Make sure the Behavior Detection, Remediation Engine and Automatic Exploit Prevention components are enabled in the settings.

1. Open Kaspersky Endpoint Security 11 for Windows.
2. Enable the Host Intrusion Prevention component. For instructions, see this article.
3. Click Manage resources in the the Host Intrusion Prevention component settings.

4. Select the Personal data category and click Add → Category.

5. Type the name for the category, for example, Protected file types. Click Add.

6. Select Protected file types and create subcategories in it, for example, Documents. Repeat steps 4-5.
7. Select the category for the file type. For example, for DOC or DOCX extension select Documents and click Add → File or folder.
8. Enter the name and specify the mask in the *.<extension> format in the Path field. ClickAdd.

9. Add other file types by repeating steps 7-8.
10. Set the rules for the High restricted and Low restricted categories. To do this:
    1. Select the created category.
    2. For Low restricted and High restricted categories, set write, create and delete rights to Deny and select Log events.

11. Make sure that the applications you often use with protected file types are in the Trusted group. Click Save.

The Host Intrusion Prevention has been set up for protection against file-encrypting malware.

Before installing patches for Kaspersky Lab solutions, it is necessary to temporarily restore initial settings. If your browser is located in a group with high or low restrictions it will not be possible to download protected files.

Make sure the Behavior Detection, Remediation Engine and Automatic Exploit Prevention components are enabled in the settings.

1. Open Kaspersky Endpoint Security 11 for Windows.
2. Enable the Host Intrusion Prevention component. See this article for instructions.
3. Click Manage resources in the Host Intrusion Prevention settings window.

4. Select Personal data and click Add → Category.

5. Enter the name for the new category, e.g. Protected file types. Click Add.

6. Select Protected file types and create subcategories, e.g. Documents or Images. To create subcategories, repeat steps 4–5.
7. Select the category to add a type of protected files. E.g. Documents for files with the DOC or DOCX extension. Click Add → File or folder.
8. Enter the name for the category, and specify the mask for the file type in the format *.<extension> in the Path field. Click Add.

9. Add other file types. To add other file types, repeat steps 7–8.
10. Set the rules for the High restricted and Low restricted categories. To do this:
    1. Select the created category.
    2. For Low restricted and High restricted categories, set write, create and delete rights to Deny and select Log events.

11. Make sure that the applications you often use with protected file types are in the Trusted group. Click Save.

The Host Intrusion Prevention has been set up for protection against file-encrypting malware.

Before installing patches for Kaspersky Lab solutions, it is necessary to temporarily restore initial settings. If your browser is located in a group with high or low restrictions it will not be possible to download protected files.

Make sure the Behavior Detection, Remediation Engine and Automatic Exploit Prevention components are enabled in the settings.

1. Open the Kaspersky Security Center console.
2. Go to Managed devices → Policies and open the Kaspersky Endpoint Security for Windows policy properties.
3. Go to Advanced Threats Protection → Host Intrusion Prevention → Settings.

4. Select Personal data and click Add → Category.

5. Enter the name for the new category, e.g. Protected file types. Click OK.

6. Select Protected file types and create subcategories, e.g. Documents or Images. To add other file types, repeat steps 4–5.
7. Select the category to add a type of protected files. E.g. Documents for files with the DOC or DOCX extension. Click Add → File or folder.
8. Fill out the Name filed, click Browse and enter the mask for the file in the *.<extension> format. Click OK → OK.

9. Add other file types. To add other file types, repeat steps 7–8.
10. Set the rules for the High restricted and Low restricted categories. Select the Protected file types category and set the Block option and Log events in the Write, Read, delete and Create columns.

11. Make sure that the applications are in the Trusted group. Click OK → Apply.
12. Go to Event configuration → Info. Open the properties for Host Intrusion Prevention was triggered.

13. Select the checkbox for On Administration Server for (days). If necessary, adjust settings to receive the notifications to your email. Click OK.

The Host Intrusion Prevention has been set up for protection against file-encrypting malware. If a malicious file is run on a managed computer, Kaspersky Security Center will register that event. To track the events, go to Administration Server → Events.

If the Administration Server registers too many events, the oldest will be overwritten.

Before installing patches for Kaspersky Lab solutions, it is necessary to temporarily restore initial settings. If your browser is located in a group with high or low restrictions it will not be possible to download protected files.

To use all the functions of Kaspersky Security Center Remote Diagnostic Utility, restore initial settings or disable the Host Intrusion Prevention component.

If you have found a malicious file that may cause infection and encryption of files, send a request to technical support through Kaspersky CompanyAccount. Attach the file to your request and add the comment “possible cryptovirus”. 

To find the files that have been removed during disinfection:

• If you are using Kaspersky Endpoint Security for Windows version 11.7.0–11.11.0, in the main application window click Backup.
• If you are using Kaspersky Endpoint Security for Windows version 11.5.0–11.6.0, in the main application window click More Tools → Backup.