Make sure that the following components are enabled in the application settings: Behavior Detection, Remediation Engine, and Exploit Prevention.

1. Open Kaspersky Endpoint Security for Windows.
2. Enable the Host Intrusion Prevention component.
3. Go to Settings → the Host Intrusion Prevention component and click Manage resources.

4. Select Personal data and click Add → Category.

5. Type the name of the new category, e.g. Protected file types. Click Add.

6. Select Protected file types and create subcategories. For example, Documents or Images. To do this, repeat steps 4—5.
7. Select the category for the protected file type. E.g., for files with .DOC or .DOCX extension, select the Documents category and click Add → File or folder.
8. Enter the name and specify the mask in the *.<extension> format in the Path field.

9. Add other file types. To do this, repeat steps 7—8.
10. Set the rules for the High restricted and Low restricted categories. To do this:
    1. Select the created Protected file types category.
    2. For the High restricted and Low restricted folders, set the Write, Create, and Delete permissions to Deny and click Log events.

11. Make sure that necessary application are in the trusted group and click Save.

Before installing patches for Kaspersky solutions, temporarily restore the initial settings. If your browser is in a group with high or low restrictions, you will not be able to download protected files.

Make sure that the following components are enabled in the application settings: Behavior Detection, Remediation Engine, and Exploit Prevention.

1. Open Kaspersky Endpoint Security for Windows.
2. Enable the Host Intrusion Prevention component.
3. Go to Settings → the Host Intrusion Prevention component and click Manage resources.

4. Select Personal data and click Add → Category.

5. Type the name of the new category, for example, Protected file types. Click Add.

6. Select Protected file types and create subcategories. For example, Documents and Images. To do this, repeat steps 4—5.
7. Select the category for the protected file type. E.g., for files with .DOC or .DOCX extension, select the Documents category and click Add → File or folder.
8. Enter the name and specify the mask in the *.<extension> format in the Path field.

9. Add other file types. To do this, repeat steps 7—8.
10. Set the rules for the High restricted and Low restricted categories. To do this:
    1. Select the created Protected file types category.
    2. For the High restricted and Low restricted folders, set the Write, Create, and Delete permissions to Deny and click Log events.

11. Make sure that necessary application are in the trusted group and click Save.

Before installing patches for Kaspersky solutions, temporarily restore the initial settings. If your browser is in a group with high or low restrictions, you will not be able to download protected files.

Make sure that the following components are enabled in the settings: Behavior Detection, Remediation Engine and Exploit Prevention.

1. Open Kaspersky Security Center.
2. Go to Managed devices → Policies and open the policy properties of Kaspersky Endpoint Security for Windows.
3. Go to Advanced Threats Protection → Host Intrusion Prevention → Settings.

4. Select Personal data and click Add → Category.

5. Type the name for the category, e.g. Protected file types and click OK.

6. Select Protected file types and create subcategories. For example, Documents or Images. To do this, repeat steps 4—5.
7. Select the category for the protected file type. For example, for files with .DOC or .DOCX extension, select the Documents category and click Add → File or folder.
8. Fill out the Name filed, click Browse and enter the mask for the file in the *.<extension> format. Click OK → OK.

9. Add other file types. To do this, repeat steps 7—8.
10. Set the rules for the High restricted and Low restricted categories. To do this, select the Protected file types category and set the Write, Create, and Delete rights to Deny and click Log events.

11. Make sure that the applications are in the trusted group. Click OK → Apply.
12. Go to Event configuration → Info. Open the properties for Host Intrusion Prevention was triggered.

13. Select the check box for On Administration Server for (days). If necessary, adjust settings to receive the notifications to your email. Click OK.

The Host Intrusion Prevention component has been set up for protection against file-encrypting malware. If a malicious file is run on a client device, Kaspersky Security Center will register that event. To track the events, go to Administration Server → Events.

If the Administration Server registers too many events, the oldest will be overwritten.

Before installing patches for Kaspersky solutions, temporarily restore the initial settings. If your browser is in a group with high or low restrictions, you will not be able to download protected files.

To use all the features of Kaspersky Security Center Remote Diagnostic Utility, restore the initial settings or disable the Host Intrusion Prevention component.

The file types listed above are the most commonly encrypted. Nevertheless, other file formats of user data and backup files can also be encrypted by malware.

• If you have found a malicious file that may cause infection and encryption of files, follow these instructions.
• If your device has already been infected by malware, follow these instructions.