home *** CD-ROM | disk | FTP | other *** search
/ PC World 2006 November / PCWorld_2006-11_cd.bin / zabezpeceni / avs / avs.msi / en_bb.loc < prev    next >
Windows Autorun File  |  2006-09-14  |  23KB  |  593 lines

  1. ;------------- proactive defense --------------
  2.  
  3. [Global]
  4. $Behavior_Monitor=Proactive Defense
  5. $OG=Office Guard
  6. errPpmNotLoaded=$Behavior_Monitor module cannot be loaded.
  7. errCalcHash=Cannot open file.
  8. RegKeyMaskWithSubfoldersWarning=A mask cannot be used simultaneously with "Include subkeys" option. Using an asterix or a question mark when this option is enabled is only appropriate if they are part of the actual key name. Did you really intend to enter a key name that contains these characters?
  9.  
  10. [REG_ValueName]
  11. <empty>=(Default)
  12. default=$(@)
  13.  
  14. [BB_Body]
  15. Status=Status
  16.  
  17. [StatusRG]
  18. 1=$(pdm.state,SubProfileStateFont)$(pdm.state,ProfileState)
  19. 0=f(Normal_grey)disabled
  20.  
  21. [Behavior_Blocking_Status]
  22. StatusBB=Application Activity Analyzer:
  23. StatusPG=Application Integrity Control:
  24. StatusRG=Registry Guard:
  25. StatusOG=Office Guard:
  26. PDMRules=Critical applications:
  27. RGRules=Registry rules:
  28. OGRules=Office rules:
  29.  
  30. [Behavior_Blocking_Statistics]
  31. PDMScaned=Events checked:
  32. PDMBlocked=Blocked:
  33. OGScaned=Macros checked:
  34.  
  35. [ImportantEvents_PDM_not]
  36. #PDM_STATUS_OK=successfully
  37. default=not
  38.  
  39. [ImportantEvents_PDM_Action]
  40. #PDM_EVENT_INVADER      =embed itself into another process
  41. #PDM_EVENT_IMG_CHANGED  =load new or modified module
  42. #PDM_EVENT_APPG_ASCHILD =run process as a child of another process
  43. #PDM_EVENT_APPG_BROWSER =hidden launch of Internet browser
  44. default                 =perform suspicious actions
  45.  
  46. [ImportantEvents_PDM]
  47. #PDM_ROLLBACK_RESULT     =Rollback $(ReportInfo.nStatus,ImportantEvents_PDM_not) completed.
  48. #PDM_TERMINATE_PROCESS   =Process $(ObjectName) (PID $(nPID)) $(ReportInfo.nStatus,ImportantEvents_PDM_not) terminated.
  49. #PDM_DENY_PROCESS_ACTION =Process $(ObjectName) (PID: $(nPID)): attempt to $(EventType,ImportantEvents_PDM_Action) was denied.
  50. default                  =PDM_EVT($(ReportInfo.nEvent))
  51.  
  52. [ImportantEvents_OG_Action]
  53. #ACTION_TERMINATE=Dangerous macro command in file $(ObjectName) has been blocked.
  54.  
  55. [ImportantEvents_OG]
  56. #OBJSTATUS_ADDEDTOEXCLUDE=Exclusion rule has been created.
  57. default=$(ResultAction,ImportantEvents_OG_Action)
  58.  
  59. ;------------- SettingsWindow.Behavior_Blocking -----------
  60.  
  61. [SettingsWindow.Behavior_Blocking]
  62. StartupGroup=$General
  63. BBGroup=Application Activity Analyzer
  64. PGGroup=Application Integrity Control
  65. OGGroup=Office Guard
  66. RGGroup=Registry Guard
  67. Excludes=Exclusions...
  68.  
  69. [BBStartup_Group]
  70. Startup=Enable $Behavior_Monitor
  71.  
  72. [BB_Group]
  73. BB_Enable=Enable Application Activity Analyzer
  74. PDM_Settings=Settings...
  75.  
  76. [PG_Group]
  77. PG_Enable=Application Integrity Control
  78. PG_Settings=Settings...
  79.  
