User manual KASPERSKY LAB KASPERSKY ANTI-HACKER 1.5

[. . . ] KASPERSKY LABS Kaspersky Anti-Hacker 1. 5 USER GUIDE KASPERSKY ANTI-HACKER 1. 5 User Guide Kaspersky Labs Ltd. http://www. kaspersky. com Revision date: April 2004 Contents CHAPTER 1. KASPERSKY ANTI-HACKER. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] 19) when it detects an unknown event while running with the Medium level selected. Fig. An example of a training window At the top of this box you can see the name of the application requesting connection with a remote machine, the remote machine address, and the port numbers. If required, you can display more details of the requested connection by clicking on the . . . You can allow or block this specific operation by clicking on the Allow once or Block once buttons, respectively. If you close the training window by pressing the button in its upperright corner, the operation at issue will be blocked this time. To define a rule that will later handle events initiated by this application, select one of the actions listed below and click on the button. After this, the new rule will be added to your list of application rules. · Allow activity of the application according to its type ­ allows only network communication that is compliant with the specified application Enabling the Security System and Defining its Settings 43 type. Select the required type from the drop-down list below the option button (for details see subchapter 6. 3. 2. 1 on page 49). · · Disable all activities of the application ­ blocks the specified application from any kind of network activity including the described operation. ­ allows you to specify the operations that will be allowed for this application. If you select this option button and click , the Rule Wizard box will appear on your screen (for details of the wizard see subchapter 6. 3. 2 on page 49). If you create a rule that does not correspond to the described event, an appropriate message will appear on your screen (see fig. Then you may press the Yes button to add the created rule to the list, or the No button if this rule was created by mistake. In both cases you will be prompted to select another option from the list in the training window. Fig. The rule you created does not correspond to the current event Note that if several programs on your computer within a short period of time will attempt to perform network operations that are not described by the user rules, the queue of requests for rule creation will be generated. These requests will be successively displayed within the training window: first you will have to define the program response to actions of the first network application, then the second and so on. All the programs in this queue will be waiting for your reaction. 6. 1. 5. The Executable Module Substitution Warning Kaspersky Anti-Hacker protects your network applications from the unauthorized attempts to substitute their original executable files. If this kind of substitution detected Kaspersky Anti-Hacker displays the appropriate warning (see figure 21). You can select one of the following options: 44 Kaspersky Anti-Hacker · Block any further network activity of this application ­ all the further network operations of this application will be prohibited: the appropriate blocking rule will be added to the beginning of the application rule list and all other rules in this list will be disabled. It is advisable that you start your anti-virus program to check for viruses in this application, or restore this application from the archive, or rein- stall it. [. . . ] The product is also powered by a unique heuristic technology combating even future threats: the built-in heuristic code analyzer, which is able to detect up to 92% of unknown viruses and the world's only behavior blocker for MS Office 2000 providing 100% guaranteed protection against any macroviruses. Appendix C. 93 C. 1. Other Kaspersky Lab's Products Kaspersky® Anti-Virus Lite The program is the most easy-to-use Kaspersky Lab's anti-virus product that is developed for protection of home computers running Windows 95/98/Me, Windows 2000/NT Workstation, Windows XP. Kaspersky® Anti-Virus Lite includes: · · · an anti-virus scanner that provides a comprehensive check of all local and network drives on demand; an anti-virus monitor that automatically checks all used files in realtime; an MS Outlook Express mail databases checking module for checking for viruses on demand. Kaspersky® Anti-Virus Personal/Personal Pro The package has been developed to provide the full-scale anti-virus protection for home computers running the Windows 95/98/ME, or the Windows 2000/NT, or the Windows XP operation system, MS Office 2000 business applications and the Outlook and Outlook Express mail programs. Kaspersky® Anti-Virus Personal/Personal Pro includes a program to retrieve daily updates via the Internet, an integrated module of management and automation of your anti-virus protection. [. . . ]