Detection of other types of objects
|
Windows
macOS
Linux
|
Regardless of the configured application settings, Kaspersky Endpoint Security always detects and blocks viruses, worms, and Trojans. They can cause significant harm to a computer.
If this option is selected, Kaspersky Endpoint Security detects objects from the Legitimate software that can be used to cause damage category. Although they do not have any malicious functions, such applications can be exploited by intruders. For details on legitimate software that can be used by intruders to damage your computer or personal data, please refer to the Kaspersky IT Encyclopedia website.
Legitimate software that can be used to cause damage
Subcategory: Legitimate software that can be used by intruders to damage your computer or personal data.
Danger level: Medium
Most of these applications are useful, so many users run them. These applications include IRC clients, auto-dialers, file download programs, computer system activity monitors, password utilities, and internet servers for FTP, HTTP, and Telnet.
However, if intruders gain access to these programs or if they plant them on the user's computer, some of the application's features may be used to violate security.
These applications differ by function; their types are described in the following table.
Type
|
Name
|
Description
|
Client-IRC
|
Internet chat clients
|
Users install these programs to talk to people in Internet Relay Chats. Intruders use them to spread malware.
|
Downloader
|
Programs for downloading
|
They can download files from web pages in hidden mode.
|
Monitor
|
Programs for monitoring
|
They allow monitoring activity on the computer on which they are installed (seeing which applications are active and how they exchange data with applications that are installed on other computers).
|
PSWTool
|
Password restorers
|
They allow viewing and restoring forgotten passwords. Intruders secretly implant them on users' computers with the same purpose.
|
RemoteAdmin
|
Remote administration programs
|
They are widely used by system administrators. These programs allow obtaining access to the interface of a remote computer to monitor and manage it. Intruders secretly implant them on users' computers with the same purpose: to monitor and manage remote computers.
Legal remote administration programs differ from backdoor-type Trojans for remote administration. Trojans have the ability to penetrate the operating system independently and install themselves; legal programs are unable to do so.
|
Server-FTP
|
FTP servers
|
They function as FTP servers. Intruders implant them on the user's computer to open remote access to it via FTP.
|
Server-Proxy
|
Proxy servers
|
They function as proxy servers. Intruders implant them on the user's computer to send spam under the user's name.
|
Server-Telnet
|
Telnet servers
|
They function as Telnet servers. Intruders implant them on the user's computer to open remote access to it via Telnet.
|
Server-Web
|
Web servers
|
They function as web servers. Intruders implant them on the user's computer to open remote access to it via HTTP.
|
RiskTool
|
Tools for working at a local computer
|
They provide the user with additional options when working at the user's own computer. The tools allow the user to hide files or windows of active applications and terminate active processes.
|
NetTool
|
Network tools
|
They provide the user with additional options when working with other computers on the network. These tools allow restarting them, detecting open ports, and starting applications that are installed on the computers.
|
Client-P2P
|
P2P network clients
|
They allow working on peer-to-peer networks. They can be used by intruders for spreading malware.
|
Client-SMTP
|
SMTP clients
|
They send email messages without the user's knowledge. Intruders implant them on the user's computer to send spam under the user's name.
|
WebToolbar
|
Web toolbars
|
They add toolbars to the interfaces of other applications to use search engines.
|
FraudTool
|
Pseudo-programs
|
They pass themselves off as other programs. For example, there are pseudo-anti-virus programs that display messages about malware detection. However, in reality, they do not find or disinfect anything.
|
|
Advanced Disinfection Technology
|
Windows
|
If this option is selected, a pop-up notification appears on the screen when malicious activity is detected in the operating system. In its notification, Kaspersky Endpoint Security offers the user the option to perform Advanced Disinfection of the computer. After the user approves this procedure, Kaspersky Endpoint Security neutralizes the threat. After completing the advanced disinfection procedure, Kaspersky Endpoint Security restarts the computer. The advanced disinfection technology uses considerable computing resources, which may slow down other applications.
When the application is in process of detecting an active infection, some operating system functionality can be unavailable. The availability of the operating system is restored when Advanced Disinfection is complete and the computer is restarted.
If Kaspersky Endpoint Security is installed on a computer running Windows for Servers, Kaspersky Endpoint Security does not show the notification. Therefore, you cannot select an action to disinfect an active threat. To disinfect a threat, you need to enable Advanced Disinfection technology in the application settings and enable immediate Advanced Disinfection in the Malware Scan task settings. Then, you need to start a Malware Scan task.
|