Hot Take KIS/KTS/KSCloud/KStandard/KPlus/KPremium - Implementing Protected Folders via Manage Resources (+ Default Deny Mode)

[harlan4096]

No, Free version does not have Application Control...

 

[Bryan320]

No, Free version does not have Application Control...

I mean you have tested Kaspersky more then me what are the chances of ransomware actually getting past system watcher?

 

[harlan4096]

No security module from any av firm is 100% bullet proof so there will be always a rsw that will bypass SW

 

[harlan4096]

I would like to add a modification of this configuration:

​

This is the right mask to protected a full drive and all the files and subfolders inside: <drive letter>:\**\* -> C:\**\*

For additional mask info: Creating a scan exclusion (although for corporate product, also valid for home products)

I also modified (enforced) some rights of some allowed/denied operations...

 

[starsfighter]

how to configure kaspersky firewall to ask for new application or set learn mode for specific time.

 

[harlan4096]

Disable:



If You want also prompts from truted applications, then You should modify Trusted group rules, but probably You will get BUNCH OF PROMPTS. and will get crazy



Or You can modify manually every trusted application NetWork rule expanding Trusted Group...

 

[starsfighter]

to ask for new application

thanks for reply , just need it for new apps i used it before with eset and no "BUNCH OF PROMPTS"it's great to control the access . and for now i don't find away .

mangeded to solve it by marking trust group to ask and for "microsoft group" to allow reduce "BUNCH OF PROMPTS" except some cmd ,powershell. .....another adventage for eset firewall for me is ip to hostname reslover .

 

[ItsReallyMe]

Is it okay to add VeraCrypt container to that UNDER protected folder?

KIS/KTS/KSC Cloud

Implementing Protected Folders via Manage Resources
​

1.- Go to Settings -> Protection -> Application Control -> Manage Resources

2.- Expand Personal Data folder and then select User Files folder

3.- Click on Add and then on Category and type a name, for example: PROTECTED FOLDERS

4.- Then select the new PROTECTED FOLDER category/folder just created, and click on Add again, but this time select File or Folder

5.- In Name give a name for the resource We want to protect, for example: Hard Disk C:

6.- In Patch We can type manually the path to the resources (full drive or folder) or use [Select] to directly select, for example: C:\*

As You can see if We add a * to the end of path folder, all the content inside will be included, also We can specify concrete file types to protect:

View attachment 226879
​

7.- Finally click over [Add]

8.- Then expand PROTECTED FOLDERS category and select the new resource Hard Disk C:

9.- On the right We’ll get the rights (in the different trusted groups) assigned by default to the new resource

10.- Click on Trusted to collapse all the groups, and then We are ready to change rights. The default rights assigned are:

View attachment 226880
​

We have to remember here that Prompt For Action rights are working only if Interactive Mode is enabled, otherwise They will be ignored and the actions allowed…

So now my suggested tweaks are:

View attachment 226881

View attachment 226882

Check the new update of this tweak
​

After making the changes -> click on [Save] button below.

Now We have to complement these tweaks making some additional changes:

1. Having Protection in Defaults (Auto Mode):

View attachment 226884
​

2. Then go to Application Control and change the settings:

View attachment 226885​

For Advanced and/or more Paranoid users, We may even change:

• Protection to Interactive Mode -> unticking Performs recommended actions automatically
• Unticking Trust digitally signed applications
• Or even going beyond -> Change trust group for unknown applications to UnTrusted

WARNING:

With these tweaks You probably will get some blocks while installing new applications (unknown in KSN) and/or if there is no connection to KSN/access to InterNet.

If in Interactive Mode, You will get also some/many Kaspersky prompts warnings, I usually select (in the prompt warning) Additional Actions -> Trust this Application and ticking 1stly Remember my choice for this application, if You trust the application being installed, but We may always go to Application Control -> Manage Applications and move the blocked files to Trusted Group manually.

 

[harlan4096]

Yes, why not? But I use also Veracrypt, and may secure container does not have extension (I also have it located in an uncommon folder)... usually crypto attacks search for common user folders and known types of files such pic, docs, exe, etc. to encrypt... so it is interesting to leave container without extension, for security, maybe be less affected in a ransomware attack

 

[ItsReallyMe]

Yes, why not? But I use also Veracrypt, and may secure container does not have extension (I also have it located in an uncommon folder)... usually crypto attacks search for common user folders and known types of files such pic, docs, exe, etc. to encrypt... so it is interesting to leave container without extension, for security, maybe be less affected in a ransomware attack

okii thanks! I added download folder to protected folder, when i try to save a image from internet to that download location from MS edge ,it doesn't save!

 

[harlan4096]

when i try to save a image from internet to that download location from MS edge ,it doesn't save!

It depends on how did You set up the rights

If Edge in Trusted group and Write/Create rights for Trusted apps are in Allow, there should not be any issues...

 

[shukla44]

Great guide @harlan4096 !
Previously i had to do this for every common file type i could think of that will be affected by ransomwares. It was a lot of work. Now this guide, saved me a lot of work & time.

Question: i use kaspersky encryption vault. In lock, ransomware won't be able to affect the files inside it, right?

 

[harlan4096]

Question: i use kaspersky encryption vault. In lock, ransomware won't be able to affect the files inside it, right?

Files inside the vault will not be affected BUT main file vault/container can be affected also by some rsw... so I would also add it to protected resources

 

[ItsReallyMe]

is it possible to prevent someone from opening a folder using this Manage resources in KIS, using permissions?

 

[harlan4096]

I think this is not possible at 1st glance... since the rights are Read/Right/Create/Delete...

 

[ItsReallyMe]

I think this is not possible at 1st glance... since the rights are Read/Right/Create/Delete...

oh okay! what is the difference between Write and Create? , which is equivalent for modification?

 

[harlan4096]

Sincerely it is not very clear, since Kaspersky did not contribute which much info about this feature... but I guess:

Create: a new file creation
Write: modify an existing file

 

[shukla44]

I went a little further with protected folders. I don't need to protect my c: drive as any unknown application will go to High Restricted category & Start rights of High Restricted category is set to Prompt. So whenever an unknown application tries to start, i get a prompt to allow it or not.

IMO this is far better than adding c: in protected folders. I don't have any documents or files in c drive, all my personal files & documents are in e drive so as to avoid conflict/damage when formatting or reinstalling. So i added e drive to protected folders, which in turn protects ALL my files which are non-replaceable.
In addition, i modified the trusted group write & delete rights so i get notified even if a trusted app tries to access any of my files.

So now, i think no ransomware or malware will be able to affect my files even if it is trusted.
Am i being really paranoid? If i am doing anything wrong, please let me.

Regards.

 

[harlan4096]

I have a similar approach, since I also have all my docs in drive D:

 

[Berny]

Same here , all personal files are stored on external SSD’s mounted on Ewent (connected and disconnected) duo docking stations + sync application. Drive “C” contains only OS.