  80. [OG_Group]
  81. OG_Enable=Enable Office Guard
  82. OG_Settings=Settings...
  83.  
  84. [RG_Group]
  85. REG_Enable=Enable Registry Guard
  86. REG_Settings=Settings...
  87.  
  88. ;------------- SettingsWindow.Behavior_Blocking.PDM_Settings -----------
  89.  
  90. [SettingsWindow.Behavior_Blocking.PDM_Settings]
  91. dlg_caption=Settings: Application Activity Analyzer
  92. Settings=Events
  93. Exceptions=Exceptions
  94.  
  95. [SettingsWindow.Behavior_Blocking.PG_Settings]
  96. dlg_caption=Settings: Application Integrity Control
  97. Rules=Critical applications
  98. Shared=Trusted modules
  99. Text=Allow these common components to embed in any process:
  100. TrustSystemModules=Automatically add components signed by Microsoft Corporation to this list
  101.  
  102. [PdmRulesAction]
  103. #rga_allow     =Allow
  104. #rga_ask       =Prompt for action
  105. #rga_block     =Block
  106. #rga_terminate =Terminate
  107. #rga_alert     =Alert
  108.  
  109. [PdmRulesLog]
  110. 0=do not log
  111. 1=log
  112.  
  113. [PdmTreatType]
  114. #PDM_SET_SUSPICION   =Dangerous behaviour
  115. #PDM_SET_BROWSER     =Launching Internet browser with parameters
  116. #PDM_SET_INVADER     =Intrusion into process (invaders)
  117. #PDM_SET_HIDDENCHECK =Hidden processes (rootkit)
  118. #PDM_SET_SETWNDHOOK  =Window hooks
  119. #PDM_SET_REGSTRANGE  =Suspicious values in registry
  120. #PDM_SET_SYSCHANGE   =Suspicious system activities
  121.  
  122. [PdmSuspicionQuarantine]
  123. #rga_terminate =\  Quarantine: <a QuarantineOn v(#(bQuarantine)) enum(0,1)>$(bQuarantine,OnOff)</a>\n
  124.  
  125. [IsActionExAlert]
  126. #rgaex_alert=1
  127.  
  128. [PdmTreatDesc]
  129. #PDM_SET_SUSPICION   =$(Action,PdmSuspicionQuarantine)
  130. #PDM_SET_INVADER     =$(Action,PdmSuspicionQuarantine)
  131. #PDM_SET_HIDDENCHECK =$(Action,PdmSuspicionQuarantine)Period: <a PdmRootKitPeriod v(dialog:PdmRootKitPeriod)>$(Timeout) min</a>\n
  132.  
  133. [PDM_AppRules.TreatList]
  134. Name=Name
  135. Action=Action
  136. Log=Log
  137.  
  138. [PDM_Settings]
  139. Rule=Action: <a Action v(#(Action)) enum($(SetType,PDM_Settings_ActionsEnum))>$(Action,PdmRulesAction)</a>\n$(SetType,PdmTreatDesc)Log: <a Log v(#(bLog)) enum(0,1)>$(bLog,OnOff)</a>
  140.  
  141. [PdmRootKitPeriod]
  142. dlg_caption=Settings: Rootkit Detection
  143. Period=Please specify scan period:
  144. Min=min
  145.  
  146. [PDM_AppRules]
  147. Text=Restrict execution of the following applications:
  148. Rule=Application: <a PdmAppEdit>$(Data.ImagePath,SpecifyApplication)</a>\n   Execute: <a AppStart v(#(AppStart)) enum(#rga_allow,#rga_ask,#rga_block)>$(AppStart,PdmRulesAction)</a> + <a Log v(#(bLog)) enum(0,1)>$(bLog,PdmRulesLog)</a>\n   Content change: <a ContentChange v(#(ContentChange)) enum(#rga_allow,#rga_ask,#rga_block)>$(ContentChange,PdmRulesAction)</a> + <a ContentChangeLog v(#(bContentChangeLog)) enum(0,1)>$(bContentChangeLog,PdmRulesLog)</a>\n   Run as child: <a AppStartAsChild v(#(AppStartAsChild)) enum(#rga_allow,#rga_ask,#rga_block)>$(AppStartAsChild,PdmRulesAction)</a> + <a LogAsChild v(#(bLogAsChild)) enum(0,1)>$(bLogAsChild,PdmRulesLog)</a>
  149. Edit=Details...
  150.  
