System information

14 Kaspersky Internet Security 2009
Of course, scanning using the signature method with a database created
previously containing a description of known threats and methods for treating
them will give you a definite answer regarding whether a scanned object is
malicious and what dangerous program class it is classified as. The heuristic
method, unlike the signature method, is aimed at detecting typical behavior of
operations rather than malicious code signatures that allow the program to make
a conclusion on a file with a certain likelihood.
The advantage of heuristic analysis is that you do not have to update the
database before scanning. Because of this, new threats are detected before
virus analysts have encountered them.
However, there are methods for circumventing heuristics. One such defensive
measure is to freeze malicious code activity the moment heuristic scanning is
detected.
Note
Using a combination of various scanning methods ensures greater security.
In the event of a potential threat the heuristic analyzer emulates object execution
in the secure virtual environment of the application. If suspicious activity is
discovered as the object executes, the object will be deemed malicious and will
not be allowed to run on the host or a message will be displayed requesting
further instructions from the user:
 Quarantine new threat to be scanned and processed later using
updated databases
 Delete the object
 Skip (if you are positive that the object cannot be malicious).
To use heuristic methods, check Use heuristic analyzer. To do so, move the
slider to one of these positions: Shallow, Medium, or Detailed. The level of detail
of the scan provides the balance between the thoroughness, and hence the
quality, of the scan for new threats and the load on operating system resources,
as well as the duration of the scan. The higher you set the heuristics level, the
more system resources the scan will require, and the longer it will take.
Warning!
New threats detected using heuristic analysis are quickly analyzed by Kaspersky
Lab, and methods for disinfecting them are added to the hourly database
updates.
If you regularly update your databases, you will be maintaining the optimal level
of protection for your computer.