Wow, what this little exe put me through with Kaspersky.
So I reinstalled Kaspersky premium, instantly it detects keyboard locker as malware again. Mind you I've been using it every day when gaming or cleaning touchpad and keyboard, with Avira I was testing. And a complete FULL scan with Kaspersky finds only one malware, this little 200kb exe. Once it's deleted, another full, hour long complete system scan is clean.
So again, if it was malware, it would have been infecting system for those last two weeks I used it when Kaspersky wasn't installed. It would have done SOMETHING malicious to my system. But as long as that little exe is not on my system, a full 1 hour scan finds zero malware anywhere. THAT'S how I always knew it was safe, before I even finally managed to get real proof (below). Remember, this all started over 2 weeks back, so it's been a very ridiculous process.
I have every right to legitimately complain, and I am going to write a letter to Kaspersky support about it and express my disappointment and wasting hours of my time over this. Allow me to explain why. I followed all the instructions here in this forum:
I booted in safe mode and it easily allowed me to access the exe file.
Oh by the way, before I go on, I thought you might be interested in virustotal results:
Let that sink in. Do you know I have never seen any so called malware before, ever, where only one engine has detected it? If it's a false positive, it's always at least 2 or 3 or 4, but when even Mcafee and Norton say it's clean, you really know something is wrong LOL.
So much for Kaspersky having the lowest false positives in recent av comparatives April test. And Avira having so much higher. LOL I ran Avira for 2 weeks straight, 24/7, and not a single false positive whatsoever. But I digress.
I want people to understand what I went through to get this exe to submit it for reanalysis.
OK So I booted in safe mode and copied it. As soon as I rebooted back into normal mode, I right clicked and disabled Kaspersky for 5 hours, of course I was going to manually re enable protection when I had submitted the file, but this is why something like Malwarebytes becomes so useful when you need to disable an AV.
You see, disabling Kaspersky means your system is open to everything, as defender does not come back on, and not even if you right click the icon and exit Kaspersky (more on that later).
I use Malwarebytes VPN and have a 2 year plus subscription for 5 devices because I use it on my mac and my iPhone, and I have it on the PC for second opinion scans like SO many others do., But because I am a paid user of it, when I need to disable an AV, with one click I can enable all real time protections of Malwarebytes so I am NOT NAKED to the internet, so to speak.
Anyway, K was disabled, yet one minute into it, somehow it detected it and deleted it. Same as always, just two options, disinfect or disinfect without restart.
It NEVER puts it into quarantine so I can restore it and add an exception, and if I reinstall it, Windows gives it a different install folder number which it does every time you uninstall and re install any windows store app.
So this was impossible to make an exception for.
It gets better. I had to go all the way and actually tell Kaspersky NOT to start with windows, and then I went back into safe mode, re copied the exe file to a place I had user access, re started and it was gone when the computer booted back into normal windows. So Kaspersky must have some kind of boot time protection.
So I had no option but to uninstall Kaspersky, leave it uninstalled whilst I submitted the file to virus total and the false detection form and just re installed.
Weeks of hell for one app.
As to why I don't use the one other similar alternative app out there, it's incredibly slow, and has made an error before and locked my entire computer and I had to force shut down with power button. The windows store app is lightning fast and just works and always has. So that's why, before anyone asks.
To me, Kaspersky behaved worse than any malware I have personally encountered. The real problem is the disinfection pop up that gave me no option to add it as an exception, no matter what I tried.
It does make one think, and before anyone thinks I am whining, just remember I've spent about 10 hours of real time on this, submitting reports, testing other AVs, and so on. Kaspersky should not have behaved this way and given me an easy option to exclude it, like every other, I mean EVERY other AV I tested. How did I test the other AV's (I made a complete list of the ones I fully tested, about 17 of them, the ones that had 100% functional trials, but that's another storey for another time), well I used Eicar files. All of them bar Kaspersky allow simple restore from quarantine. ALL of them. Kaspersky just deletes.
The thing is, if it's actually something like an info stealer or ransomware, of course I want kaspersky to delete it, but just for my own info, is there ANY setting, something in Kaspersky that could have saved me from this fresh hell with this innocent little file?
TIA as always and sorry for my rant, now I can chill, K finally has the exe and I am sure before long I'll be able to use the app again.
Cheers
Edited by Bav
Featured Replies
Please sign in to comment
You will be able to leave a comment after signing in
Wow, what this little exe put me through with Kaspersky.