  151. [PDM_AppRules.AppList]
  152. AppName=Application
  153. Execute=Execute action
  154. Content=Content modification
  155. RunAsChild=Run as child process
  156.  
  157. [PDM_AppRules.Edit]
  158. dlg_caption=Edit Application Rule
  159. dlg_caption.new=Add Application Rule
  160. App=Application
  161. Action=Action
  162. Options=Options
  163.  
  164. [AppGuard_App_Group]
  165. AppLabel=File name:
  166. Browse=$Browse
  167. DescLabel=Description:
  168.  
  169. [AppGuard_Action_Group]
  170. ActionLabel=Action:
  171. Ask=Prompt for action
  172. AskParam=Prompt for action when run with parameters
  173. DontAsk=Do not prompt for action
  174. Block=Deny execution
  175. Notify=Display notification
  176.  
  177. [AppGuard_Options_Group]
  178. Content=Content control
  179. Log=Log
  180.  
  181. [PDM_Shared.DllList]
  182. Dll=Library
  183. Action=Action
  184. Path=Location
  185. TimeCreation=Created
  186. TimeModification=Modified
  187. Version=Version
  188. Vendor=Vendor
  189. Description=Description
  190.  
  191. [PDM_AppDllList]
  192. dlg_caption=Settings: Application Modules
  193.  
  194. [PDM_AppDllListDlg.DllList]
  195. Dll=Library
  196. Action=Action
  197. Path=Location
  198. TimeCreation=Created
  199. TimeModification=Modified
  200. Version=Version
  201. Vendor=Vendor
  202. Description=Description
  203.  
  204. [PDM_AppDllListDlg.Edit]
  205. dlg_caption=Application Module Action
  206. Text=Action:
  207.  
  208. [PDM_AppDllListDlg.Edit_Body.Value]
  209. Block=v(0)Block
  210. Allow=v(1)Allow
  211.  
  212. ;------------- SettingsWindow.Behavior_Blocking.OG_Settings -----------
  213.  
  214. [SettingsWindow.Behavior_Blocking.OG_Settings]
  215. dlg_caption=Settings: Office Guard
  216. Settings=Dangerous macros
  217. Exceptions=Exclusions
  218.  
  219. [OGSettings_Group]
  220. Info=Specify macro commands to terminate:
  221. OGActionGroup=Action
  222.  
  223. [OGSettings_Group.MacrosList]
  224. Macro=Macro command
  225. MacroDesc=Description
  226.  
  227. [OGAction_Group]
  228. Ask=Prompt for action
  229. Terminate=Terminate
  230.  
  231. [OGMacro]
  232. default=unknown
  233. 1=Import module
  234. 2=Export module
  235. 3=Copy project items
  236. 4=Copy modules (Word MacroCopy command)
  237. 5=Microsoft Office Excel sheet copy
  238. 6=Add module
  239. 7=Delete module
  240. 8=Delete project items
  241. 9=Rename project items
  242. 10=Create event procedure
  243. 11=Add code to module
  244. 12=Insert code in module from file
  245. 13=Insert code line(s)
  246. 14=Delete code line(s)
  247. 15=Replace code line(s)
  248. 16=Delete file(s)
  249. 17=Change file attributes
  250. 18=Create directory
  251. 19=Delete directory
  252. 20=Open file with write mode
  253. 21=Disable 'save normal template' prompt
  254. 22=Disable virus protection warning
  255. 23=Shell command
  256. 24=Create ActiveX object
  257. 25=Create ActiveX object on remote server
  258. 26=Gain access to ActiveX object
  259. 27=Sending keystrokes
  260. 28=API functions calls
  261.  
