System Watcher: rolling back malware actions - Kaspersky Lab

Kaspersky PURE 2.0
System Watcher:
rolling back malware actions

Kaspersky PURE 2.0
System Watcher. Rolling back actions performed by malware
You can use the product feature for rolling back the actions performed by malware in the
system. To enable a roll-back, System Watcher should log the history of program activity.
By default, Kaspersky PURE rolls back relevant operations automatically when the protection
components detect malicious activity (rolling back actions after malicious activity is detected in
the system can be initiated either by the System Watcher component based on patterns of
dangerous activity, or by Proactive Defense, and during virus scan task run or File Anti-Virus
operation).
When running in interactive mode, System Watcher prompts the user for action. You can
specify the operation which should be performed whenever malicious activity is detected. The
procedure of rolling back malware operations affects a strictly defined set of data. It causes no
negative consequences for the operating system or data integrity on your computer.
To configure rollback of malware operations, perform the following actions:
1. Open the application settings window.
2. In the left part of the window under Protection select System Watcher.
3. In the right part of the component settings in the Rollback of malware action s section
specify actions that System Watcher should perform if it has a possibility to roll back
changes made by a malicious program:
► Select the Select action automatically variant (if the automatic protection mode is
enabled). In this case System Watcher will automatically apply an action
recommended by Kaspersky Lab specialists.
► Select the Prompt for action variant (if the interactive protection mode is enabled).
In this case System Watcher will notify you that rollback is necessary and will
prompt for action: perform or cancel rollback.
► Select action
If you choose the Select action variant, select an action from the drop-down list:
► Roll back
► Do not roll back
1 | 2

Kaspersky PURE 2.0
Pay attention, you can limit the amount of data stored for rollback by clicking the
corresponding box in the Limit data to be stored for rollback section.
4. Click the Apply button.
2 | 2