Search the Community
Showing results for 'Quick Launch Keyboard'.
Found 1788 results
-
Gokyuzu posted a topic in Kaspersky: Basic, Standard, Plus, PremiumWhile my computer is running, whenever I launch Kaspersky, within 5–10 minutes my screen turns black and then comes back after about 2 seconds. I tested this many times and confirmed that Kaspersky is the cause. The issue happens even if I am idle on the desktop, without running any other applications. System details: -Operating System: Windows 10 Home, Version 22H2 (OS Build 19045.6216) -Kaspersky version: 21.22.7.466(a) -GPU: NVIDIA GeForce GTX 1060 6GB -Driver version tested: Latest driver 581.15 WHQL, also tested older versions with DDU clean install = issue persists -I don't use any other security software -Kaspersky settings: Default -Background apps: None (to minimize conflicts, I closed all unnecessary apps) Here are the troubleshooting steps I've already tried: -Updated GPU drivers (tested both latest and older versions) -Used DDU to perform clean driver reinstallations -Verified Windows is fully updated -Verified system integrity with: . "sfc /scannow" . "DISM /Online /Cleanup-Image /RestoreHealth" . "chkdsk C: /f /r" -Hardware has been tested and confirmed working normally I'm attaching a screenshot of the Windows Event Viewer section related to the error. Although this part is in Turkish, I've added an English version below. Here: "The description for Event ID 153 from source nvlddmkm cannot be found. The component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: \Device\0000007f Error occurred on GPUID: 100 The message resource is present but the message is not found in the message table." Thank you for your attention and support.
-
om richard posted a topic in Kaspersky: Basic, Standard, Plus, Premiumhow to disable kaspersky secure keyboard ? -
Psiu47 replied to Psiu47's topic in Kaspersky: Basic, Standard, Plus, PremiumAll I've got are old personal archives from my findings and this onde show is from KS 21.22 but still the unsolved mystery with scans not being saved and registered were acting defective for over two years. (Files are to big to post here) Back in 2024 in attempt to fix a common bug found by others where quick mouse virus scan prompt was not working. The instrunction was to repair or uninstal Kaspersky Standard. Doing that, It did solve this particular problem but my unknow bug remained unresolved. I've managed to survive with annoying bug for months untill KS 21.24 came, making all scans to disappear uppon finishing. So after all the embarassment spend trying understand why this curse never got resolved. I've ended up again in completely uninstal KS and downloading from MY KASPERSKY service account this layest version. Doing that, I've ran the background scan while installing and followed the progression till the end. The scan saved on reports page and I've began to execute many viruses scans to check If they were being saved, and not disappear. After four days putting to test, there have bem registered more than 23x viruses scans and they were all saved at last. Finally! 🙏 I've running now a Full scan like I usually do every week and I Hope Kaspersky co. start managing their updates with more caution and *don't* push newer version anytime soon. -
-
svc_kms posted a blog entry in Kaspersky Hybrid Cloud Security's Kaspersky Hybrid Cloud SecurityProblem: Create Group On Demand Scan Task of Windows Kaspersky Light Agent 5.2/Linux Kaspersky Light Agent 5.2 Launch Group On Demand Scan Task Group On Demand Scan Task of Windows Kaspersky Light Agent 5.2/Linux Kaspersky Light Agent 5.2 might detect infected object, but might not delete it. Solution: Delete created Group On Demand Scan Task of Windows Kaspersky Light Agent 5.2/Linux Kaspersky Light Agent 5.2 Delete all created Windows Kaspersky Light Agent 5.2/Linux Kaspersky Light Agent 5.2 Policies Add registry key on Kaspersky Administration Server 5_2_ksc_win_x86_fix.reg if Kaspersky Administration Server is installed on x86 operation system 5_2_ksc_win_x64_fix.reg if Kaspersky Administration Server is installed on x64 operation system Create Windows Kaspersky Light Agent 5.2/Linux Kaspersky Light Agent 5.2 Policies anew. Create Group On Demand Scan Task of Windows Kaspersky Light Agent 5.2/Linux Kaspersky Light Agent 5.2 Launch Group On Demand Scan Task of Windows Kaspersky Light Agent 5.2/Linux Kaspersky Light Agent 5.2 -
