Search the Community

Dear All, My client company facing a malware infestation issues on their network. This infestation happened before the came to me to use Kaspersky products. And they have been infected by this brontok viruses. First of all their Kaspersky subscription are not covering all of their PC within their network due to their budget issues, and currently we are still coordinating with them to deploy Kaspersky Free on the remaining unprotected PC. So you should understand, at least 60 PC are protected by Kaspersky Endpoint Security 11.3 and some protected by KES 10 due to still using old OS such as Win 7 no SP and there's maybe around 10 more that still unprotected by any AV. So now moving to the issues, the detection rate of brontok viruses has reach almost 1 million in their network. Sound good that Kaspersky can detect and delete the brontok, but what make things weird is that, the detection keep coming from the same PC and the same folder and location again and again and again. And even though i launch full scan, advance disinfection, Kaspersky successfully detect and delete the brontok, but, it kept poping out again few minutes later. We suspected that there's might me somehow Kaspersky might has missed one of the brontok bodies in the PC that might cause it continuously popup again and again on the same location. is there anyway that we can somehow troubleshoot and find the root cause of this infestation? Can anyone guide me how to find and cleaning up once and for all? Picture below is the report from KSC on detected thread, the picture shown detection on 22nd of June Morning, 24th of June Morning and 24th Of June on the afternoon. The Kaspersky seems to found the Brontok at the same location each time it detected it. The detection below came from the same PC. And Everyday Kaspersky detect and delete the Malware but it like keep poping up again and again.

Hello @lorcav123, For Kaspersky Security Cloud free, the Kaspersky protection extension provides On-screen keyboard only. If Kaspersky Cloud Free version 2020 is installed, Kaspersky protection extension v2020 should be used, if Kaspersky Cloud Free version 2021 is installed, Kaspersky protection extension v2021 should be used. Vivaldi is not supported. Brave is not supported, Kaspersky have given no indication if they will support Brave. Unlike the original Kaspersky Free, there is no separate documentation for Kaspersky Security Cloud Free.Thank you🙏 Flood🐳 +🐋

Hi and thanks for the quick answer. I do receive emails, but never received a push notification. Push notifications are enabled on my app. My daughter uses a Xiaomi phone and a Huawei tablet (without Google services). My phone is a Pixel 5 (Android 11). Also, I checked my daughter's screen when her time finished and there was no “request more time” button, just something about complaining to the developers.

Hi @Flood and Flood's wife , thank you so very much for responding. Dreadful would be an understatement, really. Yes, I have done a quick check on installed apps incompatible with the Kaspersky product and I don’t have any of those on my Mac. My MacOS version is the 11.0 Big Sur and it meets all Kaspersky system requirements. I’m incredibly frustrated, I can only hope the technical support gets back to me in time.

Hello, If you are sure that the password you entered is expected, please test your keyboard input, enter the password in the “Notepad” application, and check whether the displayed content is consistent with expectations. Usually, when entering a password, upper and lower case may be confused, so this situation is more common. Regards.

I upgraded my MacBook Pro 16 inch to Big Sur yesterday and after having problems getting Security and Privacy to accept my "system enhancement" I now can’t get Kaspersky Internet Security (latest version) to connect to the internet in order to do an “update of definitions”. When I go to “My Kaspersky” web site is shows that, in fact, my MacBook Pro is not connected to the net and therefore I am unable to update. I also can not for the life of me get Kaspersky to accept my “hard drive” in order to do either a “quick scan” or “full scan”. Can anybody suggest how I can solve this issue please? I have a strong wifi connection and am experiencing no problems with other applications connecting to the web. Thanking you in advance Sabina Tokyo, Japan

Hello, there are events: Faulting application name: avp.exe, version: 20.0.14.1085, time stamp: 0xef50701b Faulting module name: cryptnet.dll, version: 10.0.18362.1, time stamp: 0x00ac9791 Exception code: 0xc0000005 Fault offset: 0x0000b000 Faulting process id: 0x292c Faulting application start time: 0x01d643c63b6727db Faulting application path: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 20.0\avp.exe Faulting module path: C:\WINDOWS\SYSTEM32\cryptnet.dll As a variant, lets try to search for this cryptnet.dll and other processes which use this dll file. For instance with Proccess Explorer tool from Microsoft (https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer). Launch the tool as Administrator - click an icon Find handle or dll - paste there the name of the dll file (cryptnet.dll) - click Find. Send a screenshot of the result. Plus it is necessary to receive several full dumps: "C:\ProgramData\Kaspersky Lab\KAV.20.0.14.1085k_06.16_21.05_1372.SRV.full.dmp" Send it to me in an archive.

