Constant warnings for safe programs “attempting to create embedded keys or parameters” [Closed]

[Caspians]

I’ve been using KIS for many years, but recently I moved to Windows 10 in a new PC. I installed KIS2019, however I have constant warnings from KIS every time I try to install completely safe programs.

I get multiple warnings about programs “attempting to create embedded keys or parameters” for almost everything. This never happened before. I have to “Allow now” many pop up windows and it’s very annoying and time-consuming. I’m not talking about anything strange. I even got a message yesterday after a Steam update. There was a program I always use and I had to “Allow now” around 20 different pop-ups just to install it.

I haven’t changed any settings, KIS works on default. Have I missed anythings or is this normal on Windows 10? I never had similar problems with Windows 7 for more than a decade.

[Flood and Flood's wife]

Hello @Caspians,

Welcome!

1. May we have images of the popups?
2. KIS Reports, select ALL EVENTS, select 24hrs, export the report, save as a .txt file & attach to your reply please?
3. May we have an image of Reports & Quarantine Settings⚙ please?

Thank you

[Caspians]

Here is the report for the last 24 hours. As you can see I got some warnings over Steam and the game Divinity Original Sin 2 and also today for another game. But it doesn’t happen only for games.

Unfortunately I don’t have any images currently. They are usually messages for “apps” trying to make changes. They are legit Kaspersky pop-ups if that’s why you are asking.

 

[Flood and Flood's wife]

Hello @Caspians,

Thank you for replying & the  report.

• There’s nothing apart from :HEUR:AdWare.Script.Pusher.gen, which should not be ingored or suppressed.

1. May I have the 7day report please?
2. Also, I notice KIS is 2019, is that by choice? (2020 is available).
3. ⚠ Additional: which application is generating: “attempting to create embedded keys or parameters” alerts⚠ ?

Please post back?

Thank you

[Caspians]

Hello@FLOOD  and thank you for your time.

The HEUR:AdWare.Script.Pusher.gen was not ignored and of course these warnings are welcome. It was during browsing in a tech forum. Someone posted some screenshots in a free photo uploading website and I got the warning when opening them. But I don’t mind these notifications.

No, it was not by choice. I just did not know that 2020 was available. I was using 2019 and when I set up my new PC I just installed it.

I’m attaching the rest of the last week. There are some spam e-mails in Outlook that were automatically scanned and deleted (again no issues with this, it’s nice work from KIS) and a couple of other programs (I installed a calibration tool for my monitor for example and I had to go over many warnings again).

Regarding your last question, it happens during installations or updates. It’s not the same always.

[Flood and Flood's wife]

Hello @Caspians,

You’re very welcome!

Thank you for the report🙏

1. “attempting to create embedded keys or parameters” alerts are not being logged by KIS, which application is generating the “attempting to create embedded keys or parameters” alerts/errors?
2. Are there any “attempting to create embedded keys or parameters” events in Windows Event Logs?

Please let me know?

Thank you

• Re 2020, please read 2020 documentation, including Incompatible software, System Requirements, Release notes, KIS2020 Library

[Caspians]

So I tried to recreate something to show you what I mean. I installed a statistics program I use. I got about 6-7 windows of this kind. I’m attaching 4 of them, so you can see. This happens with almost every kind of software I use. As I said it never happened before. I have to go manually over many notifications of this kind. That’s why I’m wondering that maybe it’s some kind of setting. The programs are safe as I said, legally purchased (Steam, Microsoft Store or the developers store).

It’s not the biggest issue in the world (after installation in most cases I don’t get any other prompts), but it’s very annoying.

[Flood and Flood's wife]

Hello @Caspians,

Thank you🙏 the images help👏

What options are available in “Additional Actions”?

What happens if “Allow now” & “Remember my choice” are selected?

Now may I have KIS 24hr Report please?

Please post back?

Thank you.

 

[Caspians]

Hello @FLOOD 

I installed KIS2020 in the meantime so the report will not be the full 24h. I tried installing again some programs so you can have something to work with (GraphPad, Epic Launcher and Calibre). I got the notifications only with the first one.

In Additional Actions there is “Trust this application” and “Close, do not trust”.

Regarding Allow Now and remember my choice, I get another popup saying it needs my confirmation and that the action was requested by me. I still get the next notifications after this.

The same goes for “Trust this application”, I get the rest of the notifications during installation.

Let me know if you need any other information or if this report is not good enough now.

[Flood and Flood's wife]

Hello @Caspians.

Installed 2020 already, you must be a quick “reader”😉

Thank you for the report!

What’s interesting is, (for GraphPad Prism 7.03), KIS is not collecting the alerts, other than: to allocate it to the Low Restricted group, and, move it to: Trusted group, presumably after you’ve acknowledged the alerts. 

I’m going to test some of the apps you’ve mentioned… I’ll post back on this.

Also, is KIS licensed? If “yes”, have you raised a case with the Lab? 

Let me know please?

Thank you🙏 !

 

[Caspians]

Hello @FLOOD 

Yes, it seems that it just moves them to Trusted after my input. But from what I’m seeing the same happens automatically for EpicGamesLauncher and I don’t get any notifications.

Yes, it’s licensed. I have 5 licenses (all used for Windows).

In my ultrabook with Windows 10 I don’t have any similar issues (and I’m using some of these apps, but not games) and also not in my older Windows 7 machines.

I’m not familiar with the Lab. Is it something separate?

Thank you again for your time!

 

[Flood and Flood's wife]

Hello  @Caspians,

You’re very welcome!

Aplologies, the “Lab” = Kaspersky Technical Support Team, distinctly separate to Kaspersky Community.

