About the Real-Time File Protection task

When the Real-Time File Protection task is running, Kaspersky Embedded Systems Security for Windows scans the following protected device objects when they are accessed:

• Operating system objects.
• NTFS alternate data streams.
• Master boot records and boot sectors on local hard drives and external devices.

When any application writes or reads a file on the protected device, Kaspersky Embedded Systems Security for Windows intercepts the file, scans it for threats, and, if a threat is detected, performs a default action or an action you have specified: try to disinfect, move to Quarantine, or delete it. Before disinfection or deletion, Kaspersky Embedded Systems Security for Windows saves an encrypted copy of the source file to the Backup folder.

Kaspersky Embedded Systems Security for Windows also detects malware for processes running under Windows Subsystem for Linux. For such processes, the Real-Time File Protection task applies action defined by the current configuration.