclosure, malicious code detection application 106 in accordance with one embodiment of the present invention can be implemented in a wide variety of computer system configurations. In addition, malicious code detection application 106 could be stored as different modules in memories of different devices. For example, malicious code detection application 106 could initially be stored in server system 130, and as necessary, a portion of malicious code detection application 106 could be transferred to host computer system 102 and executed on host computer system 102. Consequently, part of the malicious code detection functionality would be executed on processor 134 of server system 130, and another part would be executed on processor 108 of host computer system 102. In view of this disclosure, those of skill in the art can implement various embodiments of the present invention in a wide variety of physical hardware configurations using an operating system and computer programming language of interest to the user.
In yet another embodiment, malicious code detection application 106 is stored in memory 136 of server system 130. Malicious code detection application 106 is transferred over network 124 to memory 114 in host computer system 102. In this embodiment, network interface 138 and I/O interface 110 would include analog modems, digital modems, or a network interface card. If modems are used, network 124 includes a communications network, and malicious code detection application 106 is downloaded via the communications network.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS6594734 *Dec 20, 1999Jul 15, 2003Intel CorporationMethod and apparatus for self modifying code detection using a translation lookaside bufferUS6745306 *Mar 7, 2000Jun 1, 2004Microsoft CorporationMethod and system for restricting the load of physical address translations of virtual addressesUS7328453 *May 9, 2002Feb 5, 2008Ecd Systems, Inc.Systems and methods for the prevention of unauthorized use and manipulation of digital contentUS7334722 *Feb 14, 2005Feb 26, 2008Symantec CorporationScan-on-readUS20030014667 *Jul 16, 2001Jan 16, 2003Andrei KolichtchakBuffer overflow attack detection and suppression* Cited by examinerNon-Patent CitationsReference1IA-32 Intel® Architecture Software developers manual, vol. 2A: Instruction set reference, A-M, Jun. 2005, p. 3-473.2IA-32 Intel® Architecture Software Developer's Manual, vol. 3: System Programming Guide, Jun. 2005, p. 3-47.3Kath, R., "The Virtual-Memory Manager in Windows NT", pp. 1-13 [online]. Retrieved on Nov. 12, 2005. Retrieved from the Internet: .4Kath, R., "The Virtual-Memory Manager in Windows NT", pp. 1-13 [online]. Retrieved on Nov. 12, 2005. Retrieved from the Internet: <URL:http://msdn.microsoft.com/library/en-us/dngenlib/html/msdn—ntvmm.asp?frame=true>.Referenced byCiting PatentFiling datePublication dateApplicantTitleUS8448165 *Sep 15, 2009May 21, 2013Symantec CorporationSystem and method for logging operations of virtual machinesUS8479295Mar 30, 2011Jul 2, 2013Intel CorporationMethod and apparatus for transparently instrumenting an application programUS8560862 *Dec 17, 2009Oct 15, 2013Fortinet, Inc.Efficient data transfer in a virus co-processing systemUS8584242 *Jul 12, 2011Nov 12, 2013At&T Intellectual Property I, L.P.Remote-assisted malware detectionUS8646083Aug 6, 2012Feb 4, 2014Fortinet, Inc.Virus co-processor instructions and methods for using suchUS8819830Dec 30, 2013Aug 26, 2014Fortinet, Inc.Virus co-processor instructions and methods for using suchUS8839439Feb 7, 2013Sep 16, 2014Fortinet, Inc.Operation of a dual instruction pipe virus co-processorUS9075913 *Feb 27, 2012Jul 7, 2015Qualcomm IncorporatedValidation of applications for graphics processing unitUS9355251Sep 20, 2013May 31, 2016Fortinet, Inc.Efficient data transfer in a virus co-processing systemUS9411960Dec 14, 2015Aug 9, 2016Fortinet, Inc.Virus co-processor instructions and methods for using suchUS9460287Jun 9, 2015Oct 4, 2016Fortinet, Inc.Efficient data transfer in a virus co-processing systemUS20130227521 *Feb 27, 2012Aug 29, 2013Qualcomm IncorporatedValidation of applications for graphics processing unitCN104137076A *Jan 30, 2013Nov 5, 2014高通股份有限公司Validation of applications for graphics processing unitWO2012134584A1 *Dec 29, 2011Oct 4, 2012Intel CorporationMethod and apparatus for transparently instrumenting an application program* Cited by examinerClassifications U.S. Classification726/24, 726/26, 726/22International ClassificationG06F12/14Cooperative ClassificationG06F12/1027, G06F21/562, G06F12/145European ClassificationG06F21/56BLegal EventsDateCodeEventDescriptionFeb 21, 2006ASAssignmentFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:FERRIE, PETER;REEL/FRAME:017857/0579Owner name: SYMANTEC CORPORATION, CALIFORNIAEffective date: 20060220Feb 28, 2014FPAYFee paymentYear of fee payment: 4RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services


text:
Revision as of 23:07, 8 August 2013 (view source)Jlandmeier (talk | contribs)← Older edit
Revision as of 23:39, 8 August 2013 (view source) Ccsmith (talk | contribs) m (→Center Contacts and Hours)Newer edit →
'''Location & Map:''' '''Location & Map:''' −#785 N. San Antonio Ave, Upland, CA +*'''Address''': 785 N. San Antonio Ave, Upland, CA −#When coming to the center, enter on the southwest corner.  There is a button to press and allow entry.  Please look at the camera over the button so staff members can identify you. +*When coming to the center, enter on the southwest corner.  There is a button to press and allow entry.  Please look at the camera over the button so staff members can identify you. −#''(Link to map using ''[http://maps.google.com Google]'' or other map sites)''+*[https://www.google.com/maps/preview?hl=en#!q=785+N+San+Antonio+Ave%2C+Upland%2C+CA&data=!1m4!1m3!1d31626!2d-117.661584!3d34.10249!4m11!1m10!2i35!4m8!1m3!1d52058!2d-122.8938686!3d47.0393335!3m2!1i1413!2i919!4f13.1 Location on Google Map]
'''Phone: (909) 985-8821''' '''Phone: (909) 985-8821''' Revision as of 23:39, 8 August 2013
Anyone interested in serving should email the director at the email address above. This Family History Center article is a stub. You can help by expanding it. Review the instructions and guidelines for FHC pages.
Retrieved from "https://familysearch.org/wiki/en/index.php?title=Upland_California_Family_History_Center&oldid=1421476"	Category: California Family History CentersHidden category: Family History Center stubs	Navigation menu

type: global

value: This website is a nonprofit organization and website offering genealogical records, education, and software. It is operated by The Church of Jesus Christ of Latter-day Saints , and is closely connected with the church's Family History Department.


