Search the Community

Hello all, Thank you for looking; I appreciate your time! KIS version 21.3.10.391 Win 10 Home x64 Build 19045 KIS has begun briefly crashing and restarting within seconds, both passively and especially during full scans. The crashes during scans happen at different points in the scan i.e. not at the same % completion / block of files being scanned. I can still complete quick scans, and background scans complete successfully. At first I could start a new full scan and it would complete most of the time; now it crashes at every full scan. When KIS crashes, I get a notification (as expected) from Windows Defender that I should turn on Virus Protection. There have been no significant changes to my OS environment other than Win and KIS updates. I have not installed any other programmes recently. I am not running any other AVP.

There were no discussion I've posted last month. What happened actually for 9 days aprox. at May 12th 'rootkit/background scans' were not saving in the full report page like other scans. So with my old habit everytime these scans were about to happen I've kept tracked the time would start accordingly to my clock and when they would stop by checking how many minutes the last background/rootkit finished. And made a log everyday on notepad. That is how I've managed to keep tracking these scans since there bugging for no reason. And I've thought Kaspersky might be aware, collecting information gathered from their client base to figure out what issue is and get resolved as soon as possible. So I would not bother with another topic about an issue as this since unknown bugs are always related to updates and changes and since KS is set to update daily by automatic. Is an unknown ground which updated blew this off. Yesterday, I've noticed a similar symptom happening when I'd execute a 'quick scan' and when went to check 'full report page', there were no log about that 'quick scan' and the last detail was from another scan. So I have booted the computer and then I've started running path selected, or 'selective scans', 'quick scan' once more and somehow managed to save these reports at 'full report page'. At late last night after several searches and automatic database updates. What I have noticed is at 10:02 p.m. all scans/verifications I have started were being stored at 'full report page'. I may have antecipated with no further study and conclusion which gets a wrong image about my presence. So anyhow, it seems like is back to normal by sort of and if the next it happens another bug. I'll wait a day or two before spreading anything at the forum. My apologies for unwary discussion I should have gathered more information before posting this.

Hello @Psiu47, Welcome back! Do you have an example of how the Report is when the problem does not exist? When this *similar* issue happened - that (you) observed around 12th May 2024, was a topic raised by (you), we cannot find any? OR perhaps (you) escalated it to Kaspersky? *IF* the report was logging *path* for Quick, Full, Background etc - potentially there could be thousands of paths in the report... Our Background & Quick scan from the 11th of June 2024 or the 15th of May 2024: May 2024, Selective scan, shows path, see image Thank you🙏 Flood🐳+🐋

Ok...seems like is only affecting 'quick/full scans'. Ran another 'selective scan' or path file and it did save on report page.

'Report' page column is not saving or updating anymore which includes detailed information regarding viruses scan like 'full/quick/path file or external devices'. Not sure yet about background/rootkit scan since last time it happened was at 3 a.m. And going to wait untill it start 24 hours after. This similar bug happen to occur last month around May 12th and took more than 9 days to Kaspersky acknowledge that existing issue. And I was still studying that proccess and symptoms and wait so others could report this as well. Although back then that bug was only affecting 'background/rootkit scan'. But this happening out of the blue again but instead got to affect all type of scans on report page is one thing to get me annoyed. So I'm making this report as fast as I can so it get fixed as soon as possible. Last known scan was save and it happen to be 18 hours ago and the update pulled a search for at 1:39 a.m. of 06/10. Then at the same day on 7:00 p.m. this bug started. Any action I'd initiate like viruses scans were not properly being saved at report page.

I kept using your product even after i realized you charge more to the people renewing the licenses than the new buyers (i guess you think old customers are there to be milked)... I kept using your product even after i realized your servers were still inside Ruzzia even after you announced you left that bog (it was already paid, the damage was done).... I kept using your product even after your "quick scan" was shutting down my pc, and so often that it even ended up roasting my SSD (sent all of the evidence i had to support, mostly circumstantial mind you, even with a video and they couldn't believe it was their fault). But the last straw was having my pc restart constantly and without warning, completely randomly, and just because enabling the VPN (no logs, no nothing, not even system dumps!, months and months troubleshooting, I only made the connection that the pc was crashing/hanging/restarting ONLY AFTER i enabled the VPN and not at a set time but randomly afterwards, even if it wasn't already running... uninstalled and the pc has not restarted ever again since, ¿what the hell else are you doing to my pc that i don't know of?). You had a good product, the competition probably is not as good as your product, but it is definitely good enough to make the jump and just leave these licenses unused. I am trying really hard not to express all the expletives i think you deserve, but you just are not worth my time anymore.

