Enable and configure System Watcher so that Kaspersky Security Cloud can terminate file-encrypting malware when it launches. See this article for instructions.

The System Watcher component collects data about actions performed by applications on your computer and shares this information with other components to improve protection. If System Watcher is enabled, Kaspersky Security Cloud will be able to terminate file-encrypting malware when it runs and move the file from which the encryption process was launched to Quarantine.

File-encrypting malware get encryption keys over the Internet. To prevent file-encrypting malware from getting these keys and encrypting files, block Internet access for applications from the Low Restricted, High Restricted and Untrusted groups in the Firewall settings. See this article for instructions.

Create categories to protect personal files such as documents, tables, images, and videos.

To create categories of protected file types:

1. In the main window of Kaspersky Security Cloud, click .

1. To learn how to open the main application window, see this article.

2. Go to Protection → Application Control.

3. Click Manage resources.

4. Select the folder in which you want to create the new category, click Add and then select Category.

5. Enter the name Protected file types and click Add.

6. Select the Protected file types category and create several subcategories for different file types. To do so, repeat steps 4 and 6. For example, create Documents and Images categories. Create categories for all the file types on your device.

7. Select the appropriate category for the file type you want to protect. For example, for files with a .doc extension, select the Documents category. Click Add → File or folder.

8. Enter name, specify a file mask based on the file extension and click Add. See below for a list of common extensions. For example, enter the name “doc” and the path “*.doc”.

9. Repeat steps 7-8 for other file types.

Categories of protected file types will be created.

Configure application access rules for the Protected file types category.

1. In the main window of Kaspersky Security Cloud, click .

1. To learn how to open the main application window, see this article.

2. Go to Protection → Application Control.

3. Click Manage applications.

4. Right-click the Trusted group and select Details and rules from the shortcut menu.

5. Go to the Files and system registry tab and make sure that, for the Protected file types category, the Allow rule has been set for the read, write, create and delete actions.

6. If this rule has not been set, click on the icon and select Allow. Click Save.

7. Right-click the Low Restricted group and select Details and rules from the shortcut menu.

8. Go to the Files and system registry tab and make sure that, for the Protected file types category, the Prompt for action rule has been set for the read, write, create and delete actions.

9. If this rule has not been set, click on the icon and select Prompt for action. Click Save.

10. Repeat steps 7-9 for the High Restricted group.