User guide

28
Path – Path to excluded files and folders.
Threat – If there is a name of a threat next to an excluded file, it means that the file is only excluded for the given threat,
not completely. If that file becomes infected later with other malware, it will be detected by the antivirus module. This
type of exclusion can only be used for certain types of infiltrations and it can be created either in the threat alert window
reporting the infiltration (click Show advanced options and then select Exclude from detection), or by clicking Setup
> Quarantine and then right-clicking the quarantined file and selecting Restore and exclude from detection from the
context menu.
Add... – Excludes objects from detection.
Edit... – Enables you to edit selected entries.
Remove – Removes selected entries.
4.1.1.6 ThreatSense engine parameters setup
ThreatSense is technology consists of many complex threat detection methods. This technology is proactive, which
means it also provides protection during the early spread of a new threat. It uses a combination of several methods
(code analysis, code emulation, generic signatures, virus signatures) which work in concert to significantly enhance
system security. The scanning engine is capable of controlling several data streams simultaneously, maximizing the
efficiency and detection rate. ThreatSense technology also successfully eliminates rootkits.
The ThreatSense technology setup options allow you to specify several scan parameters:
File types and extensions that are to be scanned,
The combination of various detection methods,
Levels of cleaning, etc.
To enter the setup window, click the Setup... button located in any module‘s setup window which uses ThreatSense
technology (see below). Different security scenarios could require different configurations. With this in mind,
ThreatSense is individually configurable for the following protection modules:
Real-time file system protection,
Document protection,
Email client protection,
Web access protection,
Computer scan.
ThreatSense parameters are highly optimized for each module, and their modification can significantly influence system
operation. For example, changing parameters to always scan runtime packers, or enabling advanced heuristics in the
Real-time file system protection module, could result in a system slow-down (normally, only newly-created files are
scanned using these methods). We recommend that you leave the default ThreatSense parameters unchanged for all
modules except Computer scan.
4.1.1.6.1 Objects
The Objects section allows you to define which computer components and files will be scanned for infiltrations.
Operating memory – Scans for threats that attack the operating memory of the system.
Boot sectors – Scans boot sectors for the presence of viruses in the master boot record.
Email files – The program supports the following extensions: DBX (Outlook Express) and EML.
Archives – The program supports the following extensions: ARJ, BZ2, CAB, CHM, DBX, GZIP, ISO/BIN/NRG, LHA,
MIME, NSIS, RAR, SIS, TAR, TNEF, UUE, WISE, ZIP, ACE, and many others.
Self-extracting archives – Self-extracting archives (SFX) are archives needing no specialized programs – archives – to
decompress themselves.
Runtime packers – After executing, runtime packers (unlike standard archive types) decompress in memory. In
addition to standard static packers (UPX, yoda, ASPack, FSG, etc.), the scanner supports (thanks to code emulation)
many more types of packers.