  262. [OGMacroDescr]
  263. default=unknown macro
  264. 1=Macro attempting to import module into project from file
  265. 2=Macro attempting to export module from project
  266. 3=Macro attempting to copy a project item from one document to another
  267. 4=Macro attempting to copy code to another macro
  268. 5=Macro attempting to copy sheet, and possibly macros attached to the sheet
  269. 6=Macro attempting to add a module to the project
  270. 7=Macro attempting to delete module
  271. 8=Macro attempting to delete a project item from the document
  272. 9=Macro attempting to rename a project item in the document
  273. 10=Macro attempting to create event
  274. 11=Macro attempting to add code
  275. 12=Macro attempting to insert code from file
  276. 13=Macro attempting to insert line(s) of code in document
  277. 14=Macro attempting to delete line(s) of code from document
  278. 15=Macro attempting to replace line(s) of code in document
  279. 16=Macro attempting to delete file(s)
  280. 17=Macro attempting to change file attributes
  281. 18=Macro attempting to create new directory
  282. 19=Macro attempting to delete directory
  283. 20=Macro attempting to open a file for writing
  284. 21=Macro attempting to disable 'save normal template' prompt
  285. 22=Macro attempting to disable virus protection warning
  286. 23=Macro attempting to execute command
  287. 24=Macro attempting to create ActiveX object
  288. 25=Macro attempting to create ActiveX object on server
  289. 26=Macro attempting to gain access to ActiveX object
  290. 27=Macro attempting to send one or more keystrokes to active window
  291. 28=Macro attempting to call API function
  292.  
  293. ;------------- SettingsWindow.Behavior_Blocking.REG_Settings -----------
  294.  
  295. [SettingsWindow.Behavior_Blocking.REG_Settings]
  296. dlg_caption=Settings: Registry Guard
  297.  
  298. [REGSettings_Group]
  299. Info=Registry key groups:
  300. NewRegGroup=New group
  301.  
  302. [REGSettings_Group.RegList]
  303. RegGroup=Name
  304. KeysCnt=Keys
  305. RulesCnt=Rules
  306.  
  307. ;------------- SettingsWindow.Behavior_Blocking.REG_Settings.Edit -----------
  308.  
  309. [SettingsWindow.Behavior_Blocking.REG_Settings.Edit]
  310. dlg_caption=Edit Group
  311. GroupName=Group name:
  312. ErrUnknown_RG_AppPath=The application name for one of the rules is undefined.
  313. ErrNoAny_RG_Apps=Invalid registry group. No application rules specified.
  314. ErrNoAny_RG_Keys=Invalid registry group. No registry keys specified for monitoring.
  315.  
  316. [GroupEdit_Tab]
  317. GroupKeys=Keys
  318. GroupRules=Rules
  319.  
  320. [RegRules_Descr_AppAny]
  321. *=Any
  322. default=This
  323.  
  324. [RegRules_Descr_App]
  325. *=
  326. default=: <a rgAppEdit v(browse:app(Data.ImagePath,Data.Hash))>$(@,SpecifyApplication)</a>
  327.  
  328. [GroupRules_Page]
  329. Add=New
  330. Rule=Restrict access to this registry key group according to the following rule:\n   <a AnyImagePath v(browse:anyapp(Data.ImagePath,Data.Hash))>$(Data.ImagePath,RegRules_Descr_AppAny)</a> application$(Data.ImagePath,RegRules_Descr_App)\n   Read: <a DoRead v(#(DoRead)) enum(#rga_allow,#rga_ask,#rga_block)>$(DoRead,PdmRulesAction)</a> + <a LogRead v(#(bLogRead)) enum(0,1)>$(bLogRead,PdmRulesLog)</a>\n   Modify: <a DoEdit v(#(DoEdit)) enum(#rga_allow,#rga_ask,#rga_block)>$(DoEdit,PdmRulesAction)</a> + <a LogEdit v(#(bLogEdit)) enum(0,1)>$(bLogEdit,PdmRulesLog)</a>\n   Delete: <a DoDelete v(#(DoDelete)) enum(#rga_allow,#rga_ask,#rga_block)>$(DoDelete,PdmRulesAction)</a> + <a LogDel v(#(bLogDel)) enum(0,1)>$(bLogDel,PdmRulesLog)</a>
  331.  
