Make sure the Behavior Detection, Remediation Engine and Automatic Exploit Prevention components are enabled in the settings.

1. Open Kaspersky Endpoint Security 11 for Windows.
2. Click Settings.
3. Go to Advanced Threats Protection → Host Intrusion Prevention → Resources.

4. Select Personal data and click Add → Category.

5. Enter the name for the new category, e.g. Protected file types. Click OK.

6. Select Protected file types and create subcategories, e.g. Documents or Images. To create subcategories, repeat steps 4-5.
7. Select the category to add a type of protected files. E.g. Documents for files with the DOC or DOCX extension. Click Add → File or folder.
8. Fill out the Name filed, click Browse and enter the mask for the file in the *.<extension> format. Click OK → OK.

9. Add other file types. To create subcategories, repeat steps 7-8.
10. Set the rules for the High restricted and Low restricted categories. Select the Protected file types category and set the Block option and Log events in the Write, Read, delete and Create columns.

11. Make sure that the applications you often use with protected file types are in the Trusted group. Click OK → Save.

The Host Intrusion Prevention has been set up for protection against file-encrypting malware.

Before installing patches for Kaspersky Lab solutions, it is necessary to temporarily restore initial settings. If your browser is located in a group with high or low restrictions it will not be possible to download protected files.

Make sure the Behavior Detection, Remediation Engine and Automatic Exploit Prevention components are enabled in the settings.

1. Open Kaspersky Security Center.
2. Go to Managed devices → Policies.

3. Open the properties of the Kaspersky Endpoint Security 11 for Windows policy.
4. Go to Advanced Threats Protection → Host Intrusion Prevention → Settings.

5. Select Personal data and click Add → Category.

6. Enter the name for the new category, e.g. Protected file types. Click OK.

7. Select Protected file types and create subcategories, e.g. Documents or Images. To create subcategories, repeat steps 5-6.
8. Select the category to add a type of protected files. E.g. Documents for files with the DOC or DOCX extension. Click Add → File or folder.
9. Fill out the Name filed, click Browse and enter the mask for the file in the *.<extension> format. Click OK → OK.

10. Add other file types. To create subcategories, repeat steps 8-9.
11. Set the rules for the High restricted and Low restricted categories. Select the Protected file types category and set the Block option and Log events in the Write, Read, delete and Create columns.

12. Make sure that the applications are in the Trusted group. Click OK → Apply.
13. Go to Event configuration → Info. Open the properties for Host Intrusion Prevention was triggered.

14. Select the checkbox for On Administration Server for (days). If necessary, adjust settings to receive the notifications to your email. Click OK.

The Host Intrusion Prevention has been set up for protection against file-encrypting malware. If a malicious file is run on a managed computer, Kaspersky Security Center 10 will register that event. To track the events, go to Administration Server → Events.

If the Administration Server registers too many events, the oldest will be overwritten.

If you have found a malicious file that may cause infection and encryption of files, send a request to technical support through Kaspersky CompanyAccount. Attach the file to your request and add the comment “possible cryptovirus”. 

To find the files that have been removed during disinfection, click Storage in the main window of Kaspersky Endpoint Security 11 for Windows.