svc_kms posted a blog entry in Kaspersky Anti Targeted Attack & EDR Expert's KATA & KEDR Expert community articlesThere is an example of a step-by-step instruction to configure Single-Sign-On (SSO) for KATA 4.1/5+/6+ into HOME.LAB domain. Prerequisites Deployed Central Node Server Name should be FQDN. (In current case FQDN name of Central Node - kata-cn.home.lab) It can be checked via Settings/Network Settings of Central Node. A and PTR record should be set for Central Node in DNS. Domain User Account should be created to set up Kerberos authentication by means of keytab file (in current case Domain User Account is kata-sign-on). AES256-SHA1 encryption algorithm should be enabled into created Domain User Account. Step-by-step guide to create keytab file On Domain Controller: Launch CMD As Administrator Execute the following command to create keytab file C:\Windows\system32\ktpass.exe -princ HTTP/kata-cn.home.lab@HOME.LAB -mapuser kata-sing-on@HOME.LAB -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * +dumpsalt -out C:\TEMP\kata-sgn-on.keytab The utility requests the kata-sign-on user password when executing the command. The SPN of the selected server is added to the created keytab file. The generated salt is displayed on the screen: Hashing password with salt "<hash value>" For multiple Central Node servers you need to save "<hash value>" of hashing password to add an SPN for each subsequent Central Node servers further using ktpass.exe utility. On Central Node Web Interface Move to Settings/Users/Active Directory Integration Add the created keytab file: Keytab file status section contains File which contains SPN for this server The file contains section HTTP/*****@*****.tld Under Users tab click Add and select Domain user account. Set domain user as <username>@<domain> On client machine Host should be joined to the same domain. Domain user should be logged in with account added into the Central Node. Open Control Panel/Internet Options Click on Security and select Local Intranet Click on Sites and then on Advanced Add FQDN of central node - kata-cn.home.lab Close windows: Launch Web Browser and access to Web Interface of the Central Node https://kata-cn.home.lab:8443 and it should be opened without asking any Login/Password.
-
nicoret posted a topic in Kaspersky: Basic, Standard, Plus, PremiumEvery Kaspersky update I've ever done - since about 2016 - has something incomprehensible. I just downloaded Kaspersky Plus, installed, relaunched (Windows 7) and a Kaspersky desktop message says: "preparing to launch the application". It's been "preparing to launch the application" for about half an hour. About 15 minutes ago, the application, while still "preparing to launch", popped up a message saying my subscription was active until 15/07/2025. When I pressed "Continue", it asked me to insert the activation code. Of course, Kaspersky Plus does not require an activation code. But the "Activate" button is dead, waiting for me to insert an activation code. Of course I don't have one. Maybe I should just close the pop-up and carry on, right? But maybe that would abort the "preparing to launch the application" process? It's been 45 minutes and it's still "preparing to launch the application". What protection my PC has during this process, I dread to think. PS: While waiting for Kaspersky Plus to start working, I tried reactivating my old Windows Firewall but of course that is unreactivatable because it's being "managed by Kaspersky Standard" (not PLus?)