  332. [GroupKeys_Page.KeysList]
  333. KeyName=Key path
  334. KeyValue=Value
  335.  
  336. [RegKeysIcon]
  337. 0=i(unkobj,nonrecursive)
  338. default=i(unkobj)
  339.  
  340. [GroupRules_Page.RulesList]
  341. AppClmn=Application
  342. ReadClmn=Read
  343. EditClmn=Modify
  344. DeleteClmn=Delete
  345.  
  346. ;------------- SettingsWindow.Behavior_Blocking.Excludes -----------
  347.  
  348. [SettingsWindow.Behavior_Blocking.Excludes]
  349. dlg_caption=Exclusions
  350. Info=Assign file masks to be excluded from protection:
  351.  
  352. ;------------- PdmCalcHash -----------
  353.  
  354. [PdmCalcHash]
  355. dlg_caption=Settings: Calculating hash
  356.  
  357. ;------------- RegMakeRule -----------
  358.  
  359. [RegMakeRule]
  360. dlg_caption=Create Allow Rule
  361. ForApp=For key
  362. ForAll=For group
  363. ForIns=For this application instance only
  364.  
  365. ;------------- PdmMakeRule -----------
  366.  
  367. [PdmMakeRule]
  368. dlg_caption=Add Module to Trusted List
  369. ForApp=This module only
  370. ForAll=Any module loaded by this process
  371.  
  372. ;------------------ ReportWindow -------------
  373.  
  374. [Report_Body.StatisticsLeft.bb]
  375. PDMScaned=Events checked:
  376. PDMBlocked=Blocked:
  377. OGScaned=Macros checked:
  378. OGTerminated=Macros terminated:
  379.  
  380. [Report_Body.ReportDetails.bb]
  381. EventsPDM=Events
  382. EventsOG=Macros
  383. EventsRG=Registry
  384.  
  385. [BB_Events_Allowed]
  386. #OBJSTATUS_NOTPROCESSED=\ (by exclusions)
  387.  
  388. [BB_Events]
  389. #PDM_HISTORY_PROCESSING   = History processing$(ReportInfo.nError,BB_EventError)
  390. #PDM_ROLLBACK_ACTION      = Rollback$(ReportInfo.nError,BB_EventError)
  391. #PDM_ROLLBACK_RESULT      = Rollback completed$(ReportInfo.nStatus,=,#PDM_STATUS_OK,!,BB_Events_RollbackResult)
  392. #PDM_CREATE_HISTORY_FOLDER= History initialization
  393. #PDM_TERMINATING_PROCESS  = Attempting to terminate process
  394. #PDM_TERMINATE_PROCESS    = Attempting to terminate process: $(ReportInfo.nError,BB_Events_TerminateProcess)
  395. #PDM_ALLOW_PROCESS_ACTION = $(EventType,PDM_IsDetailsExist,PDMEventLog_Action,removetags) Action allowed$(ObjectStatus,BB_Events_Allowed)
  396. #PDM_DENY_PROCESS_ACTION  = $(EventType,PDM_IsDetailsExist,PDMEventLog_Action,removetags) Action denied.
  397. #PDM_DETECT               = $(EventType,PDM_IsDetailsExist,PDMEventLog_Action,removetags)
  398. #PDM_QUARANTINE_RESULT    = Error moving to Quarantine
  399. default                   = UNK_EVENT($(ReportInfo.nEvent))
  400.  
  401. [BB_Events_RollbackResult]
  402. 0       = 
  403. default =\ with some errors
  404.  
  405. [BB_Events_TerminateProcess]
  406. 0       = success
  407. default = $(@,SystemError)
  408.  
  409. [PDM_Report.EventsLog]
  410. ObjectName=Name
  411. ObjectEvent=Event
  412. ReportTime=Time
  413.  
