User Guide - Kaspersky Lab

Protection management system 73
Potentially dangerous software does not have a malicious function but can be
used as an auxiliary component for a malicious code, since it contains holes and
errors. This category includes, for example, remote administration programs, IRC
clients, FTP servers, all-purpose utilities for stopping or hiding processes,
keyloggers, password macros, autodialers, etc. These programs are not
classified as viruses. They can be divided into several types, e.g. Adware, Jokes,
Riskware, etc. (for more information on potentially dangerous programs detected
by Kaspersky Internet Security, see the Virus Encyclopedia at
www.viruslist.com). After the scan, these programs may be blocked. Since
several of them are very common, you have the option of excluding them from
the scan. To do so, you must add threat name or mask to the trusted zone using
the Virus Encyclopedia classification.
For example, imagine you use a Remote Administrator program frequently in
your work. This is a remote access system with which you can work from a
remote computer. Kaspersky Internet Security views this sort of application
activity as potentially dangerous and may block it. To keep the application from
being blocked, you must create an exclusion rule that specifies not-avirus:RemoteAdmin.Win32.RAdmin.22
as a threat type.
When you add an exclusion, a rule is created that several program components
(File Anti-Virus, Mail Anti-Virus, Proactive Defense, Privacy Control module for
the Protection of Confidential Data) and virus scan tasks can later use. You can
create exclusion rules in a special window that you can open from the program
settings window, from the notice about detecting the object, and from the report
window.
To add exclusions on the Exclusion Masks tab:
1. Click on the Add button in the Exclusion Masks window (see Figure
13).
2. In the window that opens (see Figure 12), click the exclusion type in the
Properties section:
Object – exclusion of a certain object, directory, or files that match a
certain mask from scan.
Threat type – excluding an object from the scan based on its status
from the Virus Encyclopedia classification.