What is the version, build & release on the device with the issue please?

Please post back?

Thank you. 

[Caspians]

Hello @FLOOD 

After installing KIS 2020 my version is 20.0.14.1085 (e).

Do you need any other information? I don’t see anything else there.

My PC has Windows 10 Pro, Version 1903  OS Build 18362.418

[Flood and Flood's wife]

Hello  @Caspians, 

Before logging a case, please check the following: 

(KIS):

1. Security Level setting? 
2. Delete malicious tools, adware, auto-dialers and suspicious packagers setting?
3. Application Control Settings? 
4. Trust Group for Unknown Applications?
5. Firewall, check Application Rules?
6. Search for software that is intended to conceal traces of a malicious program in the system (rootkits) setting?
7. Detect other software that can be used by criminals to damage your computer or personal data setting? 
8. Advanced Disinfection setting? 
9. Self-Defense settings?
10. KSN setting? 
11. Software Updater settings?
12. Trusted Applications mode setting?
13. & have you ever run a Vulnerability Scan, if “no”, please do so & checl RookKit scans are running? 

If 1 > 13 check out, raise a case with TS, follow my template, filter all the information you’ve provided (helpfully) to me, including images, and prepare a GSI & Windows Logs, attach to the Incident request. 

Information needed for request:

• Opsys name, version, release build.
• KIS version & patch(x)
• History of errors, when they happen, what actions you take, outcome, images, KIS Reports, GSI & Windows Logs

---

When the case is logged, you’ll receive an automated email with an INC#, at some stage, generally within 5 business days, a (TS) human, will contact you, via email, to assist with the issue. TS may also request Traces, the Traces will be activated as the issue is replicated, TS will guide you with this process. 
 

And, please keep me updated🙏 ?

Thank you. 

[Flood and Flood's wife]

Hello @Caspians,

Sorry, I missed your msg, from 24minutes ago😓

You’ve done great👏 . 

I’ll update your post if I get results from GraphPad, otherwise, please do the checks and, if necessary, raise an incident.

If, is discussions with, or providing data to TS, you reference other devices, make sure the devices are easy to distinguish, for example, W10Pro,1903-18362.418 = device 1, W7-HOME-vxSP1 = device 2, etc. 

Thanks again🙏

[Flood and Flood's wife]

Hello  @Caspians,

Prism update, installed seamlessly, Kasperky allocated to “Trusted” without any alerts and or interventions…. 

Version 8.3.0, not sure if that’d make a difference🤔

 

[Caspians]

Hello @FLOOD 

Currently I’m not at home so I cannot send the Lab report. I’ll try later on today or tomorrow.

Regarding the version, no I don’t think the version makes any difference as I’ve seen the same behavior with various programs so its not “specific” to an app or a version of it. For example I saw it after a Steam update yesterday or after installing a game through Windows or even when I installed Microsoft Office (I had literally dozens of these notifications while installing the various Office programs, I don’t remember how many times I had to click on Allow now).

Is there any setting that I may have missed?

[Flood and Flood's wife]

Hello @Caspians,

Thank you for posting back.

• Regarding the escalation, take your time, whenever you’re ready, the Lab is going away.
• Regarding missing anything, not that I can think of, unless: when you updated KIS did you remove KIS19 first? 
• And:

1. Windows updates & patches are all installed successfully. 
2. KIS is functioning without errors, all updates, scans etc., are normal. 
3. You could: run tools like AdWC, CCleaner, scan with MBAM, run the sytem in SafeMode, see if the issue can be replicated.
4. When the alerts are occuring are any browsers or any other applications, in use?

If the Lab don’t have an immediate answer, they will work with you assiduously, to get to the bottom of the issue. 

I’m very keen to know the RC?

Please keep me posted?

Thank you!

[Caspians]

Hello @FLOOD 

Regarding your questions, all Windows are updates and patches were successfully installed.

It’s a brand new PC, brand new Windows installation and this happened from the beginning. Kaspersky is the 2nd-3rd app  I install in a new system after the browser.

KIS is functioning without any issues or any problems. As you saw it scans perfectly (emails, websites), so there is no other issue.

I wouldn’t like to install more 3rd party software, as the issue is not having to do with the PC being infected.

Regarding the alerts, I’m not 100% sure but my answer would be yes. Other apps are being open. Firefox probably and maybe other ones.

It’s like KIS is extremely protective or unable to understand on its own that some apps are safe. I don’t know how else to say it. One friend of mine also told me that had the same issue (Win10). I don’t get other notifications like this when opening the apps usually. It’s only when installing or updating.

I will let you know as soon as I proceed with the Lab!

[Flood and Flood's wife]

Hello  @Caspians,

Thank you for the update.

Just do one (more) test, reset KIS to default, clear KIS reports, run the system in SafeMode with Networking & install  GraphPad Prism.

Report back please?

& yes, thank you, hearing how you get on with the Lab will be good please?

Thank you

[Caspians]

Hello @FLOOD 

Just an FYI. I did what you said and I communicated via the form.

I think the problem was solved. I had to go to “Manage Settings” and then “Reset Settings”.

Although I don’t install-reinstall many things, it seems that the problem has gone. I tested with a couple of programs and I didn’t get the annoying pop-ups. Everything looks fine for the moment. It’s been some days, so I’m not 100% sure, but things look good.

Thanks again for your help!

[Flood and Flood's wife]

Hello  @Caspians,

Welcome back!

My instructions: (12th November) “Reset KIS to default”, is the same as “Reset Settings”.

I’m delighted to hear the issue is resolved👏 . Thank you for letting us know🙏

If the problem returns, please don’t hesitate to let us know?

Thanks again.