-
Hello @Pandonus, Welcome back! What happened - what errors show when Kaspersky Premium fails to update anydesk? Please look in Kaspersky Reports for any anydesk events & post back? Note - please post images in English - to convert the Kaspersky Gui to English - by pressing SHIFT + F12 on the keyboard; to revert press SHIFT + F5 on the keyboard. Are (you) able to update anydesk manually? *Note* when posting images to a public forum, for *your* privacy & security - please hide all personal information - for example - email address. Please post back? Thank you🙏 Flood🐳+🐋 -
Guest posted a topic in Kaspersky Endpoint Security for BusinessHello im using kaspersky endpoint security , I habe just upgraded my application and deployed to pc s but now the pc s are unusable due to kaspersky has blocked the keyboard and I cant press control alt delete. Can anyone help me please -
DaKo replied to TAE's topic in Kaspersky VPNThis is exactly what I tried to explain to Kaspersky support. They have changed their system (just after my yearly renewal), now my vpn is useless. And I have to go through all kind of steps, including installing a debug variant of VPN, send all kinds of reports, which I have to dig up in the android folders somewhere. I am not willing to invest my valuable time in this proces, so I decided to wait a few weeks, and then move to another VPN option. I am tired of providers who think they can launch new software/updates without taking responsability of thorough testing. I am not a test dummy! -
Yoji replied to Yoji's topic in Kaspersky: Basic, Standard, Plus, PremiumQuick update... Icon does seem to be green on many web sites... but not here on this forum.. May be it "off" for this site as it is Kaspersky's and so is trusted... I dont know.. but it seems to be all good. -
Help posted a topic in Kaspersky Security CloudI was trying to uninstall Kaspersky using the kaspersky removal tool. And halfway there I restarted the pc because of a windows 11 update and after the update my keyboard and mouse stopped working BUT both still works in the bios please help -
JoseCarlos posted a topic in Para usuarios particularesEstimado soporte, Desde hace un tiempo vengo experimentando un bug al abrir el teclado virtual de Kaspersky. Al abrirlo y pasar el puntero del ratón se oculta y no se ve sobre el teclado hacdiendo imposible su uso. Un saludo, José Carlos -
hega333 posted a topic in Kaspersky Total SecurityAfter installing Kaspersky, all USB input devices (keyboard & mouse) stopped working immediately after booting into Windows. Windows itself boots fine, but since no input devices work, I cannot log in. The issue started after attempting to install Kaspersky. During installation, it gave a message stating that Avira was still installed, even though it had been removed two years ago. I manually checked the registry and deleted two Avira-related entries, but one entry could not be removed. I continued with the Kaspersky installation anyway, and then both of my monitors went gray, and several DLL errors appeared. After restarting the PC, USB devices stopped working completely in Windows, even though they still work in BIOS and in the Windows Recovery menu. Steps Already Attempted (None Worked): 1. BIOS & Hardware Checks: - Keyboard and mouse work in BIOS, so this is not a hardware issue. - Legacy USB Support is already enabled in BIOS, so USB ports are not blocked at the motherboard level. - Tried multiple USB ports (front, back, USB 2.0, USB 3.0), but none work in Windows. - No PS/2 ports available, so that option is ruled out. 2. Windows Recovery & Safe Mode Attempts: - Booted into Advanced Startup (Recovery Mode), and USB devices work there. - Booted into Safe Mode (F4), but USB devices do not work. - Booted into Safe Mode with Networking (F5), but USB devices do not work. - Booted into Safe Mode with Command Prompt (F6), but USB devices do not work. - Attempted “Startup Repair” in Recovery Mode, but it did nothing. - Tried “Reset This PC” with “Keep My Files,” but it failed with the error “Could not reset this PC, no changes were made.” 3. Kaspersky Removal Attempts (Failed Due to No Input): - Tried opening Command Prompt in Safe Mode to uninstall Kaspersky, but no input devices work, so I couldn’t type commands. - Manually checked Kaspersky’s installation folders using Command Prompt in Recovery Mode: - C:\Program Files\Kaspersky Lab does not exist. - C:\ProgramData\Kaspersky Lab does not exist. - Manually checked Windows registry for Kaspersky-related services (klflt, klkbdflt, klmouflt, avp, etc.), but none were found. 