112
Kaspersky Anti-Virus 7.0
10.1.
Activity Monitoring Rules
Note that configuring application control under Microsoft Windows XP Profes-
sional x64 Edition, Microsoft Windows Vista or Microsoft Windows Vista x64 dif-
fers from the configuration process on other operating systems.
Information about configuring activity control for these operating systems is pro-
vided at the end of this section.
Kaspersky Anti-Virus monitors application activity on your computer. The applica-
tion includes a set of event descriptions that can be tracked as dangerous. A
monitoring rule is created for each such event. If the activity of any application is
classified as a dangerous event, Proactive Defense will strictly adhere to the
instructions stated in the rule for that event.
Select the
Enable Application Activity Analyzer
checkbox if you want to
monitor the activity of applications.
Let's take a look a several types of events that occur in the system that the appli-
cation will track as suspicious:
Dangerous behavior
. Kaspersky Anti-Virus analyzes the activity of ap-
plications installed on your computer, and based on the list of rules
created by Kaspersky Lab, detects dangerous or suspicious actions by
the programs. Such actions include, for example, masked program in-
stallation, or programs copying themselves.
Launching Internet browser with parameters
. By analyzing this type of
activity, you can detect attempts to open a browser with settings. This
activity is characteristic of opening a web browser from an application
with certain command prompt settings: for example, when you click a
link to a certain URL in an advertisement e-mail.
Intrusion into process (invaders)
– adding executable code or creating
an additional stream to the process of a certain program. This activity is
widely used by Trojans.
Rootkit detection
. A rootkit is a set of programs used to mask malicious
programs and their processes in the system. Kaspersky Anti-Virus ana-
lyzes the operating system for masked processes.
Window hooks
. This activity is used in attempts to read passwords and
other confidential information displayed in operating system dialog box-
es. Kaspersky Anti-Virus traces this activity if attempts are made to in-
tercept data transferred between the operating system and the dialog
box.