Active threats detected: KSC status reset

[Alex]

Hi, Two clients have this warning related to malware detected on external devices. These devices are no more present but the clients still remain with this warning. I performed virus counter reset without remove this status. Is there a way to do that reset?

[Nikolay Arinchev]

Hi, Could you please clarify what versions of KES and KSC do you use? Could you please provide us with a screenshot that shows the warning? Thank you!

[Alex]

Hi, Could you please clarify what versions of KES and KSC do you use? Could you please provide us with a screenshot that shows the warning? Thank you!

Hi Nikolay, see related snips. KSC 11,0.0.1131 KES: 11.1.0.15919 The other client with the same issue has KES 11.1.1.126

[Nikolay Arinchev]

Please use Kaspersky Rescue disk utility to make sure that no actual active threat is present at the PC. Thank you!

[Alex]

Please use Kaspersky Rescue disk utility to make sure that no actual active threat is present at the PC. Thank you!

Nikolay I performed a remote session on one client and there is no trace of viruses, KES homepage report the threats on the ext device (e:\). I performed a KSC scan, a local malware scan and no trace so I manually removed the warning. How can I solve for do that remotely with the other client?

[Nikolay Arinchev]

Thank you for that info! Could you please provide us with an export of all avaliable events for that host? You can create a selection at EVENTS tab at Admoinistration server node. Also, please clarify are there any files stored at local host at "Backup" interface? Is the checkbox for Active Threats at Managed computer groups and/or at any subgroup related to the host?

[Alex]

Thank you for that info! Could you please provide us with an export of all avaliable events for that host? You can create a selection at EVENTS tab at Admoinistration server node. Also, please clarify are there any files stored at local host at "Backup" interface? Is the checkbox for Active Threats at Managed computer groups and/or at any subgroup related to the host?

Attached is client events (that has been manually cleared after a virus scan). Active threats is set as critical and also as warning. About backup screen: yes, there were two files, I removed them and KSC status came back to green. Can I remotely perform this action?

[Nikolay Arinchev]

Thank you for that info! Unfortunately, there is no way to do that via KSC.