How to configure File Threat Protection

File Threat Protection component prevents infection of the device file system. The component is enabled automatically with the default settings when the Kaspersky application starts. It resides in the device operating memory and scans all files that are opened, saved, and executed in real time.

Upon detecting malware, the Kaspersky application can remove the infected file and terminate the malware process started from this file.

The operation of the component is affected by the file operation interception mode, which you can select in the general settings of the application. By default, access to the file is blocked for the duration of the scan.

On the command line, you can manage File Threat Protection using the File Threat Protection predefined task (File_Threat_Protection).

The File Threat Protection task is started by default. You can start and stop this task, as well as modify its settings manually.

To start and stop the File Threat Protection task on the command line, you need the privileges of the Administrator role.

By modifying the settings of the File Threat Protection predefined task, you can:

• Select the file scan mode (when opened, or when opened and modified).
• Enable or disable scanning of archives, mail databases, email messages in text format.
• Temporarily exclude files in text format from rescans.
• Limit the size of an object to be scanned and the duration of the object scan.
• Select the actions to be performed by the application on the infected objects.
• Configure the scan scopes. The application will scan objects in the specified area of the file system.
• Configure exclusions of objects from scans. A scan exclusion is a set of conditions. When these conditions are met, the application does not scan the objects for viruses and other malware. You can exclude the following from scans:
  • Objects by name or mask
  • Objects by the name of the threats detected in them
  • Files and directories in specified areas of the file system
  • Processes and files being modified by the specified process
• Configure the use of the heuristic analyzer and iChecker technology during a scan.
• Enable or disable the logging of information about scanned non-infected objects, about scanning objects in archives, and about unprocessed objects.

On the command line, you can view information about detected threats and check the current status of the task.

To optimize the File Threat Protection component, you can exclude from scans any files being copied from network directories. Files are scanned only after the process of copying to a local directory is finished. To exclude files located in network directories from scans, configure exclusion based on processes for the utility used for copying from network directories (for example, for the cp utility). You can configure an exclusion by process by adding an [ExcludedForProgram.item_#] section to the settings of the OAS task.

In the application interface, you can manage File Threat Protection using the File Threat Protection component.

The application interface allows you to:

• Enable or disable the File Threat Protection component.
• Observe the operation of the component.
• View pop-up notifications about detected threats; in these notifications, you can click the Open Reports link to navigate to application component reports and scan task results.
• View reports of the File Threat Protection component.

  The statistics of the File Threat Protection component are displayed in the report in the Statistics section.

File Threat Protection task settings

The File Threat Protection task is running by default with the settings listed in Appendix 3. You can stop or start the task at any time. You can also modify task settings.

You must modify the settings of a task before starting the task.

To configure the task schedule using a configuration file:

1. Output the task settings to the configuration file: kfl-control --get-schedule
2. Edit the values of the necessary settings in the configuration file and save the changes.
3. Execute the command:

   kfl-control --set-schedule 1 --file <configuration file path> [--json]

All values of the settings for the task run schedule defined in the file will be imported into the application.

To modify individual task schedule settings on the command line:

kfl-control --set-schedule 1 <setting name>=<setting value> [<setting name>=<setting value>]

The values of the specified settings for the task run schedule are modified.

To stop the File Threat Protection task and enable the output of current events related to this task, run the following command:

kfl-control --stop-task 1 -W

To start the File Threat Protection task, enable the output of current events related to this task, and display the progress of the task, run the following command:

kfl-control --start-task 1 [-W] [--progress]

The File Threat Protection task is started with default settings.

You can display the current values of the task settings in one of the following ways:

• To the console using the task settings output command: kfl-control --get-settings 1 [--json]
• To a configuration file using the task settings output command: kfl-control --get-settings 1 --file <path to configuration file> [--json]

If you need to modify the settings of the File Threat Protection task, you can:

• Modify all task settings using the configuration file. To do so:
  1. Output the task settings to the configuration file: kfl-control --get-settings 1 [--json]

     A configuration file with the current task settings is generated.

  2. Edit task settings in the generated configuration file by choosing values from the following table.
  3. If necessary, add a scan scope to the configuration file or remove scan scopes that you want to skip from the configuration file.

     To add a scan scope, add a [ScanScope.item_#] section to the configuration file and specify the values of its settings by choosing them from the table below.

     To delete a scan scope, delete the [ScanScope.item_#] section corresponding to the unwanted scan scope along with its settings from the configuration file.

  4. If necessary, add an exclusion scope to the configuration file.

     To add an exclusion scope, add an [ExcludedFromScanScope.item_#] section to exclude files and directories or an [ExcludedForProgram.item_#] section to exclude processes and specify its settings by choosing them from the table below.

  5. Save the configuration file.
  6. Run the following command: kfl-control --set-settings 1 --file <configuration file path> [--json]
• Modify individual task settings using command line options. To do so:
  1. Modify settings: kfl-control --set-settings 1 <setting name>=<setting value> [<setting name>=<setting value>]
  2. If necessary, add a scan scope using the kfl-control --set-settings 1 --add-path <path to directory with objects to scan> command or delete a scan scope using the kfl-control --set-settings 1 --del-path <path to directory with objects to scan> command.
  3. If necessary, add an exclusion scope using the kfl-control --set-settings 1 --add-exclusion <path to directory with objects to exclude> command or delete an exclusion scope using the kfl-control --set-settings 1 --del-exclusion <path to directory with objects to exclude> command.
• Restore default task settings: kfl-control --set-settings 1 --set-to-default

For detailed instructions on how to modify the settings of application tasks, see the How to manage task settings on the command line section.

The following table describes all the settings of the File Threat Protection task and their values.

File Threat Protection task settings

Page top

How to optimize the scanning of network directories

To optimize the File Threat Protection task, you can exclude from scans any files being copied from network directories to the local directory. To do so, configure exclusion based on processes for the utility used for copying from network directories (for example, for the cp utility).

To configure exclusion of network directories from scans:

1. Output the File Threat Protection task settings (File_Threat_Protection, ID:1) to a configuration file using the command:

   kfl-control --get-settings 1 --file <full path to configuration file> [--json]

2. Open the configuration file and add the [ExcludedForProgram.item_#] section with the following settings:
   • ProgramPath – path to the process to be excluded or to the directory with the processes to be excluded.
   • ApplyToDescendants is a parameter that indicates whether the scan should exclude child processes of the excluded process (possible values: Yes or No).
   • AreaDesc – a description of the process exclusion scope, which contains additional information about the exclusion scope.
   • UseExcludedForProgram enables exclusion of the specified scope during task operation (possible values: Yes or No).
   • Path – path to the files or directory with files modified by the process.
   • AreaMask.item_# is the file name mask for the files to be excluded from the scan. You can also specify the full path to the file.

     Example: [ExcludedForProgram.item_0000] ProgramPath=/usr/bin/cp ApplyToDescendants=No AreaDesc= UseExcludedForProgram=Yes Path=AllRemoteMounted AreaMask.item_0000=*

3. Execute the command:

   kfl-control --set-settings 1 --file <full path to configuration file> [--json]

   Specify the --json option if you are importing settings from a configuration file in JSON format. If the option is not specified, the application will attempt to import settings from an INI file. If the import fails, an error is displayed.

The application does not scan the files in network directories, but the cp command itself (for the example given above) and local files are scanned.

Page top