Modules updated. Then Event error with Private Browsing

[Steve]

Hi

Kaspersky Security Cloud prompted for update today. I ran it. A pop-up said Databases and modules have been updated and requested application restart. I chose ‘Yes’. Moments later the popup  opened.  Again I chose ‘Yes’. A “Task cannot be performed” window popped up. 

 

“Event :    Task stopped
Application name :    avp.exe
Application path :    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Cloud 21.2
User :    Owner-PC\Owner
User type :    Active user
Component :    Private Browsing”

I restarted the PC and went through the same cycle of update and error again. 

 

Problem #1 is I have no idea what the ‘private browsing’ it refers to is. 

Problem #2 is I do not know whether it is safe to choose ‘’No” for the restart but  assume that would mean KSC would  keep trying and failing in the background, which seems bad.

 

How do I fix the problem?

 

Windows 7 Pro

[Flood and Flood's wife]

Hello @Steve, 
Welcome!
The Private Browsing component is designed to prevent the collection of information about your online activity.
If you have Kaspersky Security Cloud Free, the Private browsing component, is non configurable. 

1. Please tell us KSC version & patch(x) x= letter, on Windows taskbar, rightclick the Kaspersky icon, select About ?
2. Please select Restart & let us know the outcome?
3. If you have restarted & the problem persists, please do the following:

• {a} Open KSC Settings ⚙ , select Manage settings
• {b} Select Export settings → save the KSC config file
• {c} Select Restore settings.
• {d} Shutdown the computer using Shutdown, not Restart, power on, login.
• {e} Make sure KSC is started. 
• {f} Run a manual Database update → allow it to complete.
• {g} Run a manual Full scan → allow it to complete. 
• {h} Check if the issue repeats? 
• {i} Let us know the outcome please?

Thank you🙏

Flood🐳 +🐋

Additional resources:

Private Browsing settings window

Blocking data collection

Private Browsing. Categories and exclusions

[Steve]

I forgot to copy before posting and received the ‘Something's gone wrong’  after  [Send]😫  I won’t bother trying to write full details again. Just that the issue is still occurring and that I noticed Windows Action center is warning on KSC and Firewall together and clearing them together. Could Malwarebytes Firewall Control and KSC suddenly have stopped working together? 

 

Version is 21.2.16.590 (b)

[Flood and Flood's wife]

Hello @Steve,

Thank you for the reply👌

1. Is KSC Free or subscription? 
2. Before installing KSC, did you check whether any applications installed on your computer are incompatible with KSC → Malwarebytes, is listed, it cannot be run with real-time protection (RTP) enabled.

If there are screen prints, please share, then we don’t have to guess what you are seeing/dealing with? 

Thank you🙏

Flood🐳 +🐋

Additional resources:

How to install Kaspersky Security Cloud

[Steve]

Forgot to copy and was logged out before posting again!

1. Free version
2. I use Malwarebytes Firewall Control (MFC). Malwarebytes (MBAM) is a different program. The Kaspersky compatibility list is not specific whether it means MBAM of MFC. When I checked, I took it to mean MBAM (using the learned logic two anti-malware programs generally do not run happily together).

I am experiencing problems embedding. Here are some links to Postimages

Update

Cannot perform update

Report

 

Anticipating a question, AVP has firewall permission. I tried update with firewall off. Same result 

 

[Flood and Flood's wife]

Hello @Steve, 

Thank you for the information & images👌

• Correct, the software conflict documentation doesn’t mention MWFC🤔 → let’s ask @Igor Kurzin & or @Anton Mefodys…. 
• Specific to the Private browsing alerts, MWFC Known Limitations, √ Windows Firewall is incompatible with software proxies, web filtering modules, NDIS drivers and any other security software that may redirect the traffic from Windows Firewall to their own filtering module🤔

1. Which was installed first, KSCF or MWFC? 

Please let us know? 

Thank you🙏

Flood🐳 +🐋

[Steve]

Interesting question. Ignoring versions, both have been installed for quite some time and both have been updated as updates became available.