text:
Words that end in glamoring | Words ending in glamoring
Words that end in glamoring | Words ending in glamoring http://www.thefreedictionary.com/words-that-end-in-glamoringPrinter Friendly
9,437,110,628 visitors served
Words that end in glamoring
Found 1 words that end in glamoring. Browse our Scrabble Word Finder, Words With Friends cheat dictionary, and WordHub word solver to find words that end with glamoring. Or use our Unscramble word solver to find your best possible play! Related: Words containing glamoring
11-letter words that end in glamoringSee also11-letter words that end in glamoringbeglamoringSee also:2-letter wordsWords that start with xWords that start with mWords that start with bWords that end in iWords that end in vWords that end in eglamoringWords that end in lamoring

value: This website is an American online dictionary and encyclopedia that aggregates information from various sources.


text:
Phone: (860) 693-6981
Fax: (860) 693-1537
75 Albany Tpke,
Request a Quote from Acura of Avon
File a Complaint against Acura of Avon
See Trends in Complaints on Acura of Avon
| View Complaints Summary by Type Pie Chart on Acura of Avon
Acura of Avon.
Acura of Avon's advertising at this time.
Customer Contact: Mr. James Tucker, General Manager

value: This website is a private, nonprofit organization whose self-described mission is to focus on advancing marketplace trust, consisting of 106 independently incorporated local BBB organizations in the United States and Canada, coordinated under the International Association of Better Business Bureaus  in Arlington, Virginia.The Better Business Bureau is not affiliated with any governmental agency. Businesses that affiliate with the BBB and adhere to its standards do so through industry self-regulation.


text:
LOGITECH, INC. M185 Wireless Mouse LOG910002225: Computers : Walmart.com Track Order Please complete both fields.
Show this number I137060024987 to a Walmart associate
** Free Shipping ** Simple and reliable mouse is contoured for comfort. Features 2.4GHz wireless technology with virtually no delays or dropouts. The on/off switch and smart sleep mode help the battery last up to one year. Nano receiver stays in your USB port for safe-keeping. Connector/Port/Interface: Nano Receiver Left/Right Hand Use: Left/Right.LOG910002225. 910002225. LOGITECH, INC. LOGITECH, INC. M185 Wireless Mouse. MiceConnector/port/interface: Nano ReceiverLeft/right Hand Use: Left/RightWired/wireless: WirelessColors: BlackOperating System Compatibility: Windows XP, Vista, 7Frequency: 2.4 GHzBatteries Required: YesType Of Batteries Required: 1 AABatteries Included: YesSize: 3 1/2"w x 5 9/10" d x 8 1/4" hPre-consumer Recycled Content Percent: 0%Post-consumer Recycled Content Percent: 0%Total Recycled Content Percent: 0%

value: This website is an American multinational retail corporation that operates a chain of hypermarkets , discount department stores, and grocery stores from the United States, headquartered in Bentonville, Arkansas.


