Kaspersky Update uninstalled Kaspersky

[Pogo123]

On Windows 10 today, I had a Kaspersky notification say it installed some modules and need to restart to apply them. I restarted and now kaspersky is gone. I still have the shortcuts but I get ‘avgui’ has been changed or moved.

[Schulte]

Hello @Pogo123, welcome to the forum.
I guess something went wrong with a version upgrade. Have you already tried reinstalling your Kaspersky version?

[Pogo123]

I tried reinstalling but got a install failure. I then uninstalled kaspersky internet security (The VPN) and restarted. After the restart I tried again and it was installed correctly.

 

I only just barely noticed that kaspersky was gone. When I restarted my PC I was up and away. I noticed some kind of warning message but before I could see it Windows had already closed it and started the restart. It was probably a Kaspersky message saying the update failed. After reinstalling, it found VHO:Trojan.Win32.Miner.adlqr on winlogui.exe and Backdoor.Win64.Agent.gen on startupchecklibrary and winscomrssrv

[Flood and Flood's wife]

Hello  @Pogo123, 

Since reinstalling have you run a manual Database Update and a Fullscan? 

If not please do both. 

&

May we have KAV All Events Report, select 7days, select Export, save as a .txt file & 📎 attach to your reply please?

The report will provide us with everything KAV has logged since reinstall.

Please post back?

Thank you🙏  

[Pogo123]

The full scan is still running. I have attached the report.

[Flood and Flood's wife]

Hello  @Pogo123,

Thank you for posting back🙏

1. In the report there’s a 23.12.2019 20.27.25, Full Scan (canceled), is that another FullScan, maybe started before we requested the FullScan in my previous reply?
2. In Quarantine, how many objects are there?
3. May we have an image of Quarantine please?

Please post back?

Thank you

[Pogo123]

I think that was a different full scan that I stopped.

I attached a image of the quarantine. There was a yellow “not a virus” one in there also but I clicked delete on that one. I believe it was this one:

 

23.12.2019 20.18.04;Object (file) not processed;C:\Windows\System32\winrmsrv.exe;Kaspersky Anti-Virus;C:\Windows\System32\winrmsrv.exe;12/23/2019 20:18:04;not-a-virus:HEUR:RiskTool.Win32.Generic;Allowed by user

 

I am not sure why this is listed as not a virus or why it is allowed. How do I un-allow and disinfect that file?

 

 

[Flood and Flood's wife]

Hello   @Pogo123 

Thank you for replying.

• There’s 3 objects in quarantine, does your question apply to all 3 objects? 

++ Please scan each object @ Kaspersky Virus Lab - if the scan result is “safe”, zip each object, & upload each file = SUBMIT for ANALYSIS, by adding your email address and agreeing to the “consent” .

The VL experts will analysise the files and determine if the detections are false positives or not.

Note: the difference by KAV application detections  & VLab “safe”,  can be attributed to each software using different resources.

You can also do an additonal  VT check of each object, upload & scan, that will show you results from 70 engines. 

Thank you. 

 

[Pogo123]

My question applies to winrmsrv.exe.

 

I do not want to restore the quarantine items. Is there a way to do the virus lab without restoring the files?

[Flood and Flood's wife]

Hello  @Pogo123,

Maybe I’m missing something, I don’t see winrmsrv.exe🤔

 

[Flood and Flood's wife]

Hello   @Pogo123,

As winrmsrv.exe is not in quarantine, the VL & VT scans are done by uploading winrmsrv.exe from it’s current location… 

[Friend]

Hi, @Pogo123 
You can delete the found objects.
You can read the description of the found objects on the website, if desired: https://threats.kaspersky.com/en/threat/
I recommend installing all the updates for your Windows system: https://support.microsoft.com/en-us/help/4028685/windows-10-get-the-update

Read more about not-a-virus https://support.kaspersky.com/viruses/answers/852