  414. [OG_Status]
  415. #ACTION_ALLOW        =i(ok)allowed$(ObjectStatus,BB_Events_Allowed)
  416. #ACTION_TERMINATE    =i(error)blocked
  417. default              =i(warning)unknown ($(@))
  418.  
  419. [REG_DataTypes]
  420. #REG_NONE                       = No value type
  421. #REG_SZ                         = Unicode null-terminated string
  422. #REG_EXPAND_SZ                  = Unicode null-terminated string (with environment variable references)
  423. #REG_BINARY                     = Free form binary
  424. #REG_DWORD                      = 32-bit number
  425. #REG_DWORD_BIG_ENDIAN           = 32-bit number
  426. #REG_LINK                       = Symbolic Link (unicode)
  427. #REG_MULTI_SZ                   = Multiple Unicode strings
  428. #REG_RESOURCE_LIST              = Resource list in the resource map
  429. #REG_FULL_RESOURCE_DESCRIPTOR   = Resource list in the hardware description
  430. #REG_RESOURCE_REQUIREMENTS_LIST = 
  431. #REG_QWORD                      = 64-bit number
  432.  
  433. [PdmRegObjectStatus]
  434. 1       = i(warning)detected
  435. default = $(ResultAction,AskAction_AllowDeny)
  436.  
  437. [OG_Report.EventsLog]
  438. ObjectName=Name
  439. ObjectStatus=Status
  440. ReportTime=Time
  441.  
  442. [RG_Report.EventsLog]
  443. App=Application
  444. KeyName=Key name
  445. ValueName=Value name
  446. Data=Data
  447. Type=Data type
  448. RegOpType=Operation
  449. ObjectStatus=Status
  450. ReportTime=Time
  451.  
  452. [REG_OpType_New]
  453. #REG_NONE           = Create
  454. default             = Modify
  455.  
  456. [REG_OpType]
  457. #eRegRequest_Modify = $(ValueTypeOld,REG_OpType_New)
  458. #eRegRequest_Read   = Read
  459. #eRegRequest_Delete = Delete
  460.  
  461. ;------------- AlertDialog.Behavior_Blocking -----------
  462.  
  463. [AlertDialog_PRM_DontCheckNames]
  464. #PDM_EVENT_REGMODIFY      =Add to Trusted Applications...
  465. #PDM_EVENT_IMG_CHANGED    =Add to Shared dll List...
  466. default                   =Add to Trusted Zone...
  467.  
  468. [AlertDialog_PDM_Event]
  469. #PDM_ROLLBACK_ACTION   =Process terminated by user. It is recommended to rollback the changes made to the system.
  470. #PDM_ROLLBACK_RESULT   =Rollback failed.
  471. #PDM_TERMINATE_PROCESS =Process cannot be terminated: $(ReportInfo.nError,SystemError).
  472. #PDM_QUARANTINE_RESULT =Error moving to Quarantine.
  473. default                =$(EventType,AlertDialog_Description_PDM)
  474.  
  475. [AlertDialog_Description_PDM]
  476. #PDM_EVENT_P2P_SC_RDL     =Process seems to be a network worm.
  477. #PDM_EVENT_SC_AR          =Process is trying to register its copy as startup autorun object. This behaviour is typical of Trojans.
  478. #PDM_EVENT_SC_ARsrc       =Process is trying to register its copy as startup autorun object. This behaviour is typical of Trojans.
  479. #PDM_EVENT_SC2STARTUP     =Process is trying to register its copy as startup autorun object. This behaviour is typical of Trojans.
  480. #PDM_EVENT_SCN            =Process seems to be a P2P worm.
  481. #PDM_EVENT_SC_MULTIPLE    =Process seems to be a P2P worm.
  482. #PDM_EVENT_P2P_SCN        =Process is trying to copy itself to network.
  483. #PDM_EVENT_RDR            =Process is trying to redirect data input/output.
  484. #PDM_EVENT_REGMODIFY      =Process is trying to gain $(RegOpType,REG_AlertOperation) access to $(strUserDescription,REG_AlertText).