text:
AtoM and Vagrant: Installing and Configuring the AtoM Vagrant Box for…
AtoM and Vagrant: Installing and Configuring the AtoM Vagrant Box for Local Testing and Development
Introducing Access to Memory by Artefactual Syste... 919 views
AtoM, Authenticity, and the Chain o... by Artefactual Syste... 630 views
An Introduction to AtoM, Archivemat... by Artefactual Syste... 2211 views
National Archives of Norway - AtoM ... by Artefactual Syste... 295 views
Artefactual and Open Source Develop... by Artefactual Syste... 152 views
AtoM and Archivematica Use Cases by Artefactual Syste... 342 views
These slides introduce AtoM users to Vagrant, and walk users through the process of installing the the AtoM Vagrant box for local testing and development on a home computer or laptop, regardless of what operating system you use.
These slides were last updated in May 2017, using the AtoM 2.4 Vagrant box, which is installed using Ubuntu 16.04. and PHP 7.0. Future versions of AtoM may use a different version of Ubuntu and PHP, which might change some of the command-line tasks used to update the box in Part 2. Be sure to check the AtoM documentation for the most up-to-date information: https://www.accesstomemory.org/docs/latest/
The AtoM Vagrant box is designed for local testing and development - it is NOT PRODUCTION READY and should not be used for long-term data storage. Please see the AtoM documentation for instructions on how to install AtoM on a server for use in your institution.
1. AtoM and VagrantINSTALLING AND CONFIGURING THE ATOM VAGRANT BOX FOR LOCAL TESTING AND DEVELOPMENT
2. What is Vagrant? Vagrant is a tool for building complete development environments. With an easy-to-use workflow and focus on automation, Vagrant lowers development environment setup time, increases development / production parity, and makes the "works on my machine" excuse a relic of the past. Vagrant was started in January 2010 by Mitchell Hashimoto. https://www.vagrantup.com/about.html Vagrant remains and always will be a liberally licensed open source project. Each release of Vagrant is the work of hundreds of individuals' contributions to the open source project.
3. What is VirtualBox? VirtualBox is an open source, cross-platform virtualization application. When we describe VirtualBox as a "virtualization" product, we refer to "full virtualization", that is, the particular kind of virtualization that allows an unmodified operating system with all of its installed software to run in a special environment, on top of your existing operating system. This environment, called a "virtual machine", is created by the virtualization software by intercepting access to certain hardware components and certain features. The physical computer is then usually called the "host", while the virtual machine is often called a "guest". Most of the guest code runs unmodified, directly on the host computer, and the guest operating system "thinks" it's running on a real machine. https://www.virtualbox.org/wiki/Virtualization
4. The AtoM Vagrant Box AtoM and all of its dependencies…. Are packaged as a Vagrant box… Which is run by VirtualBox as a virtual machine… And accessed via SSH and/or a web browser.
5. Installing the Atom Vagrant Box Step 1: Download and Install VirtualBox • https://www.virtualbox.org/ Step 2: Download and Install Vagrant • https://www.vagrantup.com/
6. Installing the Atom Vagrant Box Step 3: open your command line interface Applications/Utilities/Terminal Search for “cmd” and hit enter CTRL + ALT + T
7. Installing the Atom Vagrant Box Step 4: make a new directory on your desktop and then change directories into it > cd Desktop > mkdir vagrant-2.4 > cd vagrant-2.4 > cd Desktop > mkdir vagrant-2.4 > cd vagrant-2.4 > cd ~/Desktop > mkdir vagrant-2.4 > cd vagrant-2.4
8. Installing the Atom Vagrant Box Step 5: Initialize the directory to be a Vagrant environment > vagrant init artefactual/atom Step 6: Run Vagrant! > vagrant up
9. And Now an Intermission for our Windows Users… (Mac and Linux users, feel free to skip ahead a couple slides) http://wgnradio.com/2013/01/29/lets-all-go-to-the-lobby/comment-page-1/
10. SSH, Vagrant, and Windows What is SSH? SSH stands for Secure SHell. It is a secure way of connecting to a remote computer or server using encryption to protect the connection. To connect to the guest O/S (the Vagrant box – the virtual machine you are running) from the Host (your computer), we use SSH. Linux and Mac support an SSH client natively, but Windows does not – so we need to install an SSH client to access the AtoM Vagrant box’s command-line interface. Our preferred Windows SSH client is PuTTY. Step A: Download and Install PuTTY • http://www.putty.org/ • Follow the link to the Downloads page
11. SSH, Vagrant, and Windows Step B: Launch PuTTY and Configure it for Vagrant access • Host Name: 10.10.10.10 • Port: 22 In the “Saved Sessions” field, give this configuration a name so you can reuse it (e.g. AtoM Vagrant Box), then click “Save.”
12. SSH, Vagrant, and Windows Step B: Launch PuTTY and Configure it for Vagrant access In the options on the side, click “Translation” under the Window heading. Select UTF-8 as the Remote character set. In the menu, click the top link, “Session”, to return to the main page. Remember to click “Save” to preserve these settings.
13. SSH, Vagrant, and Windows Step C: Launch the PuTTY SSH terminal! On the main PuTTY page, click on your saved Vagrant settings and then click the “Open” button PuTTY will open a terminal so you can connect to the Vagrant box REMEMBER: you must already have run “vagrant up” via the Windows command-line interface for the connection to work.
14. SSH, Vagrant, and Mac/Linux To access the Vagrant box, enter the following command: REMEMBER: you must already have run “vagrant up” for the connection to work. > vagrant ssh
15. If You Are Prompted for a Password Both the username and the password for the AtoM vagrant box are: vagrant • Username: vagrant • Password: vagrant Now you’re almost ready to start using AtoM!
16. Open Your Web Browser Enter the following address to access your local AtoM site: 10.10.10.10 Log in credentials: • User: demo@example.com • Pass: demo
17. Part 2: Updating the Vagrant Box with the Latest Atom Code Because the AtoM Vagrant box is targeted in part to developers, it follows our latest development branch. Currently (March 2017), that is the qa/2.4.x development branch in our GitHub code repository. The AtoM Vagrant box will not automatically keep up to date with the latest AtoM development – meaning all the newest features and bug fixes are not currently included! We strongly recommend you update your Vagrant box before using it. We’ll do this by running some commands in our Vagrant terminal. The AtoM public code repository on GitHub Read more about the AtoM code repository on our wiki: • https://wiki.accesstomemory.org/Resources/Code_repository See our public code repository on GitHub: • https://github.com/artefactual/atom/
18. Updating the Vagrant Box with the Latest Atom Code Step 1: Navigate to the atom directory from the root vagrant directory > cd atom Step 2: Pull in the latest AtoM code > git pull --rebase
19. Updating the Vagrant Box with the Latest Atom Code Step 3: Purge the current database and run the SQL upgrade task > php symfony tools:purge --demo > php symfony tools:upgrade-sql WHY? There have been changes to the database since the 2.3 release. The first task will purge the current database and then re-add the demo user (so you can log into the user interface), and the second task will run a task to upgrade the MySQL database to the latest schema version.
20. Updating the Vagrant Box with the Latest Atom Code Step 3: Clear the application cache and restart all services Clear the application cache: > php symfony cc Restart the webserver (NGINX): > sudo systemctl reload nginx Restart PHP-FPM: > sudo systemctl restart php7.0-fpm Restart the memory caching engine (memcached): > sudo systemctl memcached restart
21. Updating the Vagrant Box with the Latest Atom Code Step 4: Rebuild the theme and repopulate the search index Rebuild the base (Dominion) theme CSS: > make –C plugins/arDominionPlugin Repopulate the search index: > php symfony search:populate Congratulations! Your AtoM Vagrant box should now be up to date! “Don't make me laugh..!!!” by DigiTaL~NomAd https://www.flickr.com/photos/urban-spaceman/3682523624
22. Shutting Down Vagrant close the PuTTY terminal In your Windows terminal, enter: > vagrant halt Exit the SSH session: > exit Shut down Vagrant: > vagrant halt Wait until the command prompt returns, indicating that the box has successfully shut down. You’re done! Now you can close the terminal.
23. Using Vagrant Next Time Now that all the dependencies are installed and the box has been updated: > cd Desktop/vagrant-2.4 > vagrant up Open PuTTY and launch your saved AtoM Vagrant box settings > cd Desktop/vagrant-2.4 > vagrant up > vagrant ssh > cd ~/Desktop/vagrant-2.4 > vagrant up > vagrant ssh Vagrant box Credentials: • Username: vagrant • Password: vagrant Open AtoM in your Browser – URL: http://10.10.10.10 • Username: demo@example.com • Password: demo
24. Further Resources AtoM Vagrant documentation: • https://www.accesstomemory.org/docs/latest/dev-manual/env/vagrant/ AtoM Command-Line Tutorial Videos • https://www.youtube.com/playlist?list=PLZiwlG5eSMeyeETe15EsEBSu5htPLK-wm

value: This website is an American hosting service, now owned by Scribd, for professional content including presentations, infographics, documents, and videos. Users can upload files privately or publicly in PowerPoint, Word, PDF, or OpenDocument format.


