User's Manual

123 Copyright © Acronis International GmbH, 2003-2020
Real-time Protection comes with the following additional protection options:
 Behavior analysis – to identify malicious processes, Active Protection uses behavioral heuristics.
It compares the chain of actions performed by a process with the chains of events recorded in
the database of malicious behavior patterns. This approach enables Active Protection to detect
new malware by its typical behavior.
 Exploit prevention – Active Protection analyzes the behavior of processes running on the
machine and detects abnormal activity. It prevents infected processes from spreading and
exploiting the vulnerabilities of other software installed on the system. Active Protection
employs several exploit prevention methods:
 Memory protection detects and prevents suspicious modifications of the execution rights on
memory pages. Malicious processes apply such modifications to page properties, to enable
the execution of shellcodes from non-executable memory areas like stack and heaps.
 Privilege escalation protection detects and prevents attempts for elevation of privileges
made by an unauthorized code or application. Privilege escalation is used by malicious code
to gain full access of the attacked machine, and then perform critical and sensitive tasks.
Unauthorized code is not allowed to access critical system resources or modify system
settings.
 Code injection protection detects and prevents malicious code injection into remote
processes. Code injection is used to hide malicious intent of an application behind clean or
benign processes, to evade detection by antimalware products.
You can choose one of the following types of scanning:
 Smart on-access detection means that the program runs in the background and actively and
constantly scans your machine system for viruses and other malicious threats for the entire
duration that your system is powered on. Malware will be detected in both cases when a file is
being executed and during various operations with the file such as opening it for reading/editing.
 On execution detection means that only executable files will be scanned at the moment they are
run to ensure they are clean and will not cause any damage to your machine or data. Copying of
an infected file will remain unnoticed.
You can view the results of real-time protection checks in the Activity tab of the Protection
dashboard.
Web filtering
Malware is often distributed by malicious or infected sites and uses the so called "Drive-by
download" method of infection.
Web filtering helps to protect you from potentially harmful websites and untrusted web resources by
blocking the access when you try to open them. To determine which websites are potentially harmful,
Web filtering uses the Protection updates database. The Web filtering database also includes
information about websites that contain fake news, scam, and phishing URLs. You can modify the
rules defined in the database by configuring exceptions to the Web filtering list.
Web filtering has two modes of operation:
 Complete block—the access to the website will be completely blocked.
 Notify only—a notification will be displayed, but users will be able to access the website.
Related topics
Configuring Active Protection ......................................................................................... 124
Configuring Protection exclusions .................................................................................. 128