Hi and thanks for the quick reply! Android version. The app is running, limits have not expired. He only listens to the audio, so after a few minutes the screen turns off. I tested it today: despite Storytel running for over 30 minutes (screen off, only audio), only 1 minute is registered as device usage. Regards

Hello @hankas, Unfortunately, Background scan has no Schedule options, it’s either on or off. Quick & other scans & Vulnerability scan can be scheduled to run when the computer is idle. According to a Kaspersky SME, Kaspersky’s definition of “idle” is: “usually the machine is locked: Screensaver or no processes are running.” Updates have the scheduling options we mentioned in our first reply. Please submit a Feedback, I have a suggestion request to Kaspersky Technical Support: After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will be in touch, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in their MyKaspersky account.Note: the process may take a very long time, each request is measured against many benchmarks and not all requests are successful. When feedback from the Kaspersky Technical Team is available, please share it here in the Kaspersky Community? Thank you🙏 Flood🐳+🐋

An update. I believe I may have solved both the problem I identified in the title and the problem that Flood identified for me as a question which was why was I still running V19 The reset made no difference but I then had an idea which was to check to see if my wife who shares the same computer had the same problem when she tried opening the Secure keyboard. She did not and I noticed that she did not have the yellow and blue shield attached to her Chrome icon which I did to mine, so I assumed that the change in my case may have been the problem and simply decided to uninstall and re-install Chrome and that cured the problem. Why this made the difference and why it had appeared on my desktop we may never get to the bottom of, I suppose In terms of KIS I noticed that I had the Global version and not the European one so I simply downloaded the European version which gave me 21.1.15.500(c) So thanks all for the help but just one more question if I may. Can I take it that from now on KIS will automatically move me to the next version when it is released? mikethebike

Same issue for us, all the computers we move to Kaspersky v 11.2.0.2254 get keyboard issue. We need to fix registry key as explained by bhb user : Deleting the word “klkbdctl” in the UpperFilters key in: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} Delete ONLY “klkbdctl” inside the key, else it won’t work

Hi @phunction , Do you use other Kaspersky products, like Safe Kids? Run KAVRemover utility with --nodetect key: - download kavremover utility (https://support.kaspersky.com/1464). - run CMD (Windows Command Processor) by pressing Win+R, then type CMD and press Enter - drag the downloaded file kavremvr.exe to CMD window - press "Space" on the keyboard and type: --nodetect - press "Enter" - choose from the drop down menu the Kaspersky Free\Kaspersky Anti-Virus\Internet Security\Kaspersky Total Security 2021 (or another version, that you had installed) - enter the code from the picture and run the removal process - restart PC Regards, Igor

Hello @mikethebike, Welcome back! We tested with v21 (not 20), Secure Keyboard is working in all browsers.Try resetting KIS, use the procedure we’ve provided previously, if that does not work, either uninstall KIS & do a clean install or log a case with Kaspersky Technical Support, they will need a GSI & windows Logs & they will request Traces captured as the issue is replicated, they will step you thru the correct collection process. Also, may we ask why you’re still using V20 please? Thank you 🙏 Flood🐳&🐋

Thank you very much for the quick answer @Berny

From last 2 weeks I have observed suspicious activity going on in my Laptop. Here are the symptoms/sequence of events happening and few things I tried but nothing seems to Work. Note: I have Dell Inspiron 15 series Laptop and I have Win10 Home on my laptop. Sequence of events: Suddenly 2 weeks back while working, my laptop got hanged. When I restarted to recover from hang, it started asking for BIOS System password which I had never set before. Somehow after trying many attempts, fortunately my Laptop User account user name it took as BIOS system password. Upon entering BIOS system password, it prompted for HDD password which also, I never set. Somehow I entered the same my laptop user account name as password and it took that. Now with every boot it asks for BIOS system password and HDD password. Since I was able to proceed by entering password, I did not bother much initially. However, after few days, i started noticing some suspicious activity on my Laptop: I see that some unknown email accounts get added as administrator account under Start->Settings->Accounts->Your Info. Also, the same unknown email account is added under Start->Settings->Accounts->Email and app accounts I noticed that the same unknown account was added to one drive. I removed these accounts from all places mentioned above. However, after few hours of using the laptop, again i see that same unknown account gets added as administrator account. Actions I have taken: So, i suspected that this is some malware got into my system. So i tried below things to recover: Ran Windows defender quick scan - Nothing found Ran Kaspersky total security scan - No thread found Reset Laptop to factory defaults. After resetting, again started showing same symptoms as described above Downloaded Recovery image from Dell site for my Laptop serial number and tried re-installing the image from USB. After re-installing the images, again started showing same symptoms as described above. Tried downloading Win10 Home from Microsoft website and then installed on my laptop. While installing i formatted and deleted all partitions. After installing Win10, again started showing same symptoms as described above. One other thing I observed which makes me think that malware is not getting erased even after i re-install complete OS. I observed that after re-installing Windows 10, I did not at all configure my wi-fi neither i connected to LAN at all. I disabled the Wifi from taskbar. I just left the laptop as it is. After some time i noticed that wi-fi automatically got enabled and trying to connect but it could not connect since i have not configured password at all. I again disabled wi-fi and left. Again after some time, wifi gets auto enabled and starts trying to connect. I tried running Windows Defender offline, but it runs till 91% and then system restarts. I do not see it ran completely. Since the malware is not getting eradicated even after reinstalling OS, i tried to reset BIOS to factory defaults. However, when i went to BIOS, it shows that BIOS is locked and i need BIOS admin password to unlock which i have never set. Note that to unlock BIOS, its asking for BIOS Admin password which is different than BIOS system password which i mentioned earlier. I went to Dell service center with the hope that they can reset BIOS admin password. But they told they cannot reset BIOS admin password and told me to replace entire motherboard and hard disk.So, now i am not sure how to get rid of this malware. Any help/suggestions would be really helpful.