text:
The World Ends in Hickory Hollow by Ardath Mayhar | 9781892884039 | Paperback | Barnes & Noble
ISBN-13: 9781892884039
Pages: 190Product dimensions: 5.49 (w) x 9.14 (h) x 0.53 (d)

value: This website is an American bookseller. It is a Fortune 1000 company and the bookseller with the largest number of retail outlets in the United States.


text:
Sold byspeedyhenuk (1378427)99.9% positive FeedbackContact seller
item 1 Dianetics by L. Ron Hubbard New Paperback Book -Dianetics by L. Ron Hubbard New Paperback Book
item 2 **NEW** - Dianetics: The Modern Science of Mental Health (Paperback) 8779897711 -**NEW** - Dianetics: The Modern Science of Mental Health (Paperback) 8779897711
item 3 Dianetics: The Modern Science of Mental Health by L.Ron Hubbard Paperback Book -Dianetics: The Modern Science of Mental Health by L.Ron Hubbard Paperback Book
item 4 Dianetics: The Modern Science of Mental Health by L.Ron Hubbard Paperback Book -Dianetics: The Modern Science of Mental Health by L.Ron Hubbard Paperback Book
item 5 Dianetics: The Modern Science of Mental Health by L.Ron Hubbard Paperback Book -Dianetics: The Modern Science of Mental Health by L.Ron Hubbard Paperback Book
item 6 Dianetics: The Modern Science of Mental Health (Paperback), Hubba... -Dianetics: The Modern Science of Mental Health (Paperback), Hubba...
item 7 Dianetics: The Modern Science of Mental Health -Dianetics: The Modern Science of Mental Health
89607724
by 191infinity08 Jul, 2015
I found it exhilarating to read.
A breath of fresh air ..the cleverest book I have read..ideas I had wondered about were confirmed as true.A workable procedure inside to erase past pain ..quite incredible ..

value: This website is an American multinational e-commerce corporation based in San Jose, California, that facilitates consumer-to-consumer and business-to-consumer sales through its website.


text:
Vera Johnson Condolences | Sign the Guest Book | News-Herald
Vebe, you were a very dear friend to my family for many years. I have lots of memories when you would come stay with us in Newton Falls or we would visit you in Perry. My Mom considered you such a close friend. You always made all of us feel like we could just be so REAL around you. Loved our phone conversations over the years, just feel badly that I hadn't called you more. So thankful to have received Neva's note finally.
~ Becky Weber. Moates,
Real good memories of you Vebe for many years. As little kids you helped mom and pop (Bob and Eleanor Weber) take care of us and you always made us laugh. My mum spoke of you often and I know you two were best of friends. So glad for our phone conversations over the years. When we were toddlers you were "Beve". In later years you were always very encouraging as I would recount to you how my life and family was going. Love, Sis
~ Janet Hiatt,
We all loved you soooo much, Vebe. I must have spoken to you on the phone for an hour days before you passed on to be with our Mum, Eleanor Weber Brainard. You were always our "other mother" and we all have fond memories of you in our home, on vacation in Canada with us, and when you came to visit in Newton Falls. I can attest to the fact that you were sharp as a tack up until the very end. We told jokes "just the other day". From Janet(Sis) and Becky and me, We love you and we are glad you are with your best friend again.
~ Nancy Weber Cathey,
What a pleasure it was to meet you, get to know you and take care of you! You fought a courageous battle!!!! Rest in Peace Vera!!!! My Condolences to the family.
Charlie, Sorry to see Vera's passing , may she rest in peace. My Dad always spoke fondly of Vera . Rex E. Penhollow
~ Rex Penhollow,
Vicki. I pray for comfort for you and your family in the loss of Vera She was a nice lady. God Bless, Sherry Posey
Rest in peace Vera. God bless you forever.
~ Fran Fiorello,
We will miss you Bunny but you are in a better place now.
May you rest in peace Vera. You are one of the nicest people that I got to know. I loved to hear you talk about your growing up and your life. You will be missed.
I will miss my Aunt Bunny, who was a wonderful Aunt who always was cheerful and interested in me whenever I was around her.Thanks for being a loving Aunt to me. Love ya. Bruce Johnson

value: This website is a United States-based website founded in 1998, the world's largest commercial provider of online memorials. The Web site hosts obituaries and memorials for more than 70 percent of all U.S. deaths.


text:
Sterling Heights Face & Skin Care - Deals in Sterling Heights, MI | Groupon
Face & Skin Care in Sterling Heights, MI
Categories Beauty & Spas (132) Face & Skin (132) Facials (89) Microdermabrasion (21) Facial Peels (17) Botox (12) Injectables & Fillers (6) IPL (4) Permanent Makeup (3) Cosmetic Procedures (28) Spas (6) Bioelements or Glycolic Peels
Up to 62% Off Bioelements, Glycolic, or Vitamin C Peels Chemical peels clear away the outermost layers of skin with glycolic acid or vitamin C–rich formulas for brighter, more toned complexions
One or Three Signature Facials at Lash Cafe and Beauty Studio (Up to 48% Off)
Lash Cafe and Beauty Studio Lash Cafe and Beauty Spa
Three or Six Diamond-Tip Microdermabrasions at Fab Skin Center (Up to 70% Off) Fab Skin Center Fab Skin Center
One, Three, or Five Skin Glow Facials at EyesAdorn (Up to 58% Off)
EyesAdorn Pickett
Skin glow facials applied by an experienced practitioner that help nourish skin and reduce the appearance of fine lines and age spots
Clients can relax and relieve stress with a soothing facial treatment that revitalizes the skin
We offer many skin care services like Facials, Chemical Peels, Waxing, Threading and we do offer weight loss program Called Ideal Protein you may lose 3-7 lbs per week on the program.
I love helping people to look and feel great about themselves.
The best reaction was from a weight loss client, when she started the diet she was on wheel chair coz of heavy weight and always use to carry insulin injections with her all the time, but now she can walk and taking very little amount of oral pill for Diabetes... She was in tears when she came and showed me she can walk and able to cross her legs now. We both were in tears. That was the best reaction I have ever got from a client.
+15163760332
No better service in Sterling Heights. Raphael International Salon's full salon means no matter your desire, it can help.
Raphael International Salon lets you take control of your whole look by selecting from any of its beauty services like make up application.
Even if you're busy, take care of yourself. A day at Raphael International Salon is a great way to treat yourself after a busy week.
+15869779991
At Indulge Salon, skilled stylists employ training from top cosmetology schools and specialized courses to beautify their clients. Hair artists infuse tresses with nourishing products from Schwarzkopf, Keratin Complex, and Bed Head, accentuating 'dos with extensions and highlights. To up the relaxation ante, guests can nibble and sip from a spread of complementary snacks and drinks as they await purifying facials, spa mani-pedis, or quick waxing treatments. Ladies and gents alike can avail themselves of beauty packages, from a Girls' Day Out princess party complete with manicures and pedicures, to a Gentleman's Retreat spa package consisting of a deep tissue massage, foot detailing, haircut, and beard competition prep. Read More Sterling Heights, MI US
+15864570019
Alexandra Vincent Esthetics
The skincare experts at Alexandra Vincent Esthetics & Salon customize each of their facials to deliver specific complexion-improving results. Whether their goal is to fight acne, wrinkles, or a permanently affixed Halloween mask, the aestheticians work closely with each client to assemble the right products for the treatment. Men's and women's waxing services leave legs, chests, and bikini zones smooth for weeks, and makeup applications ready brides for their big day.
In times of need, a haircut can be a person's best friend. It has more than just hair services. It's a full salon in Sterling Heights for you.
Call Proactiv Solution to check for openings and take advantage of these great services today.
+15865327146

