Configuring security settings manually

By default, On-Demand Scan tasks use common security settings for the entire scan scope.

These settings correspond to the Recommended predefined security level.

The default values of security settings can be modified by configuring them as common settings for the entire scan scope or as different settings for different items in the protected device's file resource list or nodes in the tree.

Manually managing security settings in the Kaspersky Security Center Administration Console

Open the On-Demand Scan task properties.
Select the Scan scope section.
In the list of protected devices, select an item included in the scan scope to manage security settings.
Click Configure.
This opens a window; in that window, on the Security level tab, select the security level to be applied.
Select the resource whose security settings you want to configure.
Click Configure.
In the window that opens, select the required security level and click Settings.
On the General tab, specify the following settings:
- Objects that should be included in the protection scope:
  - All objects
    Kaspersky Industrial CyberSecurity for Nodes scans all objects.
  - Objects scanned by format
    Kaspersky Industrial CyberSecurity for Nodes scans only infectable objects based on file format. Kaspersky compiles the list of formats. It is included in the Kaspersky Industrial CyberSecurity for Nodes databases.
  - Objects scanned by the list of extensions specified in anti-virus databases
    Kaspersky Industrial CyberSecurity for Nodes scans only infectable objects based on file extension. Kaspersky compiles the list of extensions. It is included in the Kaspersky Industrial CyberSecurity for Nodes databases.
- In the Optimization block, select or clear the Protect only new and modified files check box.
  This check box enables / disables scanning and protection of files that have been recognized by Kaspersky Industrial CyberSecurity for Nodes as new or modified since the last scan.
  
  If the check box is selected, Kaspersky Industrial CyberSecurity for Nodes scans and protects only the files that it has recognized as new or modified since the last scan.
  
  If the check box is cleared, Kaspersky Industrial CyberSecurity for Nodes scans and protects files regardless of their modification status.
- In the Scan of compound files section, specify the compound objects that you want to include in the scan scope:
  - Scan archives
    Scanning ZIP, GZIP, BZIP, RAR, TAR, ARJ, CAB, LHA, JAR, ICE, and other archives. The application scans archives not only by extension, but also by format. When checking archives, the application performs a recursive unpacking. This allows to detect threats inside multi-level archives (archive within an archive).
  - Scan distribution packages
    This check box enables/disables scanning of third-party distribution packages.
  - Scan files in Microsoft Office formats
    Scans Microsoft Office files (DOC, DOCX, XLS, PPT and other Microsoft extensions). Office format files include OLE objects as well. Kaspersky Industrial CyberSecurity for Nodes scans office format files that are smaller than 1 MB, regardless of whether the check box is selected or not.
  - Scan email format files
    The check box enables or disables running scan tasks after the protected device switches to a UPS source.
    
    If the check box is selected, Kaspersky Industrial CyberSecurity for Nodes pauses running scan tasks after the protected device switches to a UPS source.
    
    If the check box is cleared, Kaspersky Industrial CyberSecurity for Nodes continues running scan tasks after the protected device switches to a UPS source.
    
    By default, the check box is cleared.
On the Actions tab, specify the following settings:
- Select the action to be performed on infected and other detected objects:
  - Disinfect
  - Disinfect. Delete if disinfection fails
  - Delete
    Kaspersky Industrial CyberSecurity for Nodes deletes the object and places a copy of it in Backup.
  - Recommended
    Kaspersky Industrial CyberSecurity for Nodes performs an action recommended by Kaspersky experts.
  - Inform
    When this mode is selected, Kaspersky Industrial CyberSecurity for Nodes does not block access to nor perform any actions on infected or other detected objects. The following event is recorded in the task log: Object not disinfected. Reason: no action was taken to neutralize detected object due to user-defined settings. The event specifies all available information about the detected object.
    