  485. #PDM_EVENT_HIDDEN_OBJ     =Hidden process (rootkit) detected. Rootkits try to ensure that malicious programs they hide are never discovered.
  486. #PDM_EVENT_INVADER        =Process is trying to inject into another process. This behaviour is typical of some malicious programs.
  487. #PDM_EVENT_INVADER_LOADER =Process is trying to inject module into all processes. This behaviour is typical of some malicious programs.
  488. #PDM_EVENT_APPG           =Attempt to run critical application.
  489. #PDM_EVENT_APPG_CHANGED   =This application's executable file has been changed$(strUserDescription,AlertDialog_PDM_UserDescription).
  490. #PDM_EVENT_IMG_CHANGED    =Attempt to load new or modified module <b>$(NewImage.ImagePath,objfile)</b>.
  491. #PDM_EVENT_APPG_ASCHILD   =Attempt to run process as a child of another process.
  492. #PDM_EVENT_APPG_BROWSER   =Attempt to run browser with command line parameters.
  493. #PDM_EVENT_STRANGEKEY     =Process is trying to $(RegOpType,REG_AlertOpType) value with illegal names.
  494. #PDM_EVENT_SYSCHANGE      =Critical system activity suspicion detected.
  495. #PDM_EVENT_HIDDEN_INSTALL =Running hidden installation into system.
  496. #PDM_EVENT_BUFFEROVERRUN  =Buffer overrun code execute detected. This behaviour is typical of some malicious programs.
  497. #PDM_EVENT_DEP            =Data execute detected. This behaviour is typical of some malicious programs.
  498. default                   =Process is performing suspicious actions
  499.  
  500. [RegOldValueText]
  501. #REG_NONE =
  502. default   = \n<b>Data($(ValueTypeOld,REG_DataTypes)):</b>\n$(ValueOld,reg_data)\n
  503.  
  504. [REG_AlertText]
  505. System Startup                =list of modules executed during Windows startup
  506. Internet Security            =Internet security settings
  507. Internet Explorer Settings    =Internet Explorer settings
  508. Internet Explorer Plugins    =Internet Explorer.add-ons settings
  509. System Security                =system security settings
  510. HOSTS file                    =path to TCP/IP routing settings
  511. System Services                =list of system services
  512. default                        =group $(strUserDescription)
  513.  
  514. [REG_DetailsText]
  515. System Startup                = \ These keys control the list of modules executed during Windows startup.\n\nYou are advised to grant access to these settings only if you are sure you want to allow this program to run automatically when your computer starts. Otherwise it is better to deny access.
  516. Internet Security            = \ These keys control Internet security settings.\n\nYou are advised to grant access to these settings only if you are sure you want to allow these settings to be modified. Otherwise it is better to deny access.
  517. Internet Explorer Settings    = \ These keys control Internet Explorer settings.\n\nYou are advised to grant access to these settings only if you are sure you want to allow these settings to be modified. Otherwise it is better to deny access.
  518. Internet Explorer Plugins    = \ These keys control Internet Explorer.add-ons settings.\n\nYou are advised to grant access to these settings only if you are sure you want to allow this module to be registered as an Internet Explorer add-on. Otherwise it is better to deny access.
  519. System Security                = \ These keys control system security settings.\n\nYou are advised to grant access to these settings only if you are sure you want to allow these settings to be modified. Otherwise it is better to deny access.
  520. HOSTS file                    = \ These keys control the path to TCP/IP routing settings.\n\nYou are advised to deny write access to these settings, since there is no reason for any trustworthy application to change this path.
  521. System Services                = \ These keys controls the list of system services.\n\nYou are advised to grant access to these settings if you want to install/uninstall a driver or system service, and to deny access in other cases.
  522.  
