1. Open Kaspersky Endpoint Security 10 for Windows. 

2. In the Settings tab, select Endpoint control → Application Privilege Control and click the Resources button.

3. Select the Personal data node, click Add and select Category. 

4. Create a category called Protected file types and create several subcategories within it (Documents, Images, etc.).

5. Select the category corresponding to the protected files type (for example, Documents for files with the *.doc extension), click Add and select File or folder.  Specify a mask for the file type by using an asterisk *.<extension>

6. Add the other file types the same way.

7. Configure access permissions for the Protected file types category for applications with high and low restrictions by blocking Write, Delete and Create actions. Make sure that the applications you often use with protected file types are in the Trusted group.

1. Open the Administration Console, go to the Managed devices node and select the Policies tab.

2. Open the active Kaspersky Endpoint Security policy, select Endpoint control → Application Privilege Control and click the Settings button.

3. Select the Personal data node, click Add and select Category. 

4. Create several categories (for example, Documents, Images, etcetera).

5. Select the category corresponding to the protected files type (for example, Documents for files with the *.doc extension), click Add and select File or folder.  Specify the mask for the file type by using an asterisk *.<extension>

6. Add the other of file types the same way.
7. Configure access permissions for the Protected file types category for applications with high and low restrictions by blocking Write, Delete and Create actions. Enable Log events for each of them. 

Make sure that the applications you often use with protected file types are in the Trusted group.

8. Go to the Event notification section and open the Info tab. Open the properties for Application Privilege Control rule triggered.

9. Click the checkbox beside On Administration Server for (days). If necessary, you can configure the settings to send the events to your email.

The server is able to register many events. These events will delete old ones as the Kaspersky Security Center database is filled.

After configuring these settings, you will be able to monitor when the files you have specified are launched. If one of these files launches on any computer, Kaspersky Security Center will register an event.

10. Save the policy.

These are the file types that are most often encrypted by ransomware:

If you have detected a suspicious file which might have infected your computer or encrypted your files, you can send a request to Kaspersky Lab Technical Support. Attach the file to your request and add the comment “possible cryptovirus”. You can find the files that were deleted during disinfection in backup storage.

1. Open Kaspersky Endpoint Security 10 for Windows. 
2. Go to Quarantine and then open the Backup tab.

Watch videos on how to protect against cryptoviruses in Kaspersky Endpoint Security 10: