User Guide - Kaspersky Lab

Proactive Defense 119
• Integrity of the program modules of the programs installed on your
computer, which helps avoid application modules being substituted
for malicious code embedded in them.
• Each attempt to edit the system registry by deleting or adding
system registry keys, entering strange values for keys in an
inadmissible format that prevents them from being viewed or edited,
etc.).
2. The analysis is conducted using allow and block rules from Proactive
Defense.
3. After the analysis, the following courses of action are available:
• If the activity satisfies the conditions of the Proactive Defense allow
rule or does not match any of the block rules, it is not blocked.
• If the activity is ruled as dangerous on the basis of the relevant
criteria, the next steps taken by the component match the
instructions specified in the rule: usually the activity is blocked. A
message will be displayed on the screen specifying the dangerous
program, its activity type, and a history of actions taken. You must
accept the decision, block, or allow this activity on your own. You
can create a rule for the activity and cancel the actions taken in the
system.
The categories of settings (see Figure 35) for the Proactive Defense component
are as follows:
• Whether application activity is monitored on your computer
This Proactive Defense feature is enabled by checking the box Enable
Application Activity Analyzer. By default the analyzer is enabled
providing a strict analysis of actions performed by any program running
on the host. You can configure the order in which applications are
processed for that activity. You can also create Proactive Defense
exclusions, which will stop the monitoring of selected applications.
• Whether Application Integrity Control is enabled
This feature is responsible for the integrity of application modules
(dynamic link libraries, or DLLs) installed on your computer, and is
enabled by checking the box Enable Application Integrity Control
box. Integrity is tracked by monitoring the checksum of the application
modules, and of the application itself. You can create rules (cf.
Section 10.2, p. 124) for monitoring the integrity of modules from any
application. To do so, add that application to the list of monitored
applications.