Objects not processed, .msi installers.

[jahcpa]

Is the attached report of unprocessed objects something to be concerned about? Details of the first line are shown at the bottom of the page. Detail of all the other lines is the same, except for the object name. 

[jahcpa]

p.s. the program is running fine. No malware detected, nothing in Quarantine, no threats detected on any scans.

[Berny]

@jahcpa   Please submit the object here : https://opentip.kaspersky.com

[jahcpa]

There is no folder C:\Windows\Installer and therefore I cannot find the files (objects) on the report to send for analysis. 

[Berny]

@jahcpa 

Please contact Kaspersky Technical Support  → https://support.kaspersky.com/b2c#contacts → EMail → Contact Support 

and select “Malware” in the form.

[Schulte]

There is no folder C:\Windows\Installer and therefore I cannot find the files (objects) on the report to send for analysis. 

Hello @jahcpa,

in addition to @Bernys recommendation:

You can still check the following:
'C:\Windows\Installer' is a hidden directory.
How to enable access to hidden folders in Windows

After that you should be able to see the files.
Please check the size of the files listed in the report.

Since an .msi file is an archive, the listed files may have been skipped due to the size limit in the advanced settings.

 

 

[jahcpa]

I checked the box in explorer to show files and folders that are marked as hidden and still can’t see the C\Windows\Explorer folder. Regarding Full Scan Settings, the box is not checked under Size Limit so that is not a factor. 

Waiting to hear back from Kaspersky Technical Support.

[jahcpa]

Didn’t notice it before but the ‘Reason’  for all these events is ‘Size’.

[Schulte]

Hello @jahcpa,

this points to the setting I mentioned.

It is also available for File AV and is enabled there for performance reasons.
If your product runs with the default settings, you can ignore the messages.

But I am also curious what the support says about it. Please keep us up to date.

PS: 'C\Windows\Explorer' is the wrong directory. Or was that a typo?

[jahcpa]

Oops. That path was a typo. My KIS is running with with the default settings. I am ignoring the messages. 

This was the response received from Technical Support:

 

Dear customer,

Thank you for contacting Kaspersky Technical Support.

My name is [removed] and I'll be happy to assist you on this ticket. Please accept our apologies for any inconvenience.

Based on the screenshot, Runtime Broker is an official Microsoft core process that debuted in Windows 8 and continues in Windows 10. It is used to determine whether universal apps you got from the Windows Store–which were called Metro apps in Windows 8–are declaring all of their permissions, like being able to access your location or microphone.

To have a closer look, please create a GetSystemInfo 6 utility report. To create this report, simply follow the step-by-step guidelines here: http://support.kaspersky.com/general/dumps/3632#block7 Note that the *.zip archive containing the report is saved on the desktop by default.

Should you require further assistance, please do not hesitate to contact us.

We remain at your disposal.
[removed] || Customer Service Representative


To reply to this request, you can simply reply to this e-mail leaving the subject line unchanged.

If we do not receive a response from you within 7 days, your request will be considered resolved by our system. If you would like us to leave your request open, you can simply let us know by replying to this e-mail or sending a new reply through My Kaspersky.

Best regards,
Kaspersky Technical Support

I am not going to pursue this any further. Everything’s working fine.