12
4.1.3 ThreatSense engine parameters setup
ThreatSense is the name of the technology consisting
of complex threat detection methods. This technology
is proactive, which means it also provides protection
during the early hours of the spread of a new threat. It
uses a combination of several methods (code analysis,
code emulation, generic signatures, virus signatures)
which work in concert to significantly enhance system
security. The scanning engine is capable of controlling
several data streams simultaneously, maximizing the
efficiency and detection rate. ThreatSense technology
also successfully eliminates rootkits.
The ThreatSense technology setup options allow you
to specify several scan parameters:
File types and extensions that are to be scanned
The combination of various detection methods
Levels of cleaning, etc.
To enter the setup window, click
Setup
>
Antivirus
and antispyware
>
Advanced Antivirus and
antispyware protection setup
and then click the
Setup...
button located in the
System Protection
,
Real-Time Protection
and
Computer Scan
wildcards,
which all use ThreatSense technology (see below).
Different security scenarios could require different
configurations. With this in mind, ThreatSense is
individually configurable for the following protection
modules:
System Protection
> Automatic startup file check
Real-Time Protection
> Real-time file system
protection
Computer Scan
> On-demand computer scan
The ThreatSense parameters are specifically optimized
for each module, and their modification can
significantly influence system operation. For example,
changing settings to always scan runtime packers, or
enabling advanced heuristics in the Real-time file
system protection module could result in a slower
system . Therefore, we recommend that you leave the
default ThreatSense parameters unchanged for all
modules except Computer scan.
4.1.3.1 Objects
The
Objects
section allows you to define which
computer files will be scanned for infiltrations.
Files
– provides scanning of all common file types
(programs, pictures, audio, video files, database
files, etc.).
Symbolic links
- (On-demand scanner only) scans
special type of files that contain a text string that is
interpreted and followed by the operating system as
a path to another file or directory.
Email files
- (not available in Real-time protection)
scans special files where email messages are
contained.
Mailboxes
- (not available in Real-time protection)
scans user mailboxes in the system. Incorrect use of
this option may result in a conflict with your email
client. To learn more about advantages and
disadvantages of this option, read this
knowledgebase article
.
Archives
- (not available in Real-time protection)
provides scanning of files compressed in archives (.
rar, .zip, .arj, .tar, etc.).
Self-extracting archives
- (not available in Real-
time protection) scans files which are contained in
self-extracting archive files.
Runtime packers
- unlike standard archive types,
runtime packers decompress in memory, in addition
to standard static packers (UPX, yoda, ASPack, FGS,
etc.).
4.1.3.2 Options
In the
Options
section, you can select the methods
used during a scan of the system for infiltrations. The
following options are available:
Virus signature database
– Signatures can exactly
and reliably detect and identify infiltrations by name
using the virus signature database.
Heuristics
– Heuristics use an algorithm that
analyzes the (malicious) activity of programs. The
main advantage of heuristic detection is the ability
to detect new malicious software which did not
previously exist, or was not included in the list of
known viruses (virus signatures database).
Advanced heuristics
– Advanced heuristics
comprise a unique heuristic algorithm, developed by
ESET, optimized for detecting computer worms and
trojan horses written in high-level programming
languages. The program's detection ability is
significantly higher as a result of advanced
heuristics.
Adware/Spyware/Riskware
– This category
includes software that collects sensitive information
about users without their informed consent. This
category also includes software which displays
advertising material.
Potentially unwanted applications
– These
applications are not necessarily intended to be
malicious, but may affect the performance of your
computer in a negative way. Such applications
usually require consent for installation. If they are
present on your computer, your system behaves
differently (compared to the way it behaved before
these applications were installed). The most
significant changes include unwanted pop-up
windows, activation and running of hidden
processes, increased usage of system resources,
changes in search results, and applications
communicating with remote servers.