4. USB Driver Repair Attempts (Did Not Work): - Tried enabling USB drivers manually via Registry in Command Prompt: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBHUB3" /v Start /t REG_DWORD /d 3 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhub" /v Start /t REG_DWORD /d 3 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbxhci" /v Start /t REG_DWORD /d 3 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbehci" /v Start /t REG_DWORD /d 3 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 3 /f None of these commands fixed the issue. - Tried forcing USB driver reinstallation using DISM & pnputil in Command Prompt, but it did nothing. - Checked disk partitions (diskpart) to confirm Windows installation drive was correct, but there was confusion with the drive letters (C: and X: were mismatched). Current Situation: - Windows still boots fine, but I cannot log in because keyboard and mouse do not work. - Recovery Mode recognizes USB, but Safe Mode and normal Windows do not. - Kaspersky is not listed in Program Files, ProgramData, or the registry, but the issue clearly started right after installing Kaspersky. - Resetting Windows fails, so I cannot even attempt a repair install from inside Windows. --- What I Need from Support: - How to fully remove Kaspersky (including any hidden services) without being able to log in. - How to manually enable USB drivers from Recovery Mode. - How to fix the "Reset This PC" failure in case a repair install is required. -
Hello @Surfrat, Welcome back! Yes, you can choose how to open On-Screen Keyboard: Open On-Screen Keyboard by pressing CTRL+ALT+SHIFT+P. Show On-Screen Keyboard quick launch icon in data entry fields. The On-Screen Keyboard quick launch icon is displayed in the password input fields on web pages.Click the Edit categories link to open the Categories window. In this window, you can specify on which websites the On-Screen Keyboard quick launch icon for On-Screen Keyboard should be displayed. Click the Manage exclusions link in the Categories window to create lists of websites on which you want to enable or disable display of the On-Screen Keyboard quick launch icon irrespective of the selected website categories. You can use masks when adding exclusions. Resources: About protection of data entered on the computer keyboard About On-Screen Keyboard Thank you🙏 Flood🐳+🐋
-
svc_kms posted a blog entry in Kaspersky Security Center's Kaspersky Security Center CommunityScenario Administrator tries to install Kaspersky Security Center Network Agent (klnagent). One of the errors occur: Setup Wizard cannot process the command line Failed to definitely identify the status of the installed application. Remove the application manually or use the setup wizard In case of standalone package, installation error might be a little different: Setup wizard cannot process the internal error When looking closely to $klnagent-setup* logfile, the following error is found: 27.10.2025 13:59:12.004 00000B14.000007B8 L1 KLERR: #1, Error was caught in CInstaller::PreInstall, c:\a\c\g_4b8zduag\r\product\osmp\ksc\dev\install\wix\setup\installer.cpp@688. Error params: (1181/0x648 ("System error 0x648 (Propriedade desconhecida.)"), "KLSTD", c:\a\c\g_4b8zduag\r\product\osmp\ksc\dev\common\installer\install_utils.cpp@609) Error loc: ''. This means there are some remains of the Network Agent in registry that need to be cleared for successful installation. Troubleshooting steps Collect data Export the whole Computer registry branch and provide $kl* install log files. Steps to export the registry 1. Press Win+R on the keyboard. 2. Type regedit and click OK. 3. Right click on Computer → Export 4. Save as type: Registration files (*.reg) 5. Please collect the GSI report, run utility as Administrator, Include Windows Event Log. Find the detailed steps here: https://support.kaspersky.com/3632#block1 Analysis and troubleshooting 1. Make sure $klnagent-setup-<timestamp>.log contains System error 0x648: 27.10.2025 13:59:12.004 00000B14.000007B8 L4 INSTALL_UTILS: GetProductInfo({0F05E4E5-5A89-482C-9A62-47CC58643788}, VersionString) called... 27.10.2025 13:59:12.004 00000B14.000007B8 L1 KLERR: #1, Error was caught in CInstaller::PreInstall, c:\a\c\g_4b8zduag\r\product\osmp\ksc\dev\install\wix\setup\installer.cpp@688. Error params: (1181/0x648 ("System error 0x648 (Propriedade desconhecida.)"), "KLSTD", c:\a\c\g_4b8zduag\r\product\osmp\ksc\dev\common\installer\install_utils.cpp@609) Error loc: ''. 2. Search the registry file for any occurrences of Kaspersky Network Agent or Kaspersky. Search only at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer, HKEY_CLASSES_ROOT\Installer HKEY_CURRENT_USER\Software\Microsoft\Installer You will find either of: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1971608977-3548673899-3505954282-500\Installer\Products\5E4E50F098A5C284A92674CC85467388] [HKEY_CLASSES_ROOT\Installer\Products\42FC4FCBBA881E546A6E048C72A8075C] 3. Go to HKEY_CLASSES_ROOT\Installer\UpgradeCodes and search for 5E4E50F098A5C284A92674CC85467388 or 42FC4FCBBA881E546A6E048C72A8075C Delete the found registry branches: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1971608977-3548673899-3505954282-500\Installer\UpgradeCodes\5278159B67B039744A906C974424BF05] [HKEY_CLASSES_ROOT\Installer\UpgradeCodes\5278159B67B039744A906C974424BF05] These entries can be in user portion of Windows registry so the search should be performed in the whole registry. It might be that Network Agent removal tool cannot delete entries from registry, this is why this manipulation is required. Once all such entries are deleted, Network Agent installation should be successful.
