116
Kaspersky Anti-Virus 7.0
Proactive Defense monitors critical applications and analyzes their activity, inte-
grity of the modules of those applications, and observes other processes which
they spawn. Kaspersky Anti-Virus comes with a list of critical applications, each
of which has its own monitoring rule to control application activity. You can ex-
tend this list of critical applications, and delete or edit the rules for the applica-
tions on the list provided.
Besides the list of critical applications, there is a set of trusted modules allowed
to be opened in all controlled applications. For example, modules that are digital-
ly signed by the Microsoft Corporation. It is highly unlikely that the activity of ap-
plications that include such modules could be malicious, so it is not necessary to
monitor them closely. Kaspersky Lab specialists have created a list of such mod-
ules to lighten the load on your computer when using Proactive Defense.
Components with Microsoft-signed signatures are automatically designated as
trusted applications. If necessary, you can add or delete components from the
list.
The monitoring of processes and their integrity in the system is enabled by
checking the box
Enable Application Integrity Control
in the Proactive De-
fense settings window:
by default, the box is unchecked. If you enable this fea-
ture, each application or application module opened is checked against the criti-
cal and trusted applications list. If the application is on the list of critical applica-
tions, its activity is controlled by Proactive Defense in accordance with the rule
created for it.
To configure Application Integrity Control:
1. Open the application settings window and select
Proactive Defense
under
Protection
.
2. Click the
Settings
button in the
Application Integrity Control
box (see
Figure 35).
Let‟s examine working with critical and trusted processes in greater detail.
10.2.1.
Configuring Application Integrity
Control rules
Critical applications
are executable files of programs which are extremely impor-
tant to monitor, since malicious files uses such programs to distribute them-
selves.
A list of them was created when the application was installed, and is shown on
the
Critical applications
tab (see Figure 38): each application has its own moni-
toring rule. A monitoring rule is created for each such application to regulate its
behavior. You can edit existing rules and create your own.