OfficeScan 10.6 Administrator's Guide - Trend Micro™ Online Help

Monitored system events include:
TABLE 7-1. Monitored System Events
EVENTS DESCRIPTION
Duplicated
System File
Hosts File
Modification
Suspicious
Behavior
New Internet
Explorer
Plugin
Internet
Explorer
Setting
Modification
Security
Policy
Modification
Program
Library
Injection
Using Behavior Monitoring
Many malicious programs create copies of themselves or
other malicious programs using file names used by Windows
system files. This is typically done to override or replace
system files, avoid detection, or discourage users from
deleting the malicious files.
The Hosts file matches domain names with IP addresses.
Many malicious programs modify the Hosts file so that the
web browser is redirected to infected, non-existent, or fake
websites.
Suspicious behavior can be a specific action or a series of
actions that is rarely carried out by legitimate programs.
Programs exhibiting suspicious behavior should be used with
caution.
Spyware/grayware programs often install unwanted Internet
Explorer plugins, including toolbars and Browser Helper
Objects.
Many virus/malware change Internet Explorer settings,
including the home page, trusted websites, proxy server
settings, and menu extensions.
Modifications in Windows Security Policy can allow unwanted
applications to run and change system settings.
Many malicious programs configure Windows so that all
applications automatically load a program library (DLL). This
allows the malicious routines in the DLL to run every time an
application starts.
7-3