Kaspersky PURE 2.0. Exclusions

Size: px

Start display at page:

Download "Kaspersky PURE 2.0. Exclusions"

Jeffery Gordon
5 years ago
Views:

1 Exclusions

2 Content Exclusions... 2 Trusted zone... 2 Creating the list of trusted applications... 3 Creating exclusion rules

3 Exclusions Trusted zone Trusted zone is a list of objects created by the user whose work is not controlled by the program. Namely, it is a set of exclusions from Kaspersky PURE protection. Trusted zone is created based on the list of trusted applications and exclusion rules depending on the peculiarities of objects you are working with and programs installed on this computer. You may need to add objects to trusted zone, for example if Kaspersky PURE blocks access to an object or program, while you are sure that this object/ program is harmless. For example, you consider that the objects used by the standard Microsoft Windows Notepad are secure and do not have to be scanned. In other words, you trust this application. To exclude the objects used by this process, add the application Notepad into the list of trusted applications. Some actions classified as dangerous can be normal indeed depending on application functions. For example, hooking the text being typed is a normal action for automatic keyboard layout switch programs (Punto Switcher, etc.). It is recommended to add such specific applications to the list of trusted applications to disable monitoring of their activity. When a program is added to the list of trusted, its file and network activity (including suspicious activity) and queries to the system registry are not monitored. At the same time an executable file and the process of a trusted program are still scanned for viruses. In order to fully exclude a program from scan, you should use exclusion rules. Excluding trusted applications from scan is a way to solve possible compatibility issues between Kaspersky PURE and other software (for example, network traffic from another PC which has already been scanned by antivirus software). It also allows to increase performance of a computer, which is essential when using software for servers. In their turn, exclusion rules of trusted zone allow to work with legal software which can be used by invaders to corrupt your computer or user s data. Such programs do not have malicious functionality, but can be used as an auxiliary component of a malicious program. The list of such potentially dangerous software includes remote administrating programs, IRCclients, FTP-servers, various tools to stop processes or hide their work, key loggers, password breaking programs, auto-dialers and etc. As a result of work of Kaspersky PURE such programs can be blocked. In order to avoid blocking, configure rules excluding such programs from scan. Exclusion rules are sets of conditions that Kaspersky PURE uses to verify if it can skip an object during the scan. In all other cases an object will be scanned by protection components according to the protection settings configured for them. 2 10

Exclusion rules of trusted zone can be used by some application components. For example, by File Anti-Virus, Mail Anti-Virus, Web Anti-Virus, and during scan for viruses tasks.

4 Exclusion rules of trusted zone can be used by some application components. For example, by File Anti-Virus, Mail Anti-Virus, Web Anti-Virus, and during scan for viruses tasks. Creating the list of trusted applications By default, Kaspersky PURE scans objects opened, started or saved by any system process as well as controls activity of all programs and the created network traffic. Upon adding applications to the list of trusted applications, Kaspersky PURE excludes them from scan. In order to add a program to the list of trusted, perform the following actions: 1. In the upper part of the Settings window select Protection > Threats and Exclusions. 2. In the right part of the window in the Exclusions section, click the Settings button. 3. In the open window on the Trusted applications tab click the Add link to open the menu. In the menu select one of the items: Browse. Selecting this item opens the standard browse window. In this window, you can select the executable file of an application. Applications. Selecting this item opens the Select application window with a list of applications currently running. You can select the required application from the list. 3 10

You can modify the program scan settings or delete the program from the list using the

5 4. In the opened window Exclusions for application check the boxes for activities which should not be monitored. You can modify the program scan settings or delete the program from the list using the corresponding links in the lower part of the list. In order to exclude a program from the list without deletion, clear the box next to the program name. 4 10

Creating exclusion rules If you use in your work programs classified by Kaspersky PURE as illegal and which can be used by cyber criminals to harm either your computer or user s data, you are

6 Creating exclusion rules If you use in your work programs classified by Kaspersky PURE as illegal and which can be used by cyber criminals to harm either your computer or user s data, you are recommended to configure exclusion rules for such programs. Exclusion rules are sets of conditions that Kaspersky PURE uses to verify if it can skip an object during the scan. In Kaspersky PURE you can create exclusion rules only for the following components: File Anti-Virus Mail Anti-Virus Web Anti-Virus Application Control Proactive Defense Scan. Exclusion rules allow adding exclusions by: Object - exclusion of a certain object, directory, or files that match a certain mask / format from scans. Threat type - exclude objects according the Virus Encyclopedia threat type classification. The following parameters can be configured/ modified for the Object type: Define file, folder or mask excluded from scan Define exclusions for subfolders, if a definite folder is given as an exclusion Define component(s) and tasks for which the exclusion will work For the Threat type you can define the name / mask of the threat type classification according to the Kaspersky Lab Virus Encyclopedia. 5 10

7 You can also define component(s) and tasks for which the exclusion will work. In order to create an Exclusion rule, perform the following actions: 1. In the upper part of the Settings window under Protection select Threats and Exclusions. 2. In the right part of the window in the Exclusions section click the Settings button. 3. In the open window on the Exclusion rules tab, click the Add link. 4. In the Exclusion rule window specify the rule s properties by checking the boxes in the Properties section: Object Threat type 6 10

5. In the Rule description section click the select object link. 6. In the Object name window click the Browse button and select the file for which you are creating the rule.

8 5. In the Rule description section click the select object link. 6. In the Object name window click the Browse button and select the file for which you are creating the rule. Select the necessary folder with the file or enter the full path to the file. 7. Check the option Include subfolders if the rule is created for more than one file. 8. In the Object name window, click OK. 9. If you have checked Threats type, then next to the Threat type option, click on the enter threat name... link, if you want to exclude a threat type. 7 10

In the Exclusion rule window in the Rule description section in the

9 10. In the Threat type window, enter the classification type according to the Virus Encyclopedia. 11. In the Threat type window, click OK. 12. In the Exclusion rule window in the Rule description section in the Protection components string click the specified: select components link. 8 10

10 13. In the Protection components window, define the components for which the exclusion rule will be applied. 9 10

11 14. Click OK. 15. In the Exclusion rule window, click on the OK button. 16. In the Trusted zone window click the OK button. 17. In the bottom right corner of the Settings window click the Apply button

Internet Security Application Control

Internet Security Application Control Internet Security 2012 Application Control Table of Contents Application Control... 2 What is Application Control... 2 Operational algorithm of Application Control... 2 Enabling/disabling Application Control...