;------------- proactive defense --------------

[Behavior_Blocking2_Body]
Status=Status

[Behavior_Blocking2_Status]
StatusBB2=Application Activity Analyzer:
StatusRG2=Registry Guard:

[Behavior_Blocking2_Statistics]
PDM2Scaned=Events checked:
PDM2Blocked=Blocked:

;------------- SettingsWindow.Behavior_Blocking2 -----------

[SettingsWindow.Behavior_Blocking2]
StartupGroup=$General
BB2Group=Application Activity Analyzer
RG2Group=Registry Guard

;[SettingsWindow.Behavior_Blocking2.BB2_Group]
[BB2_Group]
BB_Enable=Enable A&pplication Activity Analyzer
PDM2_Settings=&Settings...

[RG2_Group]
REG2_Enable=Enable &Registry Guard
REG2_Settings=Se&ttings...

;------------- SettingsWindow.Behavior_Blocking2.PDM2_Settings -----------

[SettingsWindow.Behavior_Blocking2.PDM2_Settings]
dlg_caption=Settings: Application Activity Analyzer
Event   =Events
Action  =Action
Log     =Report
$SuspiciousActivity=Dangerous behaviour
Settings=General
WatchSystemAccount=Watch system user accounts
Rule    =Action: <a Action v(#(Action)) enum(#PDM2_ALLOW,#PDM2_ASK,#PDM2_BLOCK,#PDM2_TERMINATE)>$(Action,PDM2Action)</a>\nLog: <a Log v(#(bLog)) enum(0,1)>$(bLog,OnOff)</a>

[PDM2Action]
#PDM2_ALLOW     = Allow
#PDM2_ASK       = Prompt for action
#PDM2_BLOCK     = Block
#PDM2_TERMINATE = Terminate

;------------- SettingsWindow.Behavior_Blocking2.REG2_Settings -----------

[SettingsWindow.Behavior_Blocking2.REG2_Settings]
dlg_caption=Registry key groups

[REG2Settings_Group]
Info=Registry key groups:
NewRegGroup=New group

[REG2Settings_Group.RegList]
RegGroup=Name
KeysCnt=Keys
RulesCnt=Rules


;------------- SettingsWindow.Behavior_Blocking2.REG2_Settings.Edit -----------

[SettingsWindow.Behavior_Blocking2.REG2_Settings.Edit]
dlg_caption=Edit group
GroupName=Group name:
ErrUnknown_RG_AppPath=The application name for one of the rules is undefined.
ErrNoAny_RG_Apps=Invalid registry group. No application rules specified.
ErrNoAny_RG_Keys=Invalid registry group. No registry keys specified for monitoring.

[REG2_GroupEdit_Tab]
GroupKeys=Keys
GroupRules=Rules

[REG2_GroupRules_Page]
Add=New
Rule=Restrict access to this registry key group according to the following rule:\n   <a AnyImagePath v(browse:anyapp(ApplicationExeWildcard))>$(ApplicationExeWildcard,RegRules_Descr_AppAny)</a> application$(ApplicationExeWildcard,RG2Rules_Descr_App)\n   Read: <a v(#(ActionOnRead)) enum(#RG2A_ALLOW,#RG2A_PROMPT,#RG2A_BLOCK)>$(ActionOnRead,RG2RulesAction)</a> + <a v(#(bLogRead)) enum(0,1)>$(bLogRead,PdmRulesLog)</a>\n   Modify: <a v(#(ActionOnWrite)) enum(#RG2A_ALLOW,#RG2A_PROMPT,#RG2A_BLOCK)>$(ActionOnWrite,RG2RulesAction)</a> + <a v(#(bLogWrite)) enum(0,1)>$(bLogWrite,PdmRulesLog)</a>\n   Delete: <a v(#(ActionOnDelete)) enum(#RG2A_ALLOW,#RG2A_PROMPT,#RG2A_BLOCK)>$(ActionOnDelete,RG2RulesAction)</a> + <a v(#(bLogDelete)) enum(0,1)>$(bLogDelete,PdmRulesLog)</a>

[REG2_GroupKeys_Page.KeysList]
KeyName=Key path:
KeyValue=Value:

[REG2_GroupRules_Page.RulesList]
AppClmn=Application
ReadClmn=Read
EditClmn=Modify
DeleteClmn=Delete

[RG2RulesAction]
#RG2A_ALLOW=Allow
#RG2A_PROMPT=Prompt for action
#RG2A_BLOCK=Block

[RG2Rules_Descr_App]
*=
default=: <a rgAppEdit v(browse:app(ApplicationExeWildcard))>$(@,SpecifyApplication)</a>

