The System Watcher includes:

• Automatic Exploit Prevention technology, which prevents and blocks the actions of exploits.
• Application Privilege Control, which performs an action specified in the component settings when it detects suspicious application behavior.
• Protection against screen lockers, which detects and removes screen lockers when you press a set key combination on the keyboard.
• Rollback of malware actions. Information about suspicious actions in the system is collected not only for the current session, but also for previous sessions. This allows to roll back all actions performed by the application if it is subsequently recognized as malicious.
• Protection against cryptoviruses. Cryptoviruses are a type of malware that encrypts your files and demands a ransom. When a cryptovirus attempts to encrypt a file, the Kaspersky product automatically creates a backup copy of the file before it is affected. If the file gets encrypted, the product restores it from a backup copy.
  Please note:
  • Backup copies are stored in the system Temp folder (temporary files storage). The backup copy is not created if there is not enough space on the system disk, so please keep at least 10-15% of the disk C space empty.
    
  • Backup copies are removed when Kaspersky Anti-Virus 2018 is closed or System Watcher is disabled (backup copies are not removed if the application is stopped unexpectedly). If necessary, you can remove backup copies manually by deleting the contents of the Temp folder.

1. In the main window of Kaspersky Anti-Virus 2018, click the gear button .

1. If you have problems opening the application window, see this guide.

2. Go to Settings → Protection and click the switch in the right frame to enable or disable System Watcher.

1. In the main window of Kaspersky Anti-Virus 2018, click the gear button .

1. If you have problems opening the application window, see this guide.

2. Go to the Protection section in the Settings window and select System Watcher.

3. In the System Watcher settings view, you can:
   • Select an action to be performed upon exploit detection.
   • Select an action to be performed upon detection of malware activity.
   • Roll back unwanted changes when possible.
   • Adjust the keyboard combination that enables Protection against screen lockers.