Windows ad/Remove says (dd/mm/yyyy format)

KSC - 10/11/2020 (however, I the update attempt was yesterday and I would have sworn it updated via pop-up message earlier this year)

MFC - 28/10/2020

 

Windows folder creation dates

KSC - 16/08/2018 (oldest folder I can see - C:\Program Files\Common Files\AV) 

MFC - 12/03/2019 (but before that it would have been installed under a folder created by the  Voidtools version)

 

Both have played happily side-by-side until now.

 

Edit: just re-read web filtering comment. My adapter uses Quad 9 DNS servers: 9.9.9.9 and 149.112.112.112 

[Flood and Flood's wife]

Hello @Steve,

Thank you for posting back👌

🅰 Which Supported browsers are installed & used: Chrome, Firefox, Edge Chromium? 

🅱 Which Supported browser is the system default browser? 

Re “Both have played happily side-by-side until now”, understood, however, now, something is not working, an uninstall & clean install of both, may determine what that is:

Please follow these steps:

1. Create a System restore point.
2. Uninstall MWFC → at the end of the uninstall, shutdown the computer using Shutdown, not Restart, power on, login.
3. Uninstall KSCF → leave all checkboxes blank/empty →  at the end of the uninstall, shutdown the computer using Shutdown, not Restart, power on, login.
4. Download & clean install KSCF, at the end of the install, → shutdown the computer using Shutdown, not Restart, power on, login.
5. Run a manual Database update → allow it to complete.
6. Run a manual Full scan → allow it to complete.
7. Download latest MWFC & install. 
8. Monitor for original issues? 
9. Please let us know the outcome? 

Thank you🙏

Flood🐳 +🐋

KSC library

[Steve]

I mainly use (Google) Chrome, which is the default browser but do have Brave installed and occasionally fall back to IE11.  Brave is there for evaluation. I haven’t used it since configuring it around mid January this year. I have a few extension to harden Chrome (if extension matter uMatrix may be of relevance but I don’t see how.  Likewise adBlock Plus and popupoff).

 

Uninstall and reinstall was on my list if I didn’t get an answer. It seems we are both at the same point working out what to do next (albeit you would have far superior knowledge solving issues with KSC). 

 

Not only will I uninstall. I will seek and delete leftovers so we get clean installations.

 

Meanwhile, it is time for a cup of coffee. it may be a while before I get back

 

 

 

 

[Flood and Flood's wife]

Hello @Steve, 

1. Brave is not supported.
2. v21.2 IE is “reduced” support → that translates to certain functions are no longer available.
3. Regarding the installed extensions, (ioo) probably not related, however, you may wish to try disabling all, re-enable one by one, exit the browser for each reset, test for the issue?
4. ☕ sounds like a grand idea, enjoy!!
5. Additional steps:
6. Create a System Restore Point
7. Run the System in Safe Mode:

• {a} clear C:\Users\USER\AppData\Local\Temp   → USER = your name
• {b} clear C:\Windows\Temp

Thank you🙏

Flood🐳 +🐋

[Steve]

 Thanks Flood

Browser support is a minor issue for me as most of my browser sessions take place inside a Sandbox and download are verified via VirusTotal (I understand that’s not a guarantee, which is where KSC becomes a backstop - safe hex - so far it found nothing). 

The solution went quick and easy.

Summarizing the position now. I started with neither suggestion above but picked on MBAM. When uninstalled and leftover traces were removed I shut down and restarted. KSC has not made a peep since. Bearing in mind I always switch off MBAM service as unwanted and check it is off after use and that I had checked before telling you that above, interference by MBAM is a mystery. On the bright side, I can say Malwarebytes Firewall  Control and Kaspersky Security Cloud do seem to be coexisting happily. If that changes, I will update.

 

The curious tinkerer inside me will probably want to install MBAM again (after clean removals and installations, as above) the the aim of triple-checking  everything related to MBAM was switched off.  Not immediately. I did download installation files before uninstalling and they are beckoning, “you know you want to do it”🤔  

 

 

 

[Flood and Flood's wife]

Hello @Steve, 

Well there’s a revelation, you “did” have MBAM🤔

qte

I use Malwarebytes Firewall Control (MFC). Malwarebytes (MBAM) is a different program. 

unqte

This could’ve been sorted 7 hours ago. 

Delighted to read KSCF & MWFC are friends again. 