-
paul_33 replied to paul_33's topic in Kaspersky Endpoint Security for BusinessWe're on 12.11.0.637 right now It seems like some computers are fixing themselves without having to do anything, while others are suddenly experiencing this issue out of the blue despite working since the update. So now I am not sure what is causing this. One computer that I had previously reinstalled suddenly starting having it again, then after a few restarts it fixed itself. There needs to be a quick way to fix this because users can't be carrying on while their AV is not running correctly. Shouldn't it try to restart protection on it's own? -
George Whittle replied to S.E.'s topic in Kaspersky: Basic, Standard, Plus, PremiumMy question regards the "Kapersky keyboard" that shows up on my Mac every time that I try and key in a password. It blocks my ability to see what I am typing withmy own keyboard (or if I use the Kapersky keyboard), and sometimes I can't make the keyboard disappear. Is there any way to just not have the Kapersky keyboard show up on my screen at all. I never use it, and it just gets in the way. -
Ar ar ar replied to AngryAlpaca's topic in Kaspersky: Basic, Standard, Plus, PremiumI hate kaspersky because it keeps making a please wait loop and when time runs out, the pig app just decides to block quick share -
MFFChef replied to BlackEdition's topic in Kaspersky: Basic, Standard, Plus, PremiumI found Kaspersky, as well as two other previous softwares, cannot discern between a standard form field and one that needs extra care. Always sticking the prompts in a standard address field or whatever. I did find a control for this in the primary Kaspersky interface by typing "key" in the search field at the top, and selecting secure data input. You can keep the function enabled, but called upon with a keyboard shortcut only, and then disabling the prompt. You can choose types of fields you want the virtual keyboard to pop up in, but I have no faith. I have Bitwarden for my passwords and credentials, so no typing anyway. -
David Rose posted a topic in Kaspersky: Basic, Standard, Plus, PremiumAutorenewal failed because my credit card expired. I cannot find anywhere to supply new card details. When I 'retry' card, and enter new details there, I get an error. How do I fix this? -
svc_kms posted a blog entry in Kaspersky EDR Optimum's Kaspersky EDR OptimumProblem Using EDR, you may encounter an issue where you're unable to view incident card regarding a detection in KSC Web Console. It looks like this: Here we will discuss known causes of such behavior (several products are involved, so causes may be different). Possible causes and solutions MDR In MDR, incidents are to be viewed using the dedicated MDR Console, and KSC version 13 and newer with configured MDR plug-in. KSC 12.* Web Console will not receive the data; this is expected behavior. KES+KEA If you first install KES without EA component, and then a standalone KEA package, KES EDRO integration will be disabled and killchain will not work. Here is a quick way to determine if KEA was installed as a component of KES. Open regedit, then navigate to: [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\protected\KES\Installer\features] "AntiAPTFeature" = "1" If the value is 0, proceed to the workaround to enable the component as described below. To fix this, we