Kaspersky 2016 Suggestion/Info

[Deleted member 2913]

I tried KIS 2016 latest on Win 10 64.

Few queries -
1. I see alerts are Windows type alerts & not Kaspersky GUI type alerts, anyway to get KIS GUI type alerts?
2. I see it has ads/tracking, etc.., how good is it? Is it good enough to replace programs like ABP, uBlock Origin, etc...?

HTTPS scan -
I dont like HTTPS scanning. I see it is required for safe money, url advisor, etc...
I in a way liked the implementation of HTTPS scan in KIS...it is not used for all the websites.

HTTPS scan ---
I opened a bank website...checked the certificate & it was Kaspersky cert. KIS asked to open the website in protected browser & I did so. In the protected browser I checked the certificate & it was not Kaspersky cert but original cert...thats good.
So why HTTPS scan enabled is needed for safe money? Coz websites under safe money use original certs & not Kaspersky certs.

And I tried few HTTPS websites & all showed original certs. Only bank websites showed Kaspersky certs but under safe money browser bank websites too showed original certs.

So I am little confused how HTTPS scan in KIS works & on what websites it works? Coz as mentioned above all the HTTPS websites I tried showed original certs. Only Google search showed Kaspersky certs.

So why HTTPS scan enabled is needed for safe money, url advisor, etc..? Coz if HTTPS websites are using original certs & not Kaspersky certs then it means those websites are not scanned, m I right?

 

[harlan4096]

I guess You are using KIS2016MR1 16.0.1.445a...

1.- There are both types of notifications, some are in new Windows 10 way (new Microsoft recomendations) and others are the Kaspersky GUI usual notifications as always. Change KIS2016 to Interactive Mode and You will see them

2.- It's good but not enough to replace add-ons in browsers, so I use Anti-Banner enabled alongside with uBlock Origin in my FireFox.

About HTTPS in Kaspersky and Safe Money, better You read some of this links to see how Safe Money works:

http://www.kaspersky.com/downloads/pdf/kaspersky_lab_whitepaper_safe_money_eng_final.pdf
How to configure Safe Money in Kaspersky Internet Security 2014 (Step 1).
How to configure and use Safe Money in Kaspersky Total Security 2016
Reasons for the Invalid Certificate error in the Safe Money component of Kaspersky Internet Security 2015

Personally I have "Always scan encrypted connection" enabled... if some application or service does not work properly, just ad an exclusions for encrypted traffic and does the trick. And in 2016 They have added support for HTTP/2 protocol.

Taken from contextual Kaspersky Help:

Analyze encrypted connections if requested protection components

Kaspersky Total Security uses the installed Kaspersky Lab's certificate to verify security SSL connections only if required components Web Anti-Virus protection, parental control, URL and Safe Money Advisor. If protection components Parental Controls and Safe Money Advisor URL are disabled, Kaspersky Total Security does not verify the security of SSL connections.

This option is selected by default.


If the option is selected, Kaspersky Total Security always uses the Kaspersky Lab certificate installed to ensure that the connections are secure.

The use of Secure Sockets Layer protocol (SSL) for connections to exchange data with Internet security. The SSL protocol allows identifying the parties exchanging data using electronic certificates, encrypt the data during transfer and ensure their integrity during the transfer.

If Kaspersky Total Security detects an invalid when connecting to a server certificate (eg., When the certificate has been replaced by someone with malicious intent), the application displays a notification asking you to accept or reject the certificate, or simply you see the information on the certificate. If Kaspersky Total Security runs in self-protection mode, it terminates the connection using an invalid certificate automatically without notification.

 

[Deleted member 2913]

Interactive Mode will give alert instead of auto-quarantine, right?

Does setting to interactive mode, all the alerts will appear in KIS GUI type?

 

[harlan4096]

Yes but not all alerts will be in KIS GUI, still there will be alerts also in new W10 way...

 

[Deleted member 2913]

harlan,

In Virus Exchange thread I see you test & post results with KIS, is it possible to test with KES?

 

[harlan4096]

Yes, I test there with KIS2016MR1a in Auto-Mode, and almost default settings, because they are the settings for commons users. In Interactive Mode KIS2016 would be even stronger, but It's me (the user) who would decide in every warning/notification what to do so it would not be an impartial test...

Sure, You may test KES also, always following the new Hub rules, why not?

 

[Deleted member 2913]

harlan,

I mean is it possible for you to test with KES instead of KIS?

Currently here only 1 family shared laptop. Other laptop is damaged. So not possible to do tests.

 

[harlan4096]

I have KES10 in my laptop, well not using it to test, but actually not working with it, so maybe I can publish also some malware tests with KES10 from time to time, always depending on my free time

 

[Deleted member 2913]

I have KES10 in my laptop, well not using it to test, but actually not working with it, so maybe I can publish also some malware tests with KES10 from time to time, always depending on my free time

Will be looking forward to those time to time tests.

 

[harlan4096]

haha ok!

 

[Tony Cole]

I use KIS 2016 with AppGuard this is very powerful and will stop with dropper cruelsister demonstrated boot-time protection.

 

[harlan4096]

About Kaspersky Boot-Protection issue, I reported also it by several channels (internal) & external, I asked in beta thread:

Kaspersky 365\KAV\KIS\KTS: Application Control (HIPS, SW, Firewall, IDS, TAM) - Kaspersky Lab Forum

About AppGuard, I haven't tested yet... maybe soon I will give a try, freeware for personal use?.

 

[shmu26]

what are recommended tweaks for Kaspersky?
Or best to leave it on default settings?

 

[jamescv7]

@shmu26: Usually the protection components are fine at its default. The Application Control must tweak a little more to meet the effectiveness. ( link )

 

[harlan4096]

These are mine: PC: SECURE - harlan4096's config

 

[shmu26]

@shmu26: Usually the protection components are fine at its default. The Application Control must tweak a little more to meet the effectiveness. ( link )

could I use an anti-executable, such as SAP, instead of Kaspersky Application Control?
It looks like the same basic idea, but easier to manage.

 

[harlan4096]

I can't help You there, never tested...

 

[shukla44]

could I use an anti-executable, such as SAP, instead of Kaspersky Application Control?
It looks like the same basic idea, but easier to manage.

Yes, you could. I personally use NVT EXE Radar Pro (alert-mode) alongside Kaspersky application control which is even more effective in terms of security. Obviously i have excluded all the NVT exe's & dll's in the Kaspersky Application control & vice-versa. But it is a little hard to manage with all the custom settings & prompts. You could always try the anti-executable with kaspersky application control in default settings.

Here are my current settings - PC: SECURE - shukla44's Security Configuration (Desktop) - See the spoiler for detailed kaspersky settings.

 

[shmu26]

this function is what they call "Trusted Applications mode," in Kaspersky 2016?
works the same?

 

[shmu26]

These are mine: PC: SECURE - harlan4096's config

thanks, I applied most of those settings, and they are pretty powerful.
For some of my apps, I have to dig deep into the firewall settings and make exclusions for them. For instance, I had to do that for HMP.A, so it could connect to the cloud for a scan.