Jump to content
AndyCripps

Warning: There are unprocessed files

Recommended Posts

I've been getting email event warnings from two PCs on our network via Kaspersky Security Centre, but when I look at both machines I can find nothing wrong with them. Below is a cut/paste of the event:

 

Event "There are unprocessed files" happened on computer XXXXXXX in the domain XXXXXXX on Thursday, June 15, 2017 10:24:52 AM (GMT+00:00)

Event type: There are unprocessed files

Application\Name: Kaspersky Endpoint Security 10 for Windows

Application\Path: c:\program files (x86)\kaspersky lab\kaspersky endpoint security 10 for windows sp1\

User: XXXXXXX\XXXX (Active user)

Component: Protection

Result\Description: Malware detected

 

I get emailed two event warnings, seconds apart, per PC. Like I say, I can find nothing wrong with these PCs, and nothing in the unprocessed files section on Kaspersky Security Centre.

 

Does anyone have any ideas as to what this might be, or what I am missing?

 

 

Share this post


Link to post
I've been getting email event warnings from two PCs on our network via Kaspersky Security Centre, but when I look at both machines I can find nothing wrong with them. Below is a cut/paste of the event:

 

Event "There are unprocessed files" happened on computer XXXXXXX in the domain XXXXXXX on Thursday, June 15, 2017 10:24:52 AM (GMT+00:00)

Event type: There are unprocessed files

Application\Name: Kaspersky Endpoint Security 10 for Windows

Application\Path: c:\program files (x86)\kaspersky lab\kaspersky endpoint security 10 for windows sp1\

User: XXXXXXX\XXXX (Active user)

Component: Protection

Result\Description: Malware detected

 

I get emailed two event warnings, seconds apart, per PC. Like I say, I can find nothing wrong with these PCs, and nothing in the unprocessed files section on Kaspersky Security Centre.

 

Does anyone have any ideas as to what this might be, or what I am missing?

 

Hello.

 

In KES SP1, one some occasions there happens a collision where an object is reported as unprocessed after in fact is has already been removed, which leads to a loop. It is recommended that you use the latest version of KES (SP2, 10.3.0.6294), where this behavior is reworked.

 

Thank you.

Share this post


Link to post
Hello.

 

In KES SP1, one some occasions there happens a collision where an object is reported as unprocessed after in fact is has already been removed, which leads to a loop. It is recommended that you use the latest version of KES (SP2, 10.3.0.6294), where this behavior is reworked.

 

Thank you.

 

Thanks Kirill, I've done this and it has resolved the issue for these two machines.

 

However, I have a similar message from a new PC. This one is using the latest version of the endpoint, so I don't know what could be causing this. The message is:

 

 

Event "There are unprocessed files" happened on computer XXXXXX in the domain XXXXXXXXX on Tuesday, July 4, 2017 10:44:22 AM (GMT+00:00)

Event type: There are unprocessed files

Application\Name: Kaspersky Endpoint Security 10 for Windows

Application\Path: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows SP2\

User: XXXXXXXX\XXXXX (Active user)

Component: Protection

Result\Description: Legal software that can be used by criminals to damage your computer or personal data has been detected

 

 

Once again, I've checked on the PC, and there is nothing reported there. There is nothing in the Unprocessed Files repository in KSC either. How can I clear this warning?

 

Thanks

 

Share this post


Link to post
Thanks Kirill, I've done this and it has resolved the issue for these two machines.

 

However, I have a similar message from a new PC. This one is using the latest version of the endpoint, so I don't know what could be causing this. The message is:

 

 

Event "There are unprocessed files" happened on computer XXXXXX in the domain XXXXXXXXX on Tuesday, July 4, 2017 10:44:22 AM (GMT+00:00)

Event type: There are unprocessed files

Application\Name: Kaspersky Endpoint Security 10 for Windows

Application\Path: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows SP2\

User: XXXXXXXX\XXXXX (Active user)

Component: Protection

Result\Description: Legal software that can be used by criminals to damage your computer or personal data has been detected

 

 

Once again, I've checked on the PC, and there is nothing reported there. There is nothing in the Unprocessed Files repository in KSC either. How can I clear this warning?

 

Thanks

 

Please specify if this is a recurring event, or it was only generated once.

 

Thank you.

Share this post


Link to post

This event keeps occurring. This morning at 07:54, then again at 08:44, then again at 12:44. I get two email notification the same time, saying the same thing.

 

Share this post


Link to post

Hello,

I have same/simillar issue. Warning status for 3 PC in different gruops (from 17 total PC-s) are "There are unprocessed objects". I'm unable to reset that status (tried full scan, sometimes in past that was helping).

