The Anti-virus Times

Tuesday, July 3, 2018

Windows 10 x68 Home, Dr.Web Security Space.
TeamViewer is installed on the computer. I need to change
Dr.Web Security Space policies. Whenever I try to change
the policies via TeamViewer, keyboard and mouse input
gets blocked. Is it supposed to work this way?

A question for Doctor Web’s tech support

Here we are talking about a Dr.Web feature that usually goes unnoticed by users. Data often gets leaked or stolen when an attacker gains remote access to a system they’ve attacked. This doesn't mean that a hacker is sitting next to a computer with his keyboard connected to it. Remote access is facilitated by special software that has either been installed on the victim’s computer before the attack or has been deployed by a threat actor. A hacker may use the software to track user activity or take action themselves.

On more than one occasion, we’ve advised users to password protect their anti-virus settings (not with the user account password). This makes it impossible for an attacker to change access permissions or delete data backups.

But let's assume that a hacker has gotten hold of your password (or you never used a password) and opens the settings remotely—and suddenly it appears that they can't do anything else. This effect is achieved by the self-protection feature that can be enabled by pressing the toggle button Block user activity emulation.

The self-protection prevents Dr.Web settings from being changed via other applications. It also blocks scripts that simulate keyboard and mouse events.