Hi again, thanks for replying. I am searching in the actual vault (KPM app) not in the browser - (I know it sounds strange, it's really weird, presumably a bug). I have sync'd (it auto syncs but I checked also). I tried to take a screenshot to show you all is up to date but it seems that KPM cleverly prevents screenshots whilst open. You asked "iStorm cannot be found in the actual KPM vault application, on the computer", is that accurate please? " Yes, that is accurate. Autosave & autofill is ticked for 1. logins & password & 3. Bank cards (not 2. addresses). Thinking ahead, I thought you would recommend next that I reinstall this app on my PC so as I also use the iPhone and iPad KPM app every day I tried searching on that and it also doesn't appear there. The common denominator then is the website itself and the main thing I can think that's different to maybe all other sites is that it's mainly in Greek language (I have to use Google Chrome translate on the site). I did wonder whether it has saved in KPM in the Greek alphabet but when visiting the site the URL is in English as you can see from my screenshots. I did try translate and searching for 'καταιγίδα' in case but no luck. I have tried in KPM app scrolling down all entries to letter 'i' but there's nothing for istorm there. I am looking in 'all' and not 'favourites' It doesn't seem to appear in 'recents' but not all recent sites do (upon testing). Strangely when trying to log in on iPhone, tapping on the login name/email which displays the 'key' icon above the keyboard, on tapping the key which opens KPM app, it says 'no matching password' and 'show passwords' can't find it in search. Only the Chrome browser on PC recognises the website address and gives me the green KPM icon as per screenshots you've seen. I can't think of any other info to help identify this strange issue.

Dear Sir, Thank you very much for your quick respose. I couldn't find this particular page - yashasviworld . com/products?id=7&data_from=brand&page=1 as mentioned in your reply. Can you please confirm whether this script is in database or in Webpage.

Hello @GuiBesb, Welcome! *READ: Kaspersky for Windows, Background Scan - especially the parameters that control Background Scans* *As FYI - the Rootkit scan is run as a part of the Full Scan & the Quick Scan* *Second 'tip', IF (you) haven't done so, for Full & Quick Scans -> *after* running a clean scan, select -> Scan only new and modified files. Export Kaspersky Settings - see Manage Settings images at the end of reply. Restore Kaspersky Settings - see Manage Settings images at the end of reply. *Don't import Kaspersky Settings/config file while the problem is being worked on* Shutdown the computer using SHUTDOWN, not Restart, power computer ON by pressing the power button, login. Make sure Kaspersky Plus is running. Don't *manually* run a Rootkit scan, wait for it to run. IF the Rootkit scan does not *automatically* run in 36 hours *after* doing steps 1 to 5, log a request with Kaspersky Customer Service: https://support.kaspersky.com/b2c#contacts - on the support page, select either Chat or Email, then fill in the template as shown in the image below; please include a *detailed history*. Support may request logs, traces & other data, they will guide you: Now the ORIGINAL config can be Imported. Please update the Community with the outcome? Thank you🙏 Flood🐳+🐋 Manage Settings:

That's an enough powered system to get those issues are getting 🤔 About the detection of Your 1st post: PowerShell it's a Windows legit app, but it's true that it can be abused to execute malicious activity in the system, Kaspersky in those cases, can't delete PowerShell for obvious reasons, but blocks the malicious activity or any other malicious files spawned about that abuse... I never run Full Scans in my system, that's so crazy at best, and in a new system with all new files it may take hours... I run Quick Scans adding in the scope the folders: And with these tweaked settings: Security Level -> Extreme And enabling these settings: In Full Scan settings, you may enable this settings, to run it faster the later scannings: Just because progress remains at 1% for a long time does not mean that it has stopped or frozen there, that % may eventually be updated

