Unlike traditional behavioural analysis, which relies on predefined rules describing the behaviour of legitimate programs that are well known to criminals, the intelligent Dr.Web Process Heuristic analyses the behaviour of each running program in real time by comparing it with the reputation information stored in the Dr.Web cloud which is constantly updated. It determines whether the program is dangerous and then takes whatever measures are necessary to neutralise the threat.
This data protection technology helps minimise losses resulting from the actions of unknown malware — and consumes very few of the protected system’s resources.
Dr.Web Process Heuristic monitors any attempts to modify the system:
- Detects malicious processes that modify files (such as encryption ransomware).
- Prevents malware from injecting its code into the processes of other applications.
- Protects critical system areas from being modified by malware.
- Detects and stops the execution of malicious, suspicious or unreliable scripts and processes.
- Blocks malware’s ability to modify boot disk areas in order to prevent the launch of, for example, Trojan horses on your computer.
- Blocks changes from being made to the Windows Registry to ensure that the safe mode won't be disabled.
- Prevents malicious programs from altering basic system routines. Blocks certain registry keys, preventing malware from changing the desktop’s appearance or hiding a Trojan with a rootkit
- Prevents malware from changing launch permissions.
Dr.Web Process Heuristic starts protecting a system during the boot-up phase, even before the traditional, signature-based anti-virus is loaded!
- Prevents new or unknown drivers from being downloaded without user consent.
- Prevents malware and certain other applications, such as anti-antiviruses, from adding their entries into the Windows Registry, so that they could be launched automatically.
- Blocks registry sections containing information about virtual device drivers, ensuring that no new virtual devices are created.
- Blocks connections between spyware and its control servers.
- Prevents malware from disrupting system routines such as scheduled backups.
Dr.Web Process Heuristic works right out of the box, but the user can always configure rules based on their own needs!
The technology Dr.Web ShellGuard, which is incorporated into Dr.Web Script Heuristic, blocks routes into the system so that programs that exploit vulnerabilities can’t get in. Exploits are malicious objects, that take advantage of software flaws, including those not yet known to anyone except for the intruders who created the exploits (i.e., zero-day vulnerabilities). The vulnerabilities are used to gain control over a targeted application or the operating system.