value: This website is an American global e-commerce marketplace connecting subscribers with local merchants by offering activities, travel, goods and services in 15 countries. Based in Chicago, Groupon was launched there in November 2008, launching soon after in Boston, New York City and Toronto.


text:
indexing - Oracle explain plan estimates incorrect cardinality for an index range scan - Stack Overflow
1 I have an Oracle 10.2.0.3 database, and a query like this:
from LARGE_PARTITIONED_TABLE a
join SMALL_NONPARTITIONED_TABLE b on a.key1 = b.key1 and a.key2 = b.key2
where b.id = 1000
Table LARGE_PARTITIONED_TABLE (a) has about 5 million rows, and is partitioned by a column not present in the query. Table SMALL_NONPARTITIONED_TABLE (b) is not partitioned, and holds about 10000 rows.
Statistics are up-to-date, and there are height balanced histograms in columns key1 and key2 of table a.
Table a has a primary key and a global, nonpartitioned unique index on columns key1, key2, key3, key4, and key5.
Explain plan for the query displays the following results:
| Id  | Operation          | Name                         | Rows  | Bytes | Cost (%CPU)| Time     |
|   0 | SELECT STATEMENT   |                              |     1 |    31 |     4   (0)| 00:00:01 |
|   1 |  SORT AGGREGATE    |                              |     1 |    31 |            |          |
|   2 |   NESTED LOOPS     |                              |   406 | 12586 |     4   (0)| 00:00:01 |
|*  3 |    INDEX RANGE SCAN| INDEX_ON_TABLE_B            |     1 |    19 |     2   (0)| 00:00:01 |
|*  4 |    INDEX RANGE SCAN| PRIMARY_KEY_INDEX_OF_TABLE_A |   406 |  4872 |     2   (0)| 00:00:01 |
3 - access("b"."id"=1000)
4 - access("a"."key1"="b"."key1" and
"a"."key2"="b"."key2")
Thus the rows (cardinality) estimated for step 4 is 406.
Now, a tkprof trace reveals the following: Rows     Row Source Operation
1  SORT AGGREGATE (cr=51 pr=9 pw=0 time=74674 us)
7366   NESTED LOOPS  (cr=51 pr=9 pw=0 time=824941 us)
1    INDEX RANGE SCAN INDEX_ON_TABLE_B (cr=2 pr=0 pw=0 time=36 us)(object id 111111)
7366    INDEX RANGE SCAN PRIMARY_KEY_INDEX_OF_TABLE_A (cr=49 pr=9 pw=0 time=810173 us)(object id 222222)
So the cardinality in reality was 7366, not 406!
My question is this: From where does Oracle get the estimated cardinality of 406 in this case, and how can I improve its accuracy, so that the estimate is more in line of what really happens during query execution? Update: Here is a snippet of a 10053 trace I ran on the query.
Outer table: Card: 1.00  Cost: 2.00  Resp: 2.00  Degree: 1  Bytes: 19
Inner table: LARGE_PARTITIONED_TABLE  Alias: a
Index: PRIMARY_KEY_INDEX_OF_TABLE_A
resc_io: 2.00  resc_cpu: 27093
ix_sel: 1.3263e-005  ix_sel_with_filters: 1.3263e-005
NL Join (ordered): Cost: 4.00  Resp: 4.00  Degree: 1
Cost_io: 4.00  Cost_cpu: 41536
Resp_io: 4.00  Resp_cpu: 41536
resc: 4.00 resc_io: 4.00 resc_cpu: 41536
resp: 4.00 resp_io: 4.00 resp_cpu: 41536
Using concatenated index cardinality for table SMALL_NONPARTITIONED_TABLE
Revised join sel: 8.2891-e005 = 8.4475e-005 * (1/12064.00) * (1/8.4475e-005)
Join Card:  405.95 = outer (1.00) * inner (4897354.00) * sel (8.2891-e005)
Join Card - Rounded: 406 Computed: 405.95
So that is where the value 406 is coming from. Like Adam answered, join cardinality is join selectivity * filter cardinality (a) * filter cardinality (b), as can be seen on the second to last line of above trace quote.
What I do not understand is the Revised join sel line. 1/12064 is the selectivity of the index used to find the row from table b (12064 rows on table, and select based on unique id). But so what?
Cardinality appears to be calculated by
multiplying the filter cardinality
of table b (4897354) with
selectivity of table a (1/12064).
does the selectivity on
table a have to do with how much
rows is expected to be found from
table b, when a --> b join is not based on
a.id? Where does the number
8.4475e-005 come from (it does not appear anywhere else in the whole
trace)? Not that it affects the
output, but I'd still like to know.
I understand that the optimizer has likely chosen the correct path here. But still the cardinality is miscalculated - and that can have a major effect on the execution path that is chosen from that point onwards (as in the case I'm having IRL - this example is a simplification of that).
oracle indexing oracle10g performance explain-plan share|improve this question edited Jul 2 '10 at 6:29
asked Jul 1 '10 at 9:35
Generating a 10053 trace file will help show exactly what choices the optimizer's making regarding its estimation of cardinality and selectivity. Jonathan Lewis' excellect Cost Based Oracle Fundamentals is an excellent resource to understanding how the optimizer works, and the printing I have spans 8i to 10.1.
Join Selectivity =   ((num_rows(t1) - num_nulls(t1.c1)) / num_rows(t1))
* ((num_rows(t2) - num_nulls(t2.c2)) / num_rows(t2))
/ greater (num_distinct(t1.c1), num_distinct(t2.c2))
Join Cardinality =   Join Selectivity
* filtered_cardinality (t1)
* filtered_cardinality (t2)
However, because we have a multi-column join, Join Selectivity isn't at the table level, it's the product (intersection) of the join selectivities on each column. Assuming there's no nulls in play:
