Hot Take KIS/KTS/KSCloud/KStandard/KPlus/KPremium - Implementing Protected Folders via Manage Resources (+ Default Deny Mode)

I would like to add a modification of this configuration:

1603182619778.png
​
This is the right mask to protected a full drive and all the files and subfolders inside: <drive letter>:\**\* -> C:\**\*

For additional mask info: Creating a scan exclusion (although for corporate product, also valid for home products)

I also modified (enforced) some rights of some allowed/denied operations...
 
  • +Reputation
  • Like
  • Thanks
Reactions: Ranking4029, shukla44, Nevi and 8 others
Disable:

1603817151222.png

If You want also prompts from truted applications, then You should modify Trusted group rules, but probably You will get BUNCH OF PROMPTS. and will get crazy :D

1603817306117.png

Or You can modify manually every trusted application NetWork rule expanding Trusted Group...
 
Last edited:
  • Like
  • +Reputation
  • HaHa
Reactions: shukla44, Nevi, Berny and 4 others
starsfighter said:
to ask for new application
Click to expand...
thanks for reply , just need it for new apps i used it before with eset and no "BUNCH OF PROMPTS"it's great to control the access . and for now i don't find away .

mangeded to solve it by marking trust group to ask and for "microsoft group" to allow reduce "BUNCH OF PROMPTS" except some cmd ,powershell. .....another adventage for eset firewall for me is ip to hostname reslover .
 
Last edited:
  • Like
Reactions: Nevi, Protomartyr and harlan4096
Is it okay to add VeraCrypt container to that UNDER protected folder?
harlan4096 said:
KIS/KTS/KSC Cloud

Implementing Protected Folders via Manage Resources
​
1.- Go to Settings -> Protection -> Application Control -> Manage Resources

2.- Expand Personal Data folder and then select User Files folder

3.- Click on Add and then on Category and type a name, for example: PROTECTED FOLDERS

4.- Then select the new PROTECTED FOLDER category/folder just created, and click on Add again, but this time select File or Folder

5.- In Name give a name for the resource We want to protect, for example: Hard Disk C:

6.- In Patch We can type manually the path to the resources (full drive or folder) or use [Select] to directly select, for example: C:\*

As You can see if We add a * to the end of path folder, all the content inside will be included, also We can specify concrete file types to protect:

7.- Finally click over [Add]

8.- Then expand PROTECTED FOLDERS category and select the new resource Hard Disk C:

9.- On the right We’ll get the rights (in the different trusted groups) assigned by default to the new resource

10.- Click on Trusted to collapse all the groups, and then We are ready to change rights. The default rights assigned are:

We have to remember here that Prompt For Action rights are working only if Interactive Mode is enabled, otherwise They will be ignored and the actions allowed…

So now my suggested tweaks are:


After making the changes -> click on [Save] button below.

Now We have to complement these tweaks making some additional changes:

1. Having Protection in Defaults (Auto Mode):

2. Then go to Application Control and change the settings:


For Advanced and/or more Paranoid users, We may even change:

  • Protection to Interactive Mode -> unticking Performs recommended actions automatically
  • Unticking Trust digitally signed applications
  • Or even going beyond -> Change trust group for unknown applications to UnTrusted

WARNING:

With these tweaks You probably will get some blocks while installing new applications (unknown in KSN) and/or if there is no connection to KSN/access to InterNet.

If in Interactive Mode, You will get also some/many Kaspersky prompts warnings, I usually select (in the prompt warning) Additional Actions -> Trust this Application and ticking 1stly Remember my choice for this application, if You trust the application being installed, but We may always go to Application Control -> Manage Applications and move the blocked files to Trusted Group manually.
Click to expand...
 
  • Like
Reactions: Nevi
Yes, why not? But I use also Veracrypt, and may secure container does not have extension (I also have it located in an uncommon folder)... usually crypto attacks search for common user folders and known types of files such pic, docs, exe, etc. to encrypt... so it is interesting to leave container without extension, for security, maybe be less affected in a ransomware attack :)
 
  • Like
  • +Reputation
Reactions: Guilhermesene, Nevi, Minimalist and 3 others
harlan4096 said:
Yes, why not? But I use also Veracrypt, and may secure container does not have extension (I also have it located in an uncommon folder)... usually crypto attacks search for common user folders and known types of files such pic, docs, exe, etc. to encrypt... so it is interesting to leave container without extension, for security, maybe be less affected in a ransomware attack :)
Click to expand...
okii thanks! I added download folder to protected folder, when i try to save a image from internet to that download location from MS edge ,it doesn't save!
 
  • Like
Reactions: Nevi, Venustus and harlan4096
when i try to save a image from internet to that download location from MS edge ,it doesn't save!
Click to expand...
It depends on how did You set up the rights :)

If Edge in Trusted group and Write/Create rights for Trusted apps are in Allow, there should not be any issues...

1615285002818.png
 
Last edited:
  • Like
Reactions: Guilhermesene, shukla44, Nevi and 3 others
Great guide @harlan4096 !
Previously i had to do this for every common file type i could think of that will be affected by ransomwares. It was a lot of work. Now this guide, saved me a lot of work & time.

Question: i use kaspersky encryption vault. In lock, ransomware won't be able to affect the files inside it, right?
 
  • Like
Reactions: Nevi, Venustus, Gandalf_The_Grey and 2 others
Question: i use kaspersky encryption vault. In lock, ransomware won't be able to affect the files inside it, right?
Click to expand...

Files inside the vault will not be affected BUT main file vault/container can be affected also by some rsw... so I would also add it to protected resources :)
 
  • Like
  • Thanks
Reactions: Nevi, Venustus, shukla44 and 3 others
Sincerely it is not very clear, since Kaspersky did not contribute which much info about this feature... but I guess:

Create: a new file creation
Write: modify an existing file
 
  • Like
  • +Reputation
Reactions: Guilhermesene, shukla44, Nevi and 5 others
I went a little further with protected folders. I don't need to protect my c: drive as any unknown application will go to High Restricted category & Start rights of High Restricted category is set to Prompt. So whenever an unknown application tries to start, i get a prompt to allow it or not.

Screenshot00043.jpg


Screenshot00042.jpg


IMO this is far better than adding c: in protected folders. I don't have any documents or files in c drive, all my personal files & documents are in e drive so as to avoid conflict/damage when formatting or reinstalling. So i added e drive to protected folders, which in turn protects ALL my files which are non-replaceable.
In addition, i modified the trusted group write & delete rights so i get notified even if a trusted app tries to access any of my files.

Screenshot00041.jpg


So now, i think no ransomware or malware will be able to affect my files even if it is trusted.
Am i being really paranoid? If i am doing anything wrong, please let me.

Regards.
 
  • Like
  • Thanks
Reactions: Guilhermesene, Venustus, Nevi and 4 others

You may also like...