So I reinstalled Kaspersky premium, instantly it detects keyboard locker as malware again. Mind you I've been using it every day when gaming or cleaning touchpad and keyboard, with Avira I was testing. And a complete FULL scan with Kaspersky finds only one malware, this little 200kb exe. Once it's deleted, another full, hour long complete system scan is clean.
So again, if it was malware, it would have been infecting system for those last two weeks I used it when Kaspersky wasn't installed. It would have done SOMETHING malicious to my system. But as long as that little exe is not on my system, a full 1 hour scan finds zero malware anywhere. THAT'S how I always knew it was safe, before I even finally managed to get real proof (below). Remember, this all started over 2 weeks back, so it's been a very ridiculous process.
I have every right to legitimately complain, and I am going to write a letter to Kaspersky support about it and express my disappointment and wasting hours of my time over this. Allow me to explain why. I followed all the instructions here in this forum:
I booted in safe mode and it easily allowed me to access the exe file.
Oh by the way, before I go on, I thought you might be interested in virustotal results:
https://www.virustotal.com/gui/file/d4c104c17449e5eded7520d6c77f4dce1df933bd514ad65b515516aad3fc6829?nocache=1
Let that sink in. Do you know I have never seen any so called malware before, ever, where only one engine has detected it? If it's a false positive, it's always at least 2 or 3 or 4, but when even Mcafee and Norton say it's clean, you really know something is wrong LOL.
So much for Kaspersky having the lowest false positives in recent av comparatives April test. And Avira having so much higher. LOL I ran Avira for 2 weeks straight, 24/7, and not a single false positive whatsoever. But I digress.
I want people to understand what I went through to get this exe to submit it for reanalysis.
OK So I booted in safe mode and copied it. As soon as I rebooted back into normal mode, I right clicked and disabled Kaspersky for 5 hours, of course I was going to manually re enable protection when I had submitted the file, but this is why something like Malwarebytes becomes so useful when you need to disable an AV.
You see, disabling Kaspersky means your system is open to everything, as defender does not come back on, and not even if you right click the icon and exit Kaspersky (more on that later).
I use Malwarebytes VPN and have a 2 year plus subscription for 5 devices because I use it on my mac and my iPhone, and I have it on the PC for second opinion scans like SO many others do., But because I am a paid user of it, when I need to disable an AV, with one click I can enable all real time protections of Malwarebytes so I am NOT NAKED to the internet, so to speak.
Anyway, K was disabled, yet one minute into it, somehow it detected it and deleted it. Same as always, just two options, disinfect or disinfect without restart.
It NEVER puts it into quarantine so I can restore it and add an exception, and if I reinstall it, Windows gives it a different install folder number which it does every time you uninstall and re install any windows store app.
So this was impossible to make an exception for.
It gets better. I had to go all the way and actually tell Kaspersky NOT to start with windows, and then I went back into safe mode, re copied the exe file to a place I had user access, re started and it was gone when the computer booted back into normal windows. So Kaspersky must have some kind of boot time protection.
So I had no option but to uninstall Kaspersky, leave it uninstalled whilst I submitted the file to virus total and the false detection form and just re installed.
Weeks of hell for one app.
As to why I don't use the one other similar alternative app out there, it's incredibly slow, and has made an error before and locked my entire computer and I had to force shut down with power button. The windows store app is lightning fast and just works and always has. So that's why, before anyone asks.
To me, Kaspersky behaved worse than any malware I have personally encountered. The real problem is the disinfection pop up that gave me no option to add it as an exception, no matter what I tried.
It does make one think, and before anyone thinks I am whining, just remember I've spent about 10 hours of real time on this, submitting reports, testing other AVs, and so on. Kaspersky should not have behaved this way and given me an easy option to exclude it, like every other, I mean EVERY other AV I tested. How did I test the other AV's (I made a complete list of the ones I fully tested, about 17 of them, the ones that had 100% functional trials, but that's another storey for another time), well I used Eicar files. All of them bar Kaspersky allow simple restore from quarantine. ALL of them. Kaspersky just deletes.
The thing is, if it's actually something like an info stealer or ransomware, of course I want kaspersky to delete it, but just for my own info, is there ANY setting, something in Kaspersky that could have saved me from this fresh hell with this innocent little file?
TIA as always and sorry for my rant, now I can chill, K finally has the exe and I am sure before long I'll be able to use the app again.
Cheers
Edited by Bav