Every second word about MBAM. Please stop. This is kaspersky forum not MBAM.. You wrote that you are experienced in many forums but you need learn basics on forum. If antivirus is not included in av comparatives test that means company of anitivirus dont want test it because they know that it is in poor shape (means bad protection, or mabye bad performance, many false positives etc).. I really dont want mentione a company bud i remember one german company was verry popular 20 years back... But now is missing in tests (still exists company but in tests is missing) why? Read above... As we wrote every antivirus have a special part (kaspersky have great detection behavioral, ksn cloud, Quick detection, anti ransomware detection etc)

quick scan dose not appear in the dropdown list of windows

Hello @cesarD, You're most welcome! Thank you for posting back & the extra question! And - it's wonderful to read - The screenshot is now black, so I guess it works! - that's a very good outcome - well done!! We first raised the issue with HQ experts in 2022, their final resolution came thru Feb 29th 2024, as follows: "You may find the SM documentation below in the section "About protection against screenshots" mentioning that screen capture with spyware is not possible: About protection of financial transactions and online purchases. In this case, only software based screen capture activities are blocked. The ability to take a screenshot is only possible by physically pressing the "PrtScr" key when it is needed by the user at the computer. It is also mentioned elsewhere in the "On-Screen Keyboard" section that screen capture using the "PrtScr" key cannot be prevented: About On-Screen Keyboard." We checked, the same information is also documented for v21.3 & the function worked as per design (for us), for that version too. Thank you🙏 Flood🐳+🐋

Hello @cesarD, Thank you for posting back & the information! IF (you) are taking screenprints with the Safe Money browser open & pressing the Print-Screen Key on the Keyboard - according to the experts from HQ this is working exactly as per design = it's working properly in all elements, however, IF (you're) using a *print-screen* function from a third-party application & the Safe Money browser & the images shows an image(s), i.e., the screen is not black - according to the HQ experts - this is *not* working as designed. This information is also documented for v21.3, v21.6, v21.7 etc, etc.... Thank you🙏 Flood🐳+🐋

Hello @cesarD & @nexon, We've discussed this issue in a logged case - in the past with HQ: SafeMoney & PrintScreen do work & SafeMoney, On-Screen Keyboard & PrintScreen also do work, i.e. screen-prints are not *black*. HQ experts advised: "software-based screen capture activities are blocked. The ability to take a screenshot is only possible by physically pressing the "PrtScr" key when it is needed by the user at the computer." @cesarD, we agree with @nexon, IF Kaspersky Standand is available in (your) region, it's advisable to upgrade. The software is available to download from this link: https://www.kaspersky.com/downloads#update-product. Kaspersky has replaced KIS & with Kaspersky Standard, there's no information available atm as to when KIS will be withdrawn; information about the *new* software range can be read here: Kaspersky: Basic, Standard, Plus, Premium - info & FAQ, by Danila T. Any questions or issues, please post back? Thank you🙏 Flood🐳+🐋

Hello @Boncip, Welcome! No. No. The Subscription *owner* shares the subscription, to allow for the other user to use the subscription; from their MyKaspersky account, on (your) device they will be able to: View the list of computer security problems and fix *some of them* remotely, Scan the computer for viruses and other threats - Full scan & Quick scan, Update databases and application modules, Configure *some* Kaspersky components & Disconnect (your) device. *READ* Remote management of computer protection. They will not be able to see (your) passwords or manage any of (your) data/files etc. *READ* Shared protection & all the sub-articles. Also note, Remote management & remoting to (your) computer are *different*, in (your) Kaspersky application, Self-defense, do not Allow managing Kaspersky settings via remote control applications & do not enable external management of system services, *READ* Self-Defense settings (you) can Password protect (your) installed Kaspersky application, *READ: How to password-protect access to the application management functions - however, this may not prevent the subscriber performing the above actions in point 3. as they *own* the subscription & they have *shared* their subscription with you - so they retain some control: Any questions or problems, please post back? Thank you🙏 Flood🐳+🐋

Is there any update on the "MR17" update? I certainly have many, many large files on the filesystems being scanned if that's the case. I've been experiencing this issue for what feels like a year or more now. Exact same symptoms as commonly reported over the last year or two. Full scan will always cause an application crash however, even when manual. System idle for many days will eventually cause a crash. Sometimes application can recover, other times application will fail to launch due to what appears to be the Kaspersky windows service locking up and cannot be restarted or stopped due to security and requires a reboot. I'm not totally comfortable submitting traces and have been watching from the sidelines.