Join Selectivity = Join Selectivity (key1) * Join Selectivity (key2)
Join Selectivity (key1) =   ((5,000,000 - 0) / 5,000,000)
* ((10,000 - 0)) / 10,000)
/ max (116, ?)  -- distinct key1 values in B
= 1 / max(116, distinct_key1_values_in_B)
Join Selectivity (key2) =   ((5,000,000 - 0) / 5,000,000)
/ max (650, ?)  -- distinct key2 values in B
= 1 / max(650, distinct_key2_values in B)
Join Cardinality =  JS(key1) * JS(key2)
* Filter_cardinality(a) * Filter_cardinality(b)
We know that there are no filters on A, so that's tables filter cardinality is the number of rows. We're selecting the key value from B, so that table's filter cardinality is 1. So the best case for estimated estimated join cardinality is now
Join Cardinality  = 1/116 * 1/650 * 5,000,000 * 1
=~ 67
It might be easier to work backward. Your estimated cardinality of 406, given what we know, leads to a join selectivty of 406/5,000,000, or approximately 1/12315. That happens to be really, really close to 1 / (116^2), which is a sanity check within the optimizer to prevent it from finding too aggressive a cardinality on multi-column joins.
Get Jonathan Lewis' Cost Based Oracle Fundamentals.
Get a 10053 trace of the query whose behavior your can't understand.
share|improve this answer answered Jul 1 '10 at 14:13
8,5191120
Thanks Adam. I will certainly have a look at the 10053 trace of the query. Will post my results tomorrow.
I have now updated the question with the 10053 trace, please see above.
I can't answer the second question -- Oracle's got lots of fudge factors, and the concatentated index cardinality rules aren't well documented. Besides, it's a factor that cancels itself out. The A-B join cardinality is based on the relative cardinality of A (1 row) multiplied by the absolute cardinality of B (4897354) multiplied by the join selectivity -- which is 1 / absolute cardinality of A. Look at it this way. Your tables map 12046 rows in A to 4897354 rows in B. Therefore for each row in A, there are, on average, 406 rows in B.
You also may wish to look at metalink note 728004.1 "How ORACLE CBO Calculate Join Cardinality with Join Elimination Filter"
I accepted this answer because it did help me figure out where the estimated cardinality came from - thanks Adam! What I'm still puzzled with is how to improve query performance in a case like this.
The cardinality estimate would be based on the product of the selectivity of a.key1 and a.key2, which (at least in 10g) would each be based on the number of distinct values for those two columns as recorded in the column statistics.
For a table of 5M rows, a cardinality estimate of 406 is not significantly different to 7366. The question you have to ask yourself is, is the "inaccurate" estimate here causing a problem?
You can check what plan Oracle would choose if it were able to generate a perfectly accurate estimate by getting an explain plan for this:
select /*+CARDINALITY(a 7366)*/ count(a.id)
where b.id = 1000;
If this comes up with the same plan, then the estimate that Oracle is calculating is already adequate.
Thanks Jeffrey. You are of course correct in that the cardinality estimate difference in this example is not significant. However, this is just a simplified case I prepared for this question - I have other cases of queries against same tables where the difference is much bigger - and presumably more significant as well. I am still unable to come up with the formula Oracle uses to arrive at cardinality of 406. Num_distinct for columns a and b are 116 and 650, respectively.
You might be interested to read this excellent paper by Wolfgang Breitling which has a lot of info on CBO calculations: http://www.centrexcc.com/A%20Look%20under%20the%20Hood%20of%20CBO%20-%20the%2010053%20Event.pdf.
As explained there, because you have histograms, the filter-factor calculation for these columns does not use number of distinct values (NDV) but density, which is derived from the histogram in some way.
What are the DENSITY values in USER_TAB_COLUMNS for a.key1 and a.key2?
Generally, the problem in cases like this is that Oracle does not gather statistics on pairs of columns, and assumes that their combined filter factor will be the product of their individual factors. This will produce low estimates if there is any correlation between values of the two columns.
If this is causing a serious performance issue, I suppose you could create a function-based index on a function of those columns, and use that to do the lookup. Then Oracle would gather statistics on that index and probably produce better estimates.
share|improve this answer answered Jul 1 '10 at 13:20
Thanks Dave, that paper looks like an interesting read indeed. I need to digest this a bit - I'll post the results tomorrow!
I ran a 10053 trace on the query - please see the updated question. Density values for a.key1 and a.key2 are 0,000000111 and 0,0022831.
Not the answer you're looking for?	Browse other questions tagged oracle indexing oracle10g performance explain-plan or ask your own question.	asked

value: This website is a question and answer website for professional and enthusiast programmers. It is the flagship site of the Stack Exchange Network, created in 2008 by Jeff Atwood and Joel Spolsky.


