User Guide - Kaspersky Lab

Proactive Defense 125
of applications that include such modules could be malicious, so it is not
necessary to monitor them closely. Kaspersky Lab specialists have created a list
of such modules to lighten the load on your computer when using Proactive
Defense.
Components with Microsoft-signed signatures are automatically designated as
trusted applications. If necessary, you can add or delete components from the
list.
The monitoring of processes and their integrity in the system is enabled by
checking the box Enable Application Integrity Control in the Proactive
Defense settings window: by default, the box is unchecked. If you enable this
feature, each application or application module opened is checked against the
critical and trusted applications list. If the application is on the list of critical
applications, its activity is controlled by Proactive Defense in accordance with the
rule created for it.
To configure Application Integrity Control:
1. Open the application settings window and select Proactive Defense
under Protection.
2. Click the Settings button in the Application Integrity Control box (cf.
Figure 35).
Let’s examine working with critical and trusted processes in greater detail.
10.2.1. Configuring Application Integrity
Control rules
Critical applications are executable files of programs which are extremely
important to monitor, since malicious files uses such programs to distribute
themselves.
A list of them was created when the application was installed, and is shown on
the Critical applications tab (see Figure 38): each application has its own
monitoring rule. A monitoring rule is created for each such application to regulate
its behavior. You can edit existing rules and create your own.
Proactive Defense analyzes the following operations involving critical
applications: their launch, changing the makeup of application modules, and
starting an application as a child process. You can select the Proactive Defense
response to each of the operations listed (allow or block the operation), and also
specify whether to log component activity in the component report. The default
settings allow most critical operations are allowed to start, be edited, or be
started as child processes.