If you do go down the “you know you want to” road, you’re on your own😉  

Thank you🙏

Flood🐳 +🐋

[Steve]

I thought that I had made you aware MBAM is on the PC but that I run it as a demand scanner only (maybe once overy 3-6 months). Sorry.

 

Remembering that I deliberately disable MBAM services when not required, what I don’t understand is how a program that is not running and is (AFAIK) running no services can interfere with KSC. 

SVCHost was gaining  internet access for the following at the time of ‘the trouble’ and no traffic was blocked:  

BITS,Browser,EapHost,IKEEXT,iphlpsvc,LanmanServer,MMCSS,ProfSvc,Schedule,SENS,ShellHWDetection,Themes,Winmgmt,wuauserv

AudioSrv,Dhcp,eventlog,HomeGroupProvider,lmhosts,wscsvc

CryptSvc,LanmanWorkstation,NlaSvc,Wecsvc

 

[Flood and Flood's wife]

Hello @Steve, 

Given MBAM is listed on the software conflicts list & we did point that out, the first thing to eliminate, is MBAM. 

We installed:

KSCF

MWFC

MBAM → already installed - run as RTP & not.

We could not replicate the issues you’ve reported. 

Thank you🙏

Flood🐳 +🐋

[Igor Kurzin]

Good day, 

Steve, the MBAM has not only services, but also drivers, that are running in the background. 

[Steve]

Thanks Flood

That saves me some investigating but also indicates poor memory and laziness not ensuring poor memory didn’t result in missing something. Sorry.  

 

Edit: There are a combination of best answers above. I find it difficult to pick one as best.  This was good to learn but misleading given the initial problem is resolved:

Given MBAM is listed on the software conflicts list & we did point that out, the first thing to eliminate, is MBAM. 

We installed:

KSCF

MWFC

MBAM → already installed - run as RTP & not.

We could not replicate the issues you’ve reported. 

 

 

[Flood and Flood's wife]

It’s all good @Steve, 

No apology necessary☺ !

We’re genuinely delighted the issue is resolved🤸

Thank you🙏

Flood🐳 +🐋

[Steve]

We installed:

KSCF

MWFC

MBAM → already installed - run as RTP & not.

We could not replicate the issues you’ve reported. 

 

For information: I just reinstalled MBAM. No issues arose with KSC. this may indicate the problem may only arise when KSC  tries to perform an update of its modules. Specifically, Private Browsing.

 

Low value added information: For this installation, despite MBAM wanting to give a 7-day trial, all protection features were switched off, ‘start with Windows’ was switched off and MBAM service is disabled (via services.msc).

I still haven’t work out what drivers could be running when MBAM is shut down.

[Igor Kurzin]

Hi Steve, drivers are in folder C:\Windows\System32\drivers\ and are named like mbam//////.sys  (//// some symbols there). Or mb////.sys

Examples: 

C:\Windows\System32\drivers\mbae64.sys

C:\Windows\System32\drivers\MBAMSwissArmy.sys 

C:\Windows\System32\drivers\MbamChameleon.sys

C:\Windows\System32\drivers\farflt.sys

To disable a driver you can run the following command from Command Prompt (Administrator):

sc stop %driver name%

For example: 

sc stop MbamChameleon

With Malwarebytes generally the problem is that Malwarebytes uses filters and drivers that can interfere with Kaspersky filters and drivers. 

[Steve]

Thanks Igor

I get different results (version 4.0.0.887)

C:\Windows\System32\drivers\mbamswissarmy.sys
C:\Windows\System32\drivers\mbae64.sys
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.sys
C:\Program Files\Malwarebytes\Anti-Malware\mbae64.sys

 

farflt.sys is nowhere to be found

MbamChameleon.sys is nowhere to be found 

Possibly one of the above was renamed or they were merged into mbamelam.sys?

 

 

[Flood and Flood's wife]

Hello @Steve, 

Welcome back!

The data @Igor Kurzin presented were examples. 

For the exact names, it would be best to raise the issue with Malwarebytes Technical Support or Malwarebytes Community please? 

Thank you🙏

Flood🐳 +🐋

[Igor Kurzin]

Hi Steve, 

As Flood mentioned, those names above were only examples. The set of drivers and their names can differ from version to version in any software. 

You no longer get any issues like the one with Private Browsing?