  523. [AlertDetailsPDM_AddInfo_Text]
  524. #PDM_EVENT_REGMODIFY      =Process is trying to $(RegOpType,REG_AlertOpType) value in system registry key that belongs to group <b>$(strUserDescription)</b>.$(strUserDescription,REG_DetailsText)\n\n<b>Key:</b> $(strKeyName)\n\n<b>Value:</b> $(strValueName)\n$(ValueTypeOld,RegOldValueText)\n<b>$(RegOpType,RegValueDataNew)($(ValueType,REG_DataTypes)):</b>\n$(Value,reg_data)
  525. #PDM_EVENT_INVADER        =Process <b>$(ObjectName) (PID: $(nPID))</b> is trying to inject into process <b>$(strDestObjectName) (PID: $(DestPID))</b>.
  526. #PDM_EVENT_IMG_CHANGED    =Attempt to load new or modified module <b>$(NewImage.ImagePath)</b> into process$(strUserDescription,AlertDialog_PDM_UserDescription).
  527. #PDM_EVENT_APPG_ASCHILD   =Attempt to run process as a child of <b>$(strParentObjectName) (PID: $(nParentPID))</b>.
  528. #PDM_EVENT_APPG_BROWSER   =Attempt to run browser with command line parameters: <b>$(strUserDescription)</b>.
  529. #PDM_EVENT_INVADER_LOADER =Process is trying to inject module <b>$(NewImage.ImagePath)</b> into all processes.
  530. #PDM_EVENT_STRANGEKEY     =Process is trying to $(RegOpType,REG_AlertOpType) value <b>$(strValueName)</b> with illegal names.
  531. #PDM_EVENT_SYSCHANGE      =$(strUserDescription,AlertDetails_PDM_SysChange)
  532. #PDM_EVENT_HIDDEN_INSTALL =Program module <b>$(strUserDescription)</b> installed and $(strKeyName,!!,AlertDetails_PDM_HiddenInstall) without user interaction. This activity is similar to Trojan Downloader/Dropper.
  533. #PDM_EVENT_BUFFEROVERRUN  =Buffer overrun code execute detected.
  534. #PDM_EVENT_DEP            =Data execute detected.
  535.  
  536. [AlertDetails_PDM_SysChange]
  537. SYSCALL_CHANGED           = System entry point R3-R0 changed.\n\n<b>Old address:</b>\t0x$(OldAddr)\n<b>New address:</b>\t0x$(NewAddr)
  538. PHYSICAL_MEMORY_ACCESS    = Physical memory access.
  539.  
  540. [AlertDetails_PDM_HiddenInstall]
  541. 1       = registering in registry key <b>$(strKeyName)</b> with value <b>$(strValueName)</b>
  542. default = running
  543.  
  544. [AlertDetails_PDM]
  545. DllList=Modules
  546. ChildProcs=Child processes
  547.  
  548. [AlertDetailsPDM_ChildProcs_List]
  549. ImagePath=Path
  550. PID=PID
  551. CommandLine=Command line
  552.  
  553. ;------------- AlertDialog.Behavior_Blocking.PDM -----------
  554.  
  555. [AlertDetailsPDM_Modules]
  556. DllPath=Module:
  557. DllSize=Size:
  558. DllTimeCr=Created:
  559. DllTimeMdf=Modified:
  560. DllVersion=Version:
  561. DllVendor=Vendor:
  562. DllDescription=Description:
  563.  
  564. [AlertDetailsPDM_DllList]
  565. DllPath=Module
  566. DllInUse=In use
  567. DllSize=Size
  568. DllTimeCr=Created
  569. DllTimeMdf=Modified
  570. DllVersion=Version
  571. DllVendor=Vendor
  572. DllDescription=Description
  573.  
  574. ;------------- AlertDialog.Behavior_Blocking.REG -----------
  575.  
  576. [REG_AlertOpType_New]
  577. #REG_NONE           = create
  578. default             = modify
  579.  
  580. [REG_AlertOpType]
  581. #eRegRequest_Modify = $(ValueTypeOld,REG_AlertOpType_New)
  582. #eRegRequest_Read   = read
  583. #eRegRequest_Delete = delete
  584.  
  585. [RegValueDataNew]
  586. #eRegRequest_Modify = New data
  587. default             = Data
  588.  
  589. [REG_AlertOperation]
  590. #eRegRequest_Read   = read
  591. default             = write
  592.  
  593.