text:
Protein affinity labeling mediated by genetically encoded peptide tags. - PubMed - NCBI
Create RSSRSS SettingsSearch: 12491432Number of items displayed:510152050100Feed name:Create RSSCreate alertAdvancedHelp
Format: AbstractFormatSummarySummary (text)AbstractAbstract (text)MEDLINEXMLPMID ListApplySend toChoose DestinationFileClipboardCollectionsE-mailOrderMy BibliographyCitation managerFormatSummary (text)Abstract (text)MEDLINEXMLPMID ListCSVCreate FileSearch: 12491432[uid] FormatSummarySummary (text)AbstractAbstract (text)MEDLINEXMLPMID ListMeSH and Other DataE-mailSubjectAdditional textE-mailDidn't get the message? Find out why...Add to ClipboardAdd to CollectionsOrder articlesAdd to My BibliographyGenerate a file for use with external citation management software.Create File
See comment in PubMed Commons belowAngew Chem Int Ed Engl. 2002 Jan 18;41(2):356-9.Protein affinity labeling mediated by genetically encoded peptide tags.Amini F1, Kodadek T, Brown KC.Author information1Department of Internal Medicine, Center for Biomedical Inventions, University of Texas Southwestern Medical Center, 5323 Harry Hines Blvd., Dallas 75390-9185, USA.PMID: 12491432 [Indexed for MEDLINE] SharePublication type, MeSH terms, Substances, Grant supportPublication typeResearch Support, U.S. Gov't, P.H.S.MeSH termsAffinity Labels/chemistry*Bacterial Proteins/chemistry*Bacterial Proteins/geneticsCross-Linking Reagents/chemistry*Electrophoresis, Polyacrylamide GelGenetic VectorsNickel/chemistry*Protein ConformationRecombinant Fusion Proteins/chemistry*Recombinant Fusion Proteins/geneticsSubstancesAffinity LabelsBacterial ProteinsCross-Linking ReagentsRecombinant Fusion Proteinsglycyl-glycyl-histidyl-ecotin, recombinantNickelGrant supportGM-58175/GM/NIGMS NIH HHS/United StatesLinkOut - more resourcesFull Text SourcesWileyMiscellaneousNICKEL, ELEMENTAL - Hazardous Substances Data BankPubMed Commons home
Full text links 12491432[uid]Search

value: This website is part of the United States National Library of Medicine , a branch of the National Institutes of Health . It is approved and funded by the government of the United States.


text:
SDI Media Group, Inc.: Private Company Information - Businessweek
SDI Media Group, Inc., a media localization company, provides dubbing, subtitling, and media services for content owners, aggregators, broadcasters, and new media distributors. It offers an end-to-end localization solution for feature films, episodic television series, interactive games, new media, and corporate needs. The company also provides access services that include live closed captioning services, offline captioning, audio description/descriptive video, and signing; voice over and dubbing, global media, and subtitling services; and speech services for voice recognition systems. It serves its customers in Europe, the Middle East, and Africa; Asia; the Americas; and internationally. Th...
SDI Media Group, Inc., a media localization company, provides dubbing, subtitling, and media services for content owners, aggregators, broadcasters, and new media distributors. It offers an end-to-end localization solution for feature films, episodic television series, interactive games, new media, and corporate needs. The company also provides access services that include live closed captioning services, offline captioning, audio description/descriptive video, and signing; voice over and dubbing, global media, and subtitling services; and speech services for voice recognition systems. It serves its customers in Europe, the Middle East, and Africa; Asia; the Americas; and internationally. The company was founded in 1965 and is based in Culver City, California with centralized hubs in Warsaw, Poland; and Manila, the Philippines. It has studios in Europe, Asia, and the Americas. As of April 1, 2015, SDI Media Group, Inc. operates as a subsidiary of Imagica Robot Holdings Inc.
10950 Washington BoulevardStudio BCulver City, CA 90232United StatesFounded in 1965
Key Executives for SDI Media Group, Inc.
Mr. Richard Andrews
Mr. Rodney J. Peckham
Mr. Michael Tang
Mr. Roy Dvorkin
Senior Vice President of Business Development & Client Services
Compensation as of Fiscal Year 2015. SDI Media Group, Inc. Key Developments
SDI Media Appoints Richard Andrews as Companywide President, Effective August 1, 2015
SDI Media announced that Richard Andrews has been appointed its new companywide President, a role in which he will be responsible for all aspects of SDI’s global business, reporting to SDI’s Board of Directors. Richard joined SDI in late 2009, and since that time has served as a senior executive responsible for many of SDI’s most important initiatives. Prior to SDI, Richard served as SVP/COO of Content Management at Ascent Media, President of Technicolor Creative Services, and President of Vidfilm International Digital. Richard will begin to transition into this role immediately, with an effective date of August 1, 2015.
SDI Media Appoints Nicole Brunnhuber as the New Country Manager of Germany
SDI Media has announced the appointment of Nicole Brunnhuber as the new Country Manager of Germany effective immediately. Nicole has 10 years of international management experience in the localization industry working with multi-national clients and industry leaders. She brings expertise in the global marketplace with a core focus on operational efficiency, customer service, and business development in German-speaking markets. In her role as Country Manager Nicole will oversee operations at both of SDI Media’s German facilities in Berlin and Munich. She will be responsible for managing facility operations, customer service, fulfillment, and the continuous improvement of operations in one of the world’s strongest localization markets.
SDI Media Opens New Custom-Built Dubbing Studios in Amsterdam
SDI Media announced the opening of new custom-built dubbing studios in Amsterdam. After many successful years servicing the Netherlands out of Bussum, the company has relocated to a new, upgraded 1,000 m2 facility that will provide clients an even higher level of quality, capacity, and security while delivering the most comprehensive suite of localization solutions in the region. The SDI Media Amsterdam studios are fully equipped with recording rooms for broadcast, theatrical, home entertainment and interactive products, and include expanded mixing capabilities. Dedicated editing suites, as well as audio mixing solutions for Access Services such as audio description recording, are now available. An emphasis on security has also been implemented in the new facility build, including both structural and electronic measures to ensure company's standards of protection. The company's new studios in Amsterdam offer clients a centrally located, easily accessible localization solution with even greater support and additional capabilities for broadcasters and content owners in the territory. With dedicated space for client services and talent management, as well as dining facilities, lounge, and communal areas, actors and directors have shared space to use during production for managing projects and business relations.
PowerUp Productions, LLC United States McCormick Brokerage Co., Inc. United States Competitor Group, Inc. United States U-T Community News, LLC United States Theresa Roberts, Inc. United States
To contact SDI Media Group, Inc., please visit www.sdimedia.com. Company data is provided by Capital IQ. Please use this form to report any data issues.

