Kaspersky Plus restarted during scan

[Tissalda]

Hello everyone,

I noticed a weird behavior today while doing a full system scan. After starting the full scan, I came back to see that the scan was stopped. There were a couple of files that were not processed. After checking system watcher and event logs, i noticed that kaspersky turned itself off and then back on 2 seconds later. Looking at File Anti-Virus, the timing coincided with a windows process "SecurityHealthHost.exe" running which did not get processed.

Is this something to be concerned about? I did another full scan after coming back and the scan was completed without any unprocessed files. I have attached a couple screenshots.

I am on Windows 10, application version is 21.18.5.438(a)

 

Thanks in advance for any help.

[harlan4096]

Welcome to Kaspersky Community.

 

I would start to running a health checking: ScanDisk on Your main drive C :, and then go DISM and SFC commands:

 

https://www.windowscentral.com/how-use-dism-command-line-utility-repair-windows-10-image

[Tissalda]

Thank you. I ran the 2 command lines in the article, they both came up clean with no corruption detected.

 

Edited October 17 by Tissalda

[Tissalda]

Is there something else I should check? I am not sure why the scan stopped midway and Kaspersky restarted itself. Should I be worried or is this perhaps normal behavior coinciding with a windows check/update?

[Xzz123]

do not scan installers and compressed files when you run a full scan

I observed that too much scan logs may cripple the product

I believe it is a bug

[KarDip]

Hello @Tissalda

The behavior you observed—Kaspersky momentarily disabling itself and resuming—can indeed be concerning, but it may not necessarily indicate a malware infection. Below are a few potential causes and things you can investigate to ensure your system remains secure:

---

Possible Reasons for Kaspersky's Behavior:

1. Windows Defender Interaction (SecurityHealthHost.exe):

   • The SecurityHealthHost.exe process is a legitimate Windows process responsible for managing security services, including Windows Defender.
   • If Kaspersky and Windows Defender attempt to perform similar tasks simultaneously, there could be brief interruptions as they interact. This might explain why Kaspersky seemed to turn off momentarily.

2. Software Conflict or Glitch:

   • Some third-party antivirus programs, including Kaspersky, occasionally experience conflicts with system services or other security software.
   • A transient software glitch could explain the interruption you noticed.

3. Tamper Protection or Intrusion Detection Trigger:

   • Kaspersky may temporarily restart its services if it detects suspicious behavior or an attempt to tamper with its processes.
   • The antivirus could have interpreted a routine system action from SecurityHealthHost.exe as a threat, causing a reset to ensure stability.

4. Background Update or Restart of Kaspersky Components:

   • Kaspersky periodically updates or restarts its modules for performance and security reasons. If this happened during your scan, it could explain the temporary halt.

---

Steps to Ensure Security:

1. Check Kaspersky Logs:

   • Review detailed logs in Kaspersky to see if any specific error or security incident caused the interruption.

2. Windows Defender Settings:

   • Ensure that Windows Defender’s real-time protection is disabled when using Kaspersky as your primary antivirus to avoid conflicts.
     • Go to Settings → Update & Security → Windows Security → Virus & threat protection → Manage settings.

3. Run Kaspersky Virus Removal Tool:

   • For extra safety, you can run Kaspersky’s Virus Removal Tool to see if any hidden malware might have interfered with the antivirus.

4. Update Kaspersky and Windows:

   • Ensure both Kaspersky and your Windows system are up to date to prevent compatibility issues.

5. Monitor Behavior:

   • If the issue happens again, it might indicate a deeper problem such as malware tampering with your antivirus. Consider running a boot-time scan or scanning with an additional tool like Malwarebytes.

---

Since your second full scan completed successfully without unprocessed files, this might have been a one-time issue. However, if the behavior persists or you notice anything unusual, further investigation is recommended.

Thank you

[Tissalda]

On 10/20/2024 at 3:54 AM, KarDip said:

Hello @Tissalda

The behavior you observed—Kaspersky momentarily disabling itself and resuming—can indeed be concerning, but it may not necessarily indicate a malware infection. Below are a few potential causes and things you can investigate to ensure your system remains secure

 

Thank you for the reply. Kind of a dumb question. I have downloaded KVRT. If I run it, would it interfere in any way with Kaspersky Plus during or after the scan? Same question also for Malwarebytes.

I have noticed that task stopped - task started a couple seconds later happened twice so far on my system.

One final question, can I run a boot-time scan using Kaspersky Plus?

Thank you in advance.

On 10/19/2024 at 10:05 PM, Xzz123 said:

do not scan installers and compressed files when you run a full scan

I observed that too much scan logs may cripple the product

I believe it is a bug

I am not sure how to limit the scan for that. I usually run a full scan once a week with security level at extreme.

Edited October 21 by Tissalda

[Xzz123]

30 minutes ago, Tissalda said:

I am not sure how to limit the scan for that.

in advance settings for full scan

unselect scan compressed files and scan distribute packages.

 

[KarDip]

6 hours ago, Tissalda said:

 

Thank you for the reply. Kind of a dumb question. I have downloaded KVRT. If I run it, would it interfere in any way with Kaspersky Plus during or after the scan? Same question also for Malwarebytes.

I have noticed that task stopped - task started a couple seconds later happened twice so far on my system.

One final question, can I run a boot-time scan using Kaspersky Plus?

Thank you in advance.

I am not sure how to limit the scan for that. I usually run a full scan once a week with security level at extreme.

It's not a dumb question at all!

1. KVRT (Kaspersky Virus Removal Tool) and Kaspersky Plus: KVRT is a standalone tool designed to scan for and remove malware. Running KVRT should not interfere with Kaspersky Plus. However, because both tools come from Kaspersky, they use similar detection engines. You may notice some overlap in their detection processes, but no conflict or interference should occur either during or after the scan. Just ensure that you are not running both simultaneously to avoid any resource contention.

2. KVRT and Malwarebytes: Similarly, KVRT and Malwarebytes should not interfere with each other, as they are standalone tools. It’s always best practice not to run two on-demand scanners at the same time, as this can lead to slowdowns or unexpected behavior, but running them consecutively should pose no issues.

3. Task stopped - task started: This behavior may indicate a scheduled task or background process in your system, possibly related to Kaspersky or another background service. It's generally normal unless it happens excessively or impacts performance.

4. Kaspersky Plus boot-time scan: Kaspersky Plus does not include a direct boot-time scan feature, but it does have an advanced disinfection tool that can be used if malware is found. This feature might require a reboot to clean persistent infections. You could also create a Kaspersky Rescue Disk, which is bootable from a USB drive or CD/DVD, to perform a scan before Windows starts.

Let me know if you'd like more details on any of these!

Thank you

Edited October 21 by KarDip
spellcheck

[Tissalda]

Thank you everyone very much for your help and tips.