ran Change application components task on the host, enabling Endpoint Agent in KES. If KES/KEA integration is configured correctly, we can find the following in KES traces: 12:08:37.426 0x2a18 INF edr_etw Start processing detect = http://www.virusanalyst.com/eicar.zip//eicar/eicar.com, recordId = 6, taskId = 1128, result = 0 12:08:37.426 0x2a18 INF edr_etw Start processing actions = http://www.virusanalyst.com/eicar.zip//eicar/eicar.com, action = 4, recordId = 6, taskId = 1128, edrAction = 3489660999, result = 0 12:08:37.442 0x2a18 INF edr_etw Killchain is enabled! 12:08:37.442 0x2a18 INF edr_etw SystemWatcher is running! 12:08:37.442 0x2a18 INF edr_etw product::component::edr::`anonymous-namespace'::IsSystemWatcherDetect begin 12:08:37.442 0x2a18 INF edr_etw product::component::edr::`anonymous-namespace'::IsSystemWatcherDetect end 12:08:37.442 0x2a18 INF edr_etw product::component::edr::`anonymous-namespace'::InvestigateProcessIds begin 12:08:37.442 0x2a18 INF edr_etw product::component::edr::`anonymous-namespace'::InvestigateProcessIds end 12:08:37.442 0x2a18 INF edr_etw Finish processing detect = http://www.virusanalyst.com/eicar.zip//eicar/eicar.com threat status = 1, recordId = 6, taskId = 1128,result = 0 12:08:37.458 0x1f18 INF edr_etw Finish processing AV detect result = 0 Searching for ThreatID in KEA traces: 12:08:37.426 0x2a18 INF amfcd ThreatsProcessingEventsLogic::OnTreatActionImpl: ctx:0x23d68510 [TI 0x1b8dd490: id = 0x6, : tdid = {7F620459-6C51-9E46-9A5D-689A9B0D0098}, name = http://www.virusanalyst.com/eicar.zip//eicar/eicar.com, add info: <none>, 0x0] 0x4 0x0 KES+KEA (upgrade from KESB to EDR Optimum) EDR Optimum requires KSC 12.1 or newer to work. This includes the Network Agent, which is a part of KSC, and is generally installed on the host alongside KES. Using an outdated version of Network Agent (10.5, 11, etc.) will lead to the mentioned error when opening incident cards. If Network Agents were not upgraded along KSC, it's better upgrading them for EDR Optimum. KES 11.7+ Check that EDR Optimum feature is enabled in registry (GSI > Registry > HKLM_Software_Wow6432Node_KasperskyLab.reg.txt ). [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\protected\KES\Installer\features] EdrOptimumFeature = 1 If value is 0, run Change application components task on the host, enabling EDR Optimum in KES. Also in traces (*.SRV.log) you can search for sentence bundles::InstalledFeaturesProvider::InstalledFeaturesProvider and check that EDROptimumFeature is there, for instance in example below such component is missing KES.21.9.6.465_05.18_14.00_3952.SRV.log 11:00:36.897 0x26a0 INF bundles::InstalledFeaturesProvider::InstalledFeaturesProvider{ 3 (AVScannerAndCoreFeature) 28 (AdaptiveAnomaliesControlFeature) 0 (AdminKitConnectorFeature) 24 (AdvancedThreatProtectionFeature) 27 (AmsiFeature) 7 (ApplicationControlFeature) 17 (BehaviorDetectionFeature) 30 (CloudControlFeature) 4 (CriticalScanTask) 6 (DeviceControlFeature) 23 (EssentialThreatProtectionFeature) 11 (ExploitPreventionFeature) 8 (FileThreatProtectionFeature) 19 (FirewallFeature) 5 (FullScanTask) 2 (HostIntrusionPreventionFeature) 16 (MailThreatProtectionFeature) 14 (NetworkThreatProtectionFeature) 12 (RemediationEngineFeature) 25 (SecurityControlsFeature) 18 (UpdaterTask) 21 (WebControlFeature) 20 (WebThreatProtectionFeature) 22 (WholeProductFeature) } KSWS+KEA The same rule applies: KEA component needs to be installed in KSWS. KSWS does not have a "Change application components" task in KSC, so this has to be taken into account during KSWS deployment. Here is a quick way to determine if KEA was installed as a component of KSWS. Open regedit, then navigate to: [HKEY_LOCAL_MACHINE\Software\Wow6432Node\KasperskyLab\\WSEE\11.0\Install] "Features"="AntiCryptorNAS=0;AntiCryptor=0;AntiExploit=0;AppCtrl=0;AVProtection=0;DevCtrl=0;Fim=0;Firewall=0;ICAPProt=0;IDS=0;Ksn=0;LogInspector=0;Oas=0;Ods=0;RamDisk=0;RPCProt=0;ScriptChecker=0;Soyuz=0;WebGW=0" (Soyuz needs to be set to 1) If Soyuz is set to 0, apply workaround to enable it. KSWS allows to change its components locally or via cli. Here is the example of how to set Soyuz=1 when KEA was installed not as a component of KSWS: 1. Locate ks4ws_x64.msi or ks4ws.msi (depends on OS architecture) 2. Create custom installation package based on ks4ws_x64.msi or ks4ws.msi from p.1 with parameters as per screenshot (add UNLOCK_PASSWORD= if KSWS is protected by password in policy) 3. Deploy package on problematic servers with KSWS and KEA, then check registry that Soyuz=1 4. Check host's properties at KSC side - EDRO should be in Running state in KEA If KSWS/KEA integration is configured correctly, we can find the following in KSWS traces: 19:57:04.577 7a8 1310 info [edr] Published ThreadDetected: VerdictName : HEUR:Win32.Generic.Suspicious.Access RecordId : 0 DatabaseTime : 18446744073709551615 ThreatId : {ffb58079-6d8d-4a62-8ab0-021ff4ed61c5} IsSilent : false Technology : 3489661023 ProcessingMode : 3489660948 ObjectType : 3489660934 ObjectName : C:\Windows\System32\wbem\WmiPrvSE.exe Md5 : e1bce838cd2695999ab34215bf94b501 Sha256 : 1d7b11c9deddad4f77e5b7f01dddda04f3747e512e0aa23d39e4226854d26ca2 UniquepProcessId: 0xf7c807730e051a0d NativePid : 3360 CommandLine : AmsiScanType : AmsiScanBlob : FileCreationTime: 1601-01-06T23:09:56.075520800Z Searching for ThreatID in KEA traces: 19:57:05.583 704 9b0 debug [bl] ThreatsHandler: detect v2 verdictName: HEUR:Win32.Generic.Suspicious.Access detectTechnology: 0xd000005f processingMode: 0xd0000014 objectType: 0xd0000006 objectName: C:\Windows\System32\wbem\WmiPrvSE.exe nativePid: 3360 uniquePid: 17854528913448180237 nativePidTelemetry: 3360 uniquePidTelemetry: 17854528913448180237 downloaderUniqueFileId: <none> downloadUrl: <none> isSilentDetect: false threatId: ffb58079-6d8d-4a62-8ab0-021ff4ed61c5 19:57:05.583 704 650 info [evtstt] NetworkConnectionHandler statistics: queueSize=0, received=59675, processed=59675, dropped=0, queueBytes=191 19:57:05.583 704 650 info [evtstt] NetworkConnectionHandler statistics: queueSize=0, received=59676, processed=59676, dropped=0, queueBytes=132 19:57:05.583 704 650 info [evtstt] NetworkConnectionHandler statistics: queueSize=0, received=59677, processed=59677, dropped=0, queueBytes=371 19:57:05.583 704 9b0 debug [bl] Threats Handler: event processed, id = 2 19:57:05.584 704 1fc debug [killchain] Message discarded: name = ThreatDetect The verdict is Message discarded, this means the detection won't trigger killchain generation. No such entries can be found in traces, which might mean that EPP integration is not configured correctly (EDR component is disabled in KSWS). Check killchain presence on the host If all pre-requisites are