    Inform mode should be separately configured for each protection or scan area. This mode is not used by default in any of the security levels. If you select this mode, Kaspersky Industrial CyberSecurity for Nodes automatically changes the security level to Inform.
- Configure actions to be performed on objects depending on the type of object detected:
  1. Clear or select the Apply the action to the selected object types check box.
    If the check box is selected, you can independently set primary and secondary actions for each type of detected objects by clicking the button next to the check box. However, Kaspersky Industrial CyberSecurity for Nodes will not allow to open or execute an infected object regardless of your choice.
    
    If the check box is cleared, Kaspersky Industrial CyberSecurity for Nodes performs actions that are selected in the Action to perform on infected and other objects block.
    
    By default, the check box is cleared.
  2. Click Settings and select the types of objects to be detected.
- Configure actions on compound files that are not available for modification: clear or select the Entirely remove the compound file that cannot be modified by the application in case of embedded object detection check box.
  This check box enables or disables forced removal of the parent compound file when a malicious, probably infected or other detectable embedded child object is detected.
  
  If the check box is selected and the task is configured to remove infected and probably infected objects, Kaspersky Industrial CyberSecurity for Nodes forcibly removes the entire parent compound object when a malicious or other embedded object is detected. The parent file along with all of its contents are forcibly removed if the application cannot remove only the detected child object (for example, if the parent object cannot be modified).
  
  If this check box is cleared and the task is configured to remove infected and probably infected objects, Kaspersky Industrial CyberSecurity for Nodes does not perform the selected action if the parent object cannot be modified.
On the Performance tab, specify the following settings:
- In the Exclusions block:
  - Clear or select the Exclude files check box.
    Excluding files from scanning by file name or file name mask.
    
    If this check box is selected, Kaspersky Industrial CyberSecurity for Nodes skips specified detectable objects during scanning.
    
    If this check box is cleared, Kaspersky Industrial CyberSecurity for Nodes scans all objects.
    
    By default, the check box is cleared.
  - Clear or select the Do not detect objects by type check box.
    Objects are excluded from scanning by the name or name mask of the detectable object. The list of names of detectable objects is available on the Virus Encyclopedia website.
    
    If this check box is selected, Kaspersky Industrial CyberSecurity for Nodes skips specified detectable objects during scanning.
    
    If the check box is cleared, Kaspersky Industrial CyberSecurity for Nodes detects all objects specified in the application by default.
    
    By default, the check box is cleared.
    
    Click the Edit button for each setting to add exclusions.
- In the Advanced settings block:
  - Stop scanning if it takes longer than (sec)
    Limits the duration of object scanning. The default value is 60 seconds.
    
    If the check box is selected, scanning is limited to the specified maximum duration.
    
    If the check box is cleared, scanning is unlimited.
  - Do not scan compound objects larger than (MB)
    Excludes objects larger than the specified size from scanning.
    
    If the check box is selected, Kaspersky Industrial CyberSecurity for Nodes skips compound objects whose size exceeds the specified limit during a virus scan.
    
    If this check box is cleared, Kaspersky Industrial CyberSecurity for Nodes scans compound objects of any size.
  - Use iSwift technology
    iSwift compares a file’s NTFS identifier stored in a database with its current identifier. Scanning is performed only for files whose identifiers have changed (new files and files modified since the last scan of NTFS system objects).
    
    If the check box is selected, Kaspersky Industrial CyberSecurity for Nodes scans only new files or those modified since the last scan of NTFS system objects.
    
    If the check box is cleared, Kaspersky Industrial CyberSecurity for Nodes scans NTFS file system objects regardless of the file creation date or file modification date, except for files from network folders.
    
    The check box is selected by default.
  - Use iChecker technology
    iChecker calculates and remembers checksums of scanned files. If an object is modified, the checksum changes. The application compares all checksums and scans only files that are new and have been modified since the last scan.
    
    If the check box is selected, Kaspersky Industrial CyberSecurity for Nodes scans only new and modified files.
    
    If the check box is cleared, Kaspersky Industrial CyberSecurity for Nodes scans files regardless of the file creation date or file modification date.
    
    The check box is selected by default.
Save the new security settings.

Manually managing security settings in the Kaspersky Security Center Web Console

Manually managing security settings in the Application Console

Page top