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem Sometimes it's necessary to check KATA detects, for example IDS, IOA, Sandbox detects. Step-by-step guide IDS detects (SPAN) To check IDS detects (SPAN) you can use tcpreplay utility on server configured to receive SPAN traffic. KATA 4.0/4.1 tcpreplay package for such versions could be found here https://rhel.pkgs.org/7/epel-x86_64/tcpreplay-4.4.4-1.el7.x86_64.rpm.html KATA 5.+ and tcpreplay tcpreplay package is not installed by default, so you should install it manually, using step-by-step guide below: 1) Download this package from HERE 2) Place downloaded file tcpreplay_4.3.2-1build1_amd64.deb to your KATA node. For example, use scp: [user@host]$ scp <your-path>/tcpreplay_4.3.2-1build1_amd64.deb admin@<kata-ip>:/tmp 3) Run installation on your KATA node with the next command: [admin@katahost]$ sudo dpkg -i /tmp/tcpreplay_4.3.2-1build1_amd64.deb Success! Now you can use tcpreplay on your KATA 5.+ or any other UBUNTU system! Before using tcpreplay you should enable tx capture for span: KATA 3.7.* In technical support mode from user root run following commands : systemctl stop apt-preprocessor.service systemctl stop suricata.service rmmod pf_ring Edit file /etc/modprobe.d/pf_ring.conf: change line: options pf_ring enable_tx_capture=0 min_num_slots=16384 # tx capture is disabled to: options pf_ring enable_tx_capture=1 min_num_slots=16384 # tx capture is enabled save file. Start pfring and related services back: modprobe pf_ring systemctl start suricata.service systemctl start apt-preprocessor.service KATA 4.0/4.1 Edit file /etc/modprobe.d/pf_ring.conf: change line: options pf_ring enable_tx_capture=0 min_num_slots=16384 # tx capture is disabled to: options pf_ring enable_tx_capture=1 min_num_slots=16384 # tx capture is enabled save file. In technical support mode from user root run following commands: systemctl stop docker rmmod pf_ring modprobe pf_ring systemctl start docker tx capture for span is now enabled KATA 5.0/5.1/6.0 - see https://forum.kaspersky.com/topic/how-to-enable-tx-capturing-in-kata-katakedre-37514/ Eicar traffic detect: Upload EICAR-Test-File_TCP.pcap sample to server with SPAN interface, then execute command from root shell: tcpreplay -i ens34 EICAR-Test-File_TCP.pcap # ens34 in this example is SPAN interface Nmap traffic detect: Scenario is the same as for Eicar detect, only .pcap file differs (# tcpreplay HackTool.Nmap.HTTP.C&C.pcap). After testing detects from span we strongly recommend to disable tx capture back again by the same way as described above for enabling. AM Engine Use EICAR's - https://www.eicar.com/ Email - send the EICAR via SMTP to KATA 25 port. (SMTP processing needs to be Enabled of course). ProTip: you may use local swaks mail client on CN to skip elaborate mail setups. swaks examples swaks --server 127.0.0.1 --port 25 --from antony@test.org --to cleopatra@test.org --attach eicar.com swaks --server 127.0.0.1 --port 25 --from antony@test.org --to cleopatra@test.org --body "link_to_EICAR_here" Endpoint - put an EICAR file to the endpoint and fetch it using GetFile task, queue for scanning. YARA detects By default, no YARA rules are supplied with the product. For test purposes one can use a test rule from YARA docs https://yara.readthedocs.io/en/v4.1.0/writingrules.html rule ExampleRule { strings: $my_text_string = "text here" $my_hex_string = { E2 34 A1 C8 23 FB } condition: $my_text_string or $my_hex_string } The rule will mark any analyzed object containing $my_text_string or $my_hex_string. IoA detects To check IoA detect (IoA detects can be checked only if you have KEDR license): Copy .bat file from attached archive Test_IOA.rar(not_infected) to any folder on host with installed EDR and start it. After some time(KATA need several minutes to transmit and process telemetry from EDR) check alerts in KATA. Alert should have type ioa_test_detect. For testing IoA detects on host more than once, .bat file should be placed to different locations on this host. On the host with installed KEA run command below in the cmd.exe shell: wmic.exe sfdguninstallkasperskyblabla There can be something else instead of sdfg and blabla, important part of command is uninstallkaspersky Command execution will fail with error, but it's not important. After some time new IoA detect should appear in KATA web-interface. IoC detects One can use the custom rule for testing - Ioctest.zip (infected123) - it is triggered for "c:\windows\system32\calc.exe" Automatic sandboxing in EDR To check automatic sandboxing: Unpack the archive with sample, use default password for samples: autosbtest.zip NB! Do not change MD5 of the sample. Run the sample on EDR-protected host and wait for automatic SB detect: Sandbox detect To check sandbox detect we can use file SA_sleep.exe from archive no_am_detection sample.rar. Password is inside text document in archive. Go to KATA senior security officer web-interface. Choose Storage → Upload and upload SA_sleep.exe from attached archive for KATA checking. Kata should enqueue it to sandbox , then a bit later verdict from SB should be Suspicious Activity. If SA_sleep.exe produces Not detected verdict then please use test_sb.bat from the test_sb.rar URL reputation Firstly, confirm K(P)SN is configured and works properly. MD5 used in this example should return UnTrusted status: Check KSN on KATA command for KATA 4.+ and 5.0: docker exec -it `docker ps | grep ksn_proxy| awk '{print $1}'` /opt/kaspersky/apt-ksn_proxy/sbin/ksn_client --ip 127.0.0.1 --hash 9C642C5B111EE85A6BCCFFC7AF896A51 for KATA 5.1: docker exec -it $(docker ps | grep ksn_proxy| awk '{print $1}') /opt/kaspersky/apt-ksn-proxy/sbin/ksn_client --ip 127.0.0.1 --hash 9C642C5B111EE85A6BCCFFC7AF896A51 Secondly, For traffic: access http://bug.qainfo.ru/TesT/Aphish_w/index For email (SMTP processing needs to be Enabled), send the link above via e-mail. For quick and dirty test: swaks examples swaks --server 127.0.0.1 --port 25 --from fisherman@test.org --to cleopatra@test.org --body "http://bug.qainfo.ru/TesT/Aphish_w/index"