met, it's worth checking if killchain files are actually created on the host. To check that, run cmd.exe as Administrator and check the c:\ProgramData\Kaspersky Lab\Endpoint Agent\4.0\Data\killchain\detects folder contents. Archives with <threat_id>.zip names should be present in the folder: C:\WINDOWS\system32>dir "c:\ProgramData\Kaspersky Lab\Endpoint Agent\4.0\Data\killchain\detects" Volume in drive C has no label. Volume Serial Number is 8010-ADC0 Directory of c:\ProgramData\Kaspersky Lab\Endpoint Agent\4.0\Data\killchain\detects 08/16/2021 12:20 PM <DIR> . 08/16/2021 12:20 PM <DIR> .. 08/16/2021 09:34 AM 636 0349c190-4ac3-4da4-9b64-07835298660f.zip //this is an archive with killchain info 08/16/2021 12:18 PM 696 1d306aa7-f37f-4ab2-969e-d337d398a995.zip 08/16/2021 09:34 AM 637 23a5dc93-5776-43c8-b949-79c102aa1184.zip 08/16/2021 12:19 PM 691 27bc9ea3-200b-49d2-b8b0-df7954cd428a.zip 08/16/2021 12:19 PM 683 40673c70-9e8e-420f-b5ce-65b406862b94.zip 08/16/2021 12:19 PM 688 590b6e30-4509-4b25-bdb0-062f89b7e062.zip 08/16/2021 12:20 PM 693 67993612-dc82-45a2-9e5b-74756adc46eb.zip 08/16/2021 12:20 PM 685 6a892bd1-f452-42d0-80b0-cb953cd7fc26.zip 08/16/2021 12:19 PM 686 a63fbafa-fcef-46f7-935f-42be4392a172.zip 08/16/2021 12:19 PM 699 d9d4f5eb-42b2-4460-8f8a-eb63bbef8791.zip 08/16/2021 12:19 PM 686 f6042624-9840-4a6e-9b30-9270cce22236.zip 11 File(s) 7,480 bytes 2 Dir(s) 240,763,092,992 bytes free
-
Decimus Maxentius posted a topic in Kaspersky: Basic, Standard, Plus, PremiumHello. How to stop Kaspersky from creating shortcuts on my Desktop, this happens after software or database updates. Antivirus is not something you explicitly launch everyday like Microsoft Word, Microsoft Excel, Google Chrome, etc. Antivirus should run in background so I don't need to keep Antivirus (Kaspersky) shortcut on my desktop, because I will not launch it manually everyday. Why does it keep creating shortcut on my Desktop? I don't like it's behavior it acts like its a Boss on my PC and I'm just a guest or employee. WTF? BTW deleting Kasperksy shortcuts from my desktop requires me to enter the Admin password. STOP doing this on my PC. It is MY PC not yours. -
Hello, Additionally, you can change the language of the installed version to English within the application by pressing SHIFT + F12 on the keyboard, and if you want to return to the original installed language by pressing SHIFT + F5 on the keyboard. You have to do it every time Otherwise, you have to do what your colleague mentioned. Regards -
MightierPen posted a topic in Kaspersky: Basic, Standard, Plus, PremiumI have my file manager windows app blocked from network activity. But using that file manager I have some url shortcut files, as bookmarks to those websites. If my windows default web browser is not currently running then clicking the file will launch the browser but Kaspersky blocks it. Even though the browser is network allowed. If I run my browser first then copy over the url into the box it isn't blocked. This happens with any kind of file where I want the program not to connect to the internet but if it runs a file that I want to connect it won't. How can I allow url shortcuts to pass but keep the file manager blocked? Same with updating software. I wish that for my apps I can "Check For Updates" and Kaspersky will allow it, but that's the only thing it will allow.