KSC, agents and enpoints are latest version.

For some computers status has gone after removing file(s) from Backup repository, but for some computers there is no files in any repository...

Share this post


Link to post

Hi,

Please delete a PC with that status from it`s group, than from unassigned computers find it and move to corresponding group.

Thank you!

Share this post


Link to post

Hi Nikolay,

I tried this yesterday - deleted the affected PC from its group, left it a while, then added it back to the group - but this morning I have come in to two "Warning: there are unprocessed files" emails from KSC for that PC.

I've just reset the virus counter on that PC to see if that makes any difference. The frustrating thing is that it doesn't tell me which files are 'unprocessed' or what the application is that it thinks is causing a problem.

Share this post


Link to post

Hello,

please attach export of event log from KSC server where these events reside and GSI report with event log included from a problem machine.

Thank you.

 

 

Share this post


Link to post
21 hours ago, Nikolay Arinchev said:

Hi,

Please delete a PC with that status from it`s group, than from unassigned computers find it and move to corresponding group.

Thank you!

This works! Thank you!

Share this post


Link to post

I can't delete PC with this status. There is no Delete option nor in Right-click menu nor in Right-pane menu. I can only move this PC to other groups but no to Unassigned group. I can delete any other PC from any group though. Thank you in advance.

Share this post


Link to post
1 час назад, technikarc сказал:

I can't delete PC with this status. There is no Delete option nor in Right-click menu nor in Right-pane menu. I can only move this PC to other groups but no to Unassigned group. I can delete any other PC from any group though. Thank you in advance.

Hi,

Could you please describe your problem, provide screenshot or another. Also please specify versions and products that you use.

Thank you!

Share this post


Link to post

My problem is what this thread says: Warning: There are unprocessed files though I've cleaned everything up in KSC Repositories. None of above solutions works and by the way I found out that I can't delete this PC from gruop.

I'm using KSC with NA v10.4.343 and KES v10.3.0.6294 on workstation side.

Edit: I should mention that on this ADMIN3 workstation is installed KSC server itself. But I don't think that this may cause to remove it from group - in the beginning ADMIN3 on KSC was found like every other workstations in Unassigned group.

Screen Shot 07-21-17 at 08.06 AM 000.PNG

Screen Shot 07-21-17 at 08.06 AM 001.PNG

Screen Shot 07-21-17 at 08.06 AM 002.PNG

Screen Shot 07-21-17 at 08.07 AM 000.PNG

Screen Shot 07-21-17 at 08.07 AM 001.PNG

Screen Shot 07-21-17 at 08.07 AM 002.PNG

Screen Shot 07-21-17 at 08.07 AM 003.PNG

Edited by technikarc

Share this post


Link to post
2 hours ago, technikarc said:

My problem is what this thread says: Warning: There are unprocessed files though I've cleaned everything up in KSC Repositories. None of above solutions works and by the way I found out that I can't delete this PC from gruop.

I'm using KSC with NA v10.4.343 and KES v10.3.0.6294 on workstation side.

Edit: I should mention that on this ADMIN3 workstation is installed KSC server itself. But I don't think that this may cause to remove it from group - in the beginning ADMIN3 on KSC was found like every other workstations in Unassigned group.

 

Hello.

This is an issue specific to some installations and scenarios, which a script exists to fix. You can request it by creating an incident via CompanyAccount and stating the problem (as in issue 1892384).

Thank you.

Share this post


Link to post

Why not just make the script available freely instead of requiring a support incident be raised via Company account? Especially as doing so WITHOUT the paid subscription (at additional cost) for support via there you just get moaned at for using Company Account (it has happened every time I did it just to upload traces before they started allowing them to be sent via ftp). Is it some state secret?

Why not give out some details about what sort of circumstances and scenarios it occurs under? Or is that some utra-sensitive state secret as well?

This "unprocessed" objects which refused to be cleared "issue" comes back time, and time, and time again with KES. I've seen it repeat virtually throughout the whole, almost five years, of managing Kaspersky at our company. It never goes away for long.

But what do I care. I'm not sure if I can bothered with the machine I've had this issue on for the past (almost) week. We only have 14 days left on our licenses then were throwing Kaspersky out for good.

Edited by george.h

Share this post


Link to post

Sorry to contradict you Kirill, but "It is recommended that you use the latest version of KES (SP2, 10.3.0.6294), where this behavior is reworked." is wrong. We're running KES SP2 (10.3.0.6294) with KSC and NA 10.4.343) and is STILL happens. So, it may have been reworked, but it STILL happens and certainly has NOT fixed it.

Share this post


Link to post

Same problem in here.

Is there no real solution?!

 

I write about it in 

 

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.