1.Modified firmware found The modified firmware may contain critical security vulnerabilities. Some apps could get additional permissions and send your sensitive data to third parties. The modified firmware could cause an irreversible device malfunction. 找到修改后的固件 修改后的固件可能包含严重的安全漏洞。某些应用可能会获得其他权限，并将您的敏感数据发送给第三方。修改后的固件可能会导致不可逆转的设备故障。 2.Turn off accessibility for unknown apps Accessibility gives an app access to the data that you enter, such as text or web addresses, and gives it access to the keyboard and microphone. For your data security, you are advised to turn off accessibility for unknown apps. 关闭未知应用的辅助功能 辅助功能使应用能够访问您输入的数据（如文本或网址），并允许其访问键盘和麦克风。为了您的数据安全，建议您关闭未知应用程序的可访问性。 怎么在，在设备上本地修复此问题

First quick answer: > Has the *new* Kaspersky *application* been signed into, from the Kaspersky application. > I cannot do anything from the application itself, just see the window stuck with the need for an activation code Not 100% sure if I had shut down the pc completely, doubt that this will change things dramatically but will try a little bit later

I appreciate your quick response. I think that Linux Machines will be upgraded during KSC 14.2 upgrade. I'm right? or Should I upgrade the Linux machines first and then run KSC 14.2 upgrade? Best regards

Is this what you wanted to find ? scroll down for release notes for previous versions https://support.kaspersky.com/KESWin/12.4/en-US/127969.htm and also look at the changes in hardware and software compatibility for the latest version 12.4 ... and for 12.2 12.4 - https://support.kaspersky.com/KESWin/12.4/en-US/127972.htm 12.2 - https://support.kaspersky.com/help/KESWin/12.2/en-US/127972.htm you can change the help description to suit the version you are interested in I'm afraid there is no ready-made quick comparison table...

Ok here are the steps I had to do . 1. removed McAfee from add and remove programs. It appeared to be successful . Started the Kaspersky standard installation , it detected McAfee WebAdvisor was still detected . and incompatable . I was not really surprised about that WebAdvisor was not removed by just deleting from the add and remove 2 So I cancelled installation , and use the McAfee tool and ran. Then went back to install Kaspersky . 3. Installation went well , already ran quick scan all is good , so no more issues Just wanted to update how it went for me on windows 11. Thanks again 😃

Thanks , yeah sorry for being paranoid . I finally managed to launch the KasperSky Plus . Only because i launched the VPN on my windows machine . It's a very cool software indeed ! I still sent a request for refund to customer support since i can't always rely on vpn , i hope they can understand my paranoid and weird words . Anyways i have a small problem now , I am trying to connect to offsec 's website using Kali linux 's virtual machine , but the vpn keeps failling (Openvpn) . However the vpn on my windows machine works perfectly fine , Any idea if kaspersky implements any kind of protections against the traffic coming out from Kali or the virtual machine itself ?? Thanks

In what respect @tunathefish? Most people know not to use anything other than the *recommended* OS. Read: Smart Home Monitor resources. Read: Wi-Fi Analyzer resources. Also, there's many Smart Home Monitor topics in the Forums - you can refine the search according to your requirements: https://forum.kaspersky.com/search/?q=Smart Home Monitor&quick=1 Thank you🙏 Flood🐳+🐋