Reply to thread

Message

<blockquote data-quote="bogdan" data-source="post: 5806" data-attributes="member: 2">Default Settings: When you run an application that is not digitally signed, and it is not a known malicious application (according to signatures) KIS will first look for that application in the Kaspersky Security Network. According to the information it finds there it will place the application in a group. If the application is not found inside the Kaspersky Security Network, KIS uses heuristics to determine the group. It analyzes the application for 30 seconds. If this time interval turns out to be insufficient for defining the threat rating, the application is included into the Low restricted group, while defining the threat rating continues in background mode.So setting &quot;Move to the following group&quot; to &quot;Untrusted&quot; won&#039;t place every unknown file there, just the ones that KIS doesn&#039;t find in the Security Network. Nevertheless, I still find that i need to manually move many good applications from Untrusted to something else.Also the Low Restricted group will leave a considerable number of &quot;doors&quot; opened. Running the Comodo Leak Test as Low Restricted returns a score of 160/340. Running CLT as High restricted improved the score to 280/340.According to the above arguments, I feel that changing &quot;Move to the following group&quot; to &quot;Low Restricted&quot; will potentially result in a lower protection level than the default settings and I do not recommend it. I would rather leave KIS use heuristics to determine the right group.I also have mixed feelings about the &quot;Trust applications with digital signature&quot; setting. According to this tutorial that setting should remain checked, but the number of digitally signed apps that are malicious seems to be growing, so for maximum protection, I would disable that setting too.</blockquote>

[QUOTE="bogdan, post: 5806, member: 2"] [u]Default Settings:[/u] When you run an application that is not digitally signed, and it is not a known malicious application (according to signatures) KIS will first look for that application in the Kaspersky Security Network. According to the information it finds there it will place the application in a group. [i]If the application is not found inside the Kaspersky Security Network[/i], KIS uses heuristics to determine the group. It analyzes the application for 30 seconds. If this time interval turns out to be insufficient for defining the threat rating, the application is included into the [i]Low restricted[/i] group, [i]while defining the threat rating continues in background mode[/i]. So setting "Move to the following group" to "Untrusted" won't place every unknown file there, just the ones that KIS doesn't find in the Security Network. Nevertheless, I still find that i need to manually move many good applications from Untrusted to something else. Also the Low Restricted group will leave a considerable number of "doors" opened. Running the Comodo Leak Test as Low Restricted returns a score of 160/340. Running CLT as High restricted improved the score to 280/340. According to the above arguments, I feel that changing "Move to the following group" to "Low Restricted" will potentially result in a lower protection level than the default settings and I do not recommend it. I would rather leave KIS use heuristics to determine the right group. I also have mixed feelings about the "Trust applications with digital signature" setting. According to this tutorial that setting should remain checked, but the number of digitally signed apps that are malicious seems to be growing, so for maximum protection, I would disable that setting too. [/QUOTE]

Verification