110
Kaspersky Anti-Virus 7.0
base of dangerous activity types comes with Kaspersky Anti-Virus
and is updated with the application databases).
Integrity of the program modules
of the programs installed on your
computer, which helps avoid application modules being substituted
for malicious code embedded in them.
Each attempt to edit the system registry
by deleting or adding sys-
tem registry keys, entering strange values for keys in an inadmissi-
ble format that prevents them from being viewed or edited, etc.).
2. The analysis is conducted using allow and block rules from Proactive
Defense.
3. After the analysis, the following courses of action are available:
If the activity satisfies the conditions of the Proactive Defense allow
rule or does not match any of the block rules, it is not blocked.
If the activity is ruled as dangerous on the basis of the relevant cri-
teria, the next steps taken by the component match the instructions
specified in the rule: usually the activity is blocked. A message will
be displayed on the screen specifying the dangerous program, its
activity type, and a history of actions taken. You must accept the
decision, block, or allow this activity on your own. You can create a
rule for the activity and cancel the actions taken in the system.
If the user does not take any actions when a Proactive Defense noti-
fication appears, after a time the program will apply the default ac-
tion recommended for that threat. The recommended action can be
different for different threat types.
The categories of settings (see Figure 35) for the Proactive Defense component
are as follows:
Whether application activity is monitored on your computer
This Proactive Defense feature is enabled by checking the box
Ena-
ble Application Activity Analyzer
. By default the analyzer is enabled
providing a strict analysis of actions performed by any program running
on the host. You can configure the order in which applications are
processed (see 10.1 on pg. 112) for that activity. You can also create
Proactive Defense exclusions, which will stop the monitoring of selected
applications.
Whether Application Integrity Control is enabled
This feature is responsible for the integrity of application modules (dy-
namic link libraries, or DLLs) installed on your computer, and is enabled
by checking the box
Enable Application Integrity Control
box. In-
tegrity is tracked by monitoring the checksum of the application mod-