;------------- AlertDialog.Behavior_Blocking2 -----------

[AlertDialog_PDM2_Event]
;#PDM2_ACTION_ASK               =
;#PDM2_ACTION_DETECT            =
#PDM2_ACTION_ROLLBACK          =Process terminated by user. You are advised to rollback the changes made to the system.
#PDM2_ACTION_TERMINATE_FAILED  =Process cannot be terminated: TODO: (откуда взять error code?,SystemError).
#PDM2_ACTION_ROLLBACK_RESULT   =Rollback failed.
#PDM2_ACTION_TERMINATE_INFO    =Process terminated by user.
#PDM2_ACTION_QUARANTINE_FAILED =Error moving to Quarantine.
default                        = $(EventType,AlertDialog_Description_PDM2)

[AlertDialog_Description_PDM2]
#PDM2_EVENT_P2P_SC_RDL     = Process seems to be a network worm.
#PDM2_EVENT_SC_AR          = Process is trying to register its copy as an autorun startup object. This behaviour is typical of Trojans.
#PDM2_EVENT_SC_ARsrc       = Process is trying to register its copy as an autorun startup object. This behaviour is typical of Trojans.
#PDM2_EVENT_SCN            = Process seems to be a P2P worm.
#PDM2_EVENT_P2P_SCN        = Process is trying to copy itself to network.
#PDM2_EVENT_SC2STARTUP     = Process is trying to register its copy as an autorun startup object. This behaviour is typical of Trojans.
#PDM2_EVENT_SC_MULTIPLE    = Process seems to be a P2P worm.
#PDM2_EVENT_RDR            = Process is trying to redirect data input/output.
#PDM2_EVENT_HIDDEN_OBJ     = Hidden process (rootkit) detected. Rootkits try to hide associated malicious programs.
#PDM2_EVENT_INVADER        = Process is trying to inject into another process. This behaviour is typical of some malicious programs.
#PDM2_EVENT_INVADER_LOADER = Process is trying to inject module into all processes. This behaviour is typical of some malicious programs.
#PDM2_EVENT_SYSCHANGE      = Critical system activity suspicion detected.
#PDM2_EVENT_HIDDEN_INSTALL = Running hidden installation into system.
#PDM2_EVENT_BUFFEROVERRUN  = Buffer overrun code execute detected. This behaviour is typical of some malicious programs.
#PDM2_EVENT_DEP            = Data execute detected. This behaviour is typical of some malicious programs.
#PDM2_EVENT_HOSTS		   = 'Hosts' file has been changed. This file defines network address mapping.
#PDM2_EVENT_DOWNLOADER	   = An attempt has been made to run a module recently downloaded from the internet. This behaviour is peculiar to Trojan Downloader malware.
#PDM2_EVENT_TROJAN_GEN	   = $(EventSubType,AlertDialog_Description_PDM2_TROJAN_GEN)
#PDM2_EVENT_DRIVER_INS     = Process is trying to install driver and gain full access to operating system. Security control will not be available anymore.
;#PDM2_EVENT_HIDDEN_SEND    = ?
#PDM2_EVENT_PSTORE         = Process is trying to get access to personal data or passwords.
default                   = Process is performing suspicious actions.

[AlertDialog_Description_PDM2_TROJAN_GEN]
#PDM2_SUBEVENT_CRYPTOR    = Process is trying to encrypt personal data. This behaviour is typical of Trojan programs.
default                   = Process is performing suspicious actions. This behaviour is typical of Trojan programs.

[PDM2_ProcInfo]
dlg_caption=Information on process $(CurrentProcess.ImagePath,objfile)
ProcessInfo=Process
ParentProcessInfo=Parent process
ChildProcessInfo=Child processes
$Process=Process
$CommandLine=Command line
$StartTime=Start time
$StopTime=Stop time
$Version=Version
$Vendor=Vendor
$Description=Description

;------------- AlertDialog.Behavior_Blocking2.RegGuard2 -----------

[REG2_AlertOperation]
#RG2OpRead   = read
#RG2OpWrite  = write
#RG2OpDelete = delete
default      = write

;------------- Report -----------

[Report_Body.StatisticsLeft.bb2]
PDMScaned=Events checked:
PDMBlocked=Blocked:

[Report_Body.ReportDetails.bb2]
EventsPDM=Events
EventsRG=Registry

[PDM2_Report.EventsLog]
ReportTime=Time
ObjectName=Name
ObjectEvent=Event

[PDM2_ReportAction]
#PDM2_ACTION_ASK=$(ResultAction,PDM2_ReportUserAction)
default=$(@,AlertDialog_PDM2_Event,removetags)
 
[PDM2_ReportUserAction]
#ACTION_REPORTONLY="Allow" action chosen
#ACTION_ALLOW     ="Allow" action chosen
#ACTION_DENY      ="Block" action chosen
#ACTION_TERMINATE ="Terminate process" action chosen
#ACTION_QUARANTINE="Move to quarantine" action chosen
default=Error in [PDM2_ReportUserAction] $(@)

[RG2_Report.EventsLog]
ReportTime=Time
App=Application
KeyName=Key
ValueName=Value name
Data=Data
Type=Data type
RegOpType=Operation type
ObjectStatus=Status

[RG2_OpType]
#RG2OpRead   = Read
#RG2OpWrite  = write
#RG2OpDelete = Delete