value: This website is an international news agency headquartered in New York City and a division of Bloomberg L.P. Content produced by Bloomberg News is disseminated through Bloomberg Terminals, Bloomberg Television, Bloomberg Radio, Bloomberg Businessweek, Bloomberg Markets, Bloomberg.com, and Bloomberg's mobile platforms. Since 2015, John Micklethwait has served as editor-in-chief.


text: Top 10 Hotels in Andros Island, Greece | Hotels.comEnglish (United States)Book online or call 800-246-8357This call is free. 24 hours a day; 7 days a week.HotelsHotel DealsPackages & FlightsGroupsGift CardsHelpWebsite feedbackSign in & AccountSign inCreate an accountYour bookingsReview a hotelHotels.com® RewardsYour bookingsHotelsHotels in GreeceAndros Island HotelsHotels in Andros Island, GreeceSearch & Compare Andros Island HotelsCity, landmark, hotel name, address or zip codeCheck inCheck out I don’t know my datesRooms123456789+Room 1:Adults12345678Aged 18+Children01230-17Age at check in:Child 1:-?-<11234567891011121314151617Show dealsGet Secret Prices on select hotelsThese prices aren’t available to everyone.Unlock nowDeal of the dayMare Vista Hotel - Epaminondas from $56See all Andros Island dealsTrending now in Andros IslandMost bookedAndros HolidayExcellent 4.1 / 5( 22 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 10 people looked at this hotel in the last hourMost recent review"It was very positive. The Hotel was really close to the Port and the room was nice. Plus, the breakfast was great."A Traveller, Jun 2015, IEParadise Art HotelGood 3.5 / 5( 22 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 10 people looked at this hotel in the last hourMost recent review"Wonderful stay. It was great that we were driven into town and to airport."A Traveller, Aug 2016, USMicra Anglia - Boutique Hotel AndrosOutstanding 4.9 / 5( 17 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 10 people looked at this hotel in the last hourMost recent review"Delicious breakfast, superb quality bath amenities and a very clean room. Room was not very big (attic), but still comfortable enough for the weekend. The bathroom was large however. Overall, a very enjoyable stay. Would definitely recommend."A Traveller, Aug 2014, GBAegea Blue Cycladic ResortOutstanding 4.8 / 5( 4 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 8 people looked at this hotel in the last hourMost recent review"The hotel is beautiful, peaceful, spacious and clean, with new furnishings. It also has an amazing infinity pool overlooking scenic nature views. Drawbacks: couldn't see any water from my sea view suite unless I went out on the balcony (and from thee it was a partial view at best), slow wifi that..."A Traveller, Jul 2016, USAmorani StudiosGood 3.6 / 5( 24 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 7 people looked at this hotel in the last hourMost recent review"This is a lovely little studios complex run by a very friendly family who were extremely willing to help with anything we needed. the room was a good size with a fridge and balcony and was kept clean during our stay. the studios are a 5-10 minute walk from the centre of Batsi so are nice and quie..."A Traveller, Jun 2016, GBMare Vista Hotel - EpaminondasExcellent 4.3 / 5( 16 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 6 people looked at this hotel in the last hourMost recent review"The hotel is beautifully appointed and staff all pleasant and professional. The breakfast buffet is abundant and delicious. The view is breathtaking from the hotel. It's a gem of a hotel. "A Traveller, Oct 2016, CAAllegria Family HotelGood 3.9 / 5( 8 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 6 people looked at this hotel in the last hourChryssi AktiExcellent 4.1 / 5( 20 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 5 people looked at this hotel in the last hourMost recent review"Hotel was so clean and tidy. Staff could not do enough to help you. Best holiday in years. Can't wait to go back. "C, Jun 2016, GBAiolos HotelGood 3.0 / 5( 1 genuine review )Hotels.com® RewardsFor every 10 nights, get 1 free! 4 people looked at this hotel in the last hourSt. George StudiosGood 3.3 / 5( 7 genuine reviews )Hotels.com® RewardsFor every 10 nights, get 1 free! 3 people looked at this hotel in the last hourSee more hotels in Andros Island, GreeceRecently bookedMainades Maisonettes and Studios3 starsfrom $34Mainades Maisonettes and Studios3 starsfrom $34Pay now or later on most roomsFree cancellation on most roomsPrice GuaranteeMap of Andros Island hotelsLandmarksSaint Peter's BeachBatsi BeachParaporti BeachAchla BeachForos CaveCyclades Olive MuseumArchaeological Museum of AndrosKorthi BeachZorgos BeachTourlitis LighthouseBatsi ChurchFasa LighthouseSaint Peter's TowerMuseum of Contemporary ArtAfanis NaftisKairis LibraryMaritime Museum of AndrosNeighborhoodsAndros TownBatsiGavrioHotel typesThree Star hotels (29 hotels)Cheap hotels (10 hotels)Pool hotels (13 hotels)Pet Friendly hotels (8 hotels)Free Breakfast hotels (16 hotels)Family-friendly hotels (35 hotels)Best hotels in Andros IslandWith hotels.com we help you find the best hotels in Andros Island, Greece.

value: This website is a website for booking hotel rooms online and by telephone. The company has 85 websites in 34 languages, and lists over 325,000 hotels in approximately 19,000 locations.


text:
Pearl Tree Print PEVA Shower Curtain - Free Shipping On Orders Over $45 - Overstock - 22553916
Ilove this curtin just put in another bathroom in my home and am going with natural colors in oak tones looks great lots of light comes thru thats what i needed and the design is beautiful can be washed love that.
ITEM# 22553916
VCNY Home Dot Wave Shower Curtain Bath Set
ITEM#: 22553916
Create a natural decor theme with this shower curtain. The shower curtain is made from chlorine-free PEVA for added eco-friendliness and features an outline of a tree to provide a touch of nature-inspired beauty.
Model Number SC-TREE-109-PRL
I was hesistant when when I bought this Pearl Tree Print shower curtain, but when it arrived and I put it in my shower i just loved the way it looked.
ana a. Mar 25, 2018
I love this curtain. The wrinkle take a little time to come out.
Shannon H. Apr 6, 2018
Jeannine D. Feb 12, 2018

value: This website is an American internet retailer selling primarily furniture headquartered in Midvale, Utah, near Salt Lake City.