I created a new Chrome profile for the user then deleted the old one (it has to be done in this order) transferring over only the bookmarks via export and import. This seems to have cleared up the problem (fingers crossed). BTW- It seems that "site notifications" are a new web feature (or at least new to me). These pop up in the system notification area, outside the browser window, and can persist even after the browser is exited. It was this "improvement" that confused me into thinking these were OS notifications.

Welcome to Kaspersky Community. Find an option in Your KF settings called: Launch Kaspersky at computer startup, and manually disable it. Re-enable Self Defense. To run KF again manually, just do it via its K. icon.

As far as I can tell this malware works by overriding the meaning of the "New Tab" address in chrome (chrome://newtab), replacing the real editable start page with a fake (non editable) copy of the default start page. I found a useful comment on Reddit- Found a solution to the chrome://newtab yahoo/bing/etc search hijacker : r/chrome Unfortunately it seems to spray bad links all over the users profile (mostly directed via Yahoo) so a profile reset or a clean reinstall of Chrome may be the only options.

How can I set Kaspersky Service 21.22 (AVP21.22) startup type to manual, and also stop the service after exiting Kaspersky Free? The Self-Defence settings are all turned off: * Security settings / Self-Defence settings / Enable Self-Defence = OFF * Security settings / Self-Defence settings / Block external management of application services = OFF But I still have no access to the service: sudo sc config avp21.22 start= demand [SC] ChangeServiceConfig FAILED 5: Access is denied. sc qprotection avp21.22 [SC] QueryServiceConfig2 SUCCESS SERVICE avp21.22 PROTECTION LEVEL: ANTIMALWARE LIGHT. Windows 11 Pro, v10.0.26100.6584 Kaspersky Free 21.22.7.466(a)

Also, do a Chrome config reset, also check in Your Windows -> Control Panel -> Programs and Features, if there is a suspicious app installed.

@colin_e Also, did you check with AdwCleaner ?

Please check the system requirements of Ksos, ksos is not supported in Datacenter mode of Windows server . System Requirements: https://support.kaspersky.com/ksos/8.22/43520

Hi, thanks for coming back to me. >> Please provide version of K. product installed. Hmm. I've been using KAV for years, but every couple of years they change the UI, and now I find this very basic question isn't so easy to find the answer for? Annoying that this information does not seem to exist in the main application UI (surely this can't be true?) HoweverI found it under the right-click context menu of the systray icon- Kaspersky Standard 21.227.7.466 (a) Virus database is up to date >> That looks like just a fake / false infection pop-up warning coming from a site, just a site notification in Your browser, not a real infection. Yes that does seem to be the case. They do quite a good job of mimicing OS notifications. I originally thought that the popups were independent of the browser, however I was mistaken. This user uses Google Chrome as their default browser. A couple of days ago they noticed that their Chrome home page had changed from their personal set of preferred links to a generic set of home links (YouTube, Netflix etc.). I have checked and they have no Chrome extensions installed, so it seems this home page has been hacked or overridden and this is where the popups are being triggered. Kinda worrying that the Chrome config can be changed in this way without the user realising. Any hints on cleaning up the start page would be welcome. Worst case I can remove and reinstall Chrome, but i'm rather concerned if the same thing could happen again on a "driveby" basis, i.e. if this can happen just because the user visits the wrong web site.