Hi everyone, I have a quick question. I bought a Kaspersky licence last year in about april or may. It was suitable for up to two devices. I have never actually activated it for said second device because that is a laptop I hardly use. Is there any option for expanding the licence for this year again? This may be an odd question/request but I thought why not try and just ask :) Thanks in advance.

thanks for your quick response. I can understand and write more or less in English, so no trouble with that. About the kid’s phone I have set them to only a two hours (weekdays) and tree hours (weekends) restriction time. Downtime schedule is not set, so I understand that the app should take restrictions based on a 24hr clock, regardless of time that phone is switched off (usually during nighttime) . I have reset all time schedules and set them again to see if it is working ok. See today’s screenshot attached. One of my kids phone was blocked by the app at 8.00 am when he switched on the phone and with no use.

I am using Kaspersky Total Solution on Windows 10 1909, and had the same problem on both YouTube on Chrome and the YouTube Music app. This solution worked for me. Open K Total Solution. Click Settings (cog wheel bottom left) then Additional , Network, Manage Exclusions. Add the full urls of any pages (eg http://www.yahoo.com) where you are experiencing keyboard lag. Make sure they are marked as “active” . Reboot. Note: It may take a few minutes after rebooting before the changes take effect. Hope it works for you all.

Thanks for the quick reply, Berny. Just tried that and it allows Mailstore to work. After Mailstore stared checking for emails, I switched Kaspersky back to “Scan encrypted connections upon request from protection components” and Mailstore kept on running so I assume it only checks just at the start. However, disabling the scan of encrypted connections isn’t a long-term fix as it disables too many other services. Can I add gmail.com as an exclusion?

Hallo, many thanks for your quick an helpful response. It was the anticipated answer, there is a sign. It’s been my fault to ignore the task bars hidden icons. Sorry! Now I everytime have the possibility to look wheather the VPN is on or not. This is exactly what I want. Many Thanks Dr. Peter Fritzsche

Hi all, we expect global launch of 2021 in July.

Hi again, Thank you for your quick answer! I just tried your solution + rebboting my computer. Unfortunately this didn’t change my issue as I can load any other gmail address except this one. To be more precise, the webpage try to load (at the bottom of the page I can see “waiting for ff.kis.v2.scr.kaspersky-labs.com”) and it just stays on loading with no other message.

The last information on this issue: it is analyzing by our developers in frames of the Bug 4666826: [Xiaomi] Пользователь может включить Ultra Battery Saving из quick settings There are no news/results of analysis from them yet. I will keep you informed. Thank you.

@Flood and Flood's wife, Hi again, Backup report, the advice from authorized company came up successful. They told to uninstall the old application to terminate it and to re-install a new one. And yes, it worked. Thank God and thank to you for quick response. I hope, this report could help people with same case as mine in the future. ☺☺ Yau

Thanks Flood Browser support is a minor issue for me as most of my browser sessions take place inside a Sandbox and download are verified via VirusTotal (I understand that’s not a guarantee, which is where KSC becomes a backstop - safe hex - so far it found nothing). The solution went quick and easy. Summarizing the position now. I started with neither suggestion above but picked on MBAM. When uninstalled and leftover traces were removed I shut down and restarted. KSC has not made a peep since. Bearing in mind I always switch off MBAM service as unwanted and check it is off after use and that I had checked before telling you that above, interference by MBAM is a mystery. On the bright side, I can say Malwarebytes Firewall Control and Kaspersky Security Cloud do seem to be coexisting happily. If that changes, I will update. The curious tinkerer inside me will probably want to install MBAM again (after clean removals and installations, as above) the the aim of triple-checking everything related to MBAM was switched off. Not immediately. I did download installation files before uninstalling and they are beckoning, “you know you want to do it”🤔