User Guide - Kaspersky Lab

Proactive Defense 123
To edit a dangerous activity monitoring rule, select it from the list and assign the
rule settings in the lower part of the tab:
• Assign the Proactive Defense response to the dangerous activity.
You can assign any of the following actions as a response: allow, prompt
for action, and terminate process. Left-click on the link with the action until
it reaches the value that you need. In addition to stopping the process,
you can place the application that initiated the dangerous activity in
Quarantine. To do so, use the On / Off link across from the appropriate
setting. You can assign a time value for how frequently the scan will run
for detecting hidden processes in the system.
• Choose if you want to generate a report on the operation carried out. To
do so, click on the Log link until it shows On or Off as required.
To turn off monitoring for a dangerous activity, uncheck the next to the name
in the list. Proactive Defense will no longer analyze that type of activity.
Specifics of configuring application activity control in Kaspersky Internet
Security under Microsoft Windows XP Professional x64 Edition, Microsoft
Windows Vista, or Microsoft Windows Vista x64:
If you are running one of the operating systems listed above, only one type of
system event is controlled, dangerous behavior. Kaspersky Internet Security
analyses the activity of applications installed on the computer and detects
dangerous or suspicious activities basing on the list of rules, created by
Kaspersky Lab specialists.
If you want Kaspersky Internet Security to monitor the activity of system
processes in addition to user processes, select the Watch system user
accounts checkbox (see Figure 37). This option is disabled by default.
User accounts control access to the system and identify the user and his/her
work environment, which prevents other users from corrupting the operating
system or data. System processes are processes launched by system user
accounts.