Anti-Cryptor task (Anti_Cryptor, ID:13)

The Anti-Cryptor task allows you to protect your files in the local directories with network access by SMB/NFS protocols from remote malicious encrypting.

While the Anti-Cryptor task is running, Kaspersky Endpoint Security scans remote computers' calls to access files located in the shared network directories of the protected device. If the application considers a remote device actions on network file resources to be malicious encrypting, this device is added to a list of untrusted devices and loses access to the shared network directories. By default, the application blocks access of untrusted devices to network file resources for 30 minutes. The application does not consider actions to be encryption if encryption activity is detected in directories excluded from the protection scope of the Anti-Cryptor task.

To use the task, a license that includes the corresponding function is required.

For the Anti-Cryptor task to perform correctly, at least one of the services (Samba or NFS) must be installed in the operating system. The NFS service requires the rpcbind package to be installed.

The Anti-Cryptor task runs correctly with SMB1, SMB2, SMB3, NFS3, TCP/UDP, and IP/IPv6 protocols. Working with NFS2 and NFS4 protocols is not supported. It is recommended to configure your server settings so that the NFS2 and NFS4 protocols cannot be used to mount resources.

The Anti-Cryptor task does not block access to network file resources until the host's activity is identified as malicious. So, at least one file will be encrypted before the application detects malicious activity.