Rollback doubt (and other little things...)

[Tizio Cajo]

Hi everyone, proud to be here.

I recently bought my first wonderful Kaspersky product: Kaspersky PLUS. My doubt comes from THIS video. At 1'47", Kaspersky ransomware-test starts. At 2'13" System  Watcher notifies the ROLLBACK of the encrypted file. Kaspersky Premium is used in the test (instead I bought PLUS, but it should be the same).

Here my doubt: is this rollback possible ONLY for previously backed-up files (Backup feature in Kaspersky settings)? OR, instead, the rollback is a feature that applies to ALL the files (even those NOT previously backed-up)?

(I confess I yet wrote my doubt to the support services, but strangely they didn't give me a clear-cut answer...)

-----

If you have time, I'd have a couple of other questions:

- I downloaded the Kaspersky Plus installer, and I install it on Windows 11, but I didn't find any spec about 64bit or 32bit version. And after the installation I saw in Task Manager that avpui.exe is a x86 (32bit) app... Does it mean that Kaspersky Plus is a 32bit app? Is not there a 64bit version? And if the app is instead 64bit, how can I verify to have installed the right 64bit version?

- When I boot Windows, nothing says to me that Kaspersky is actually running in backup or the database is correctly updating. The only thing I see in Task Manager is just the Kaspersky Lab launcher (32bit) with the Kaspersky (32bit) inside (in Task Manager > Details, I see avpui.exe). Is that enough to tell that Kaspersky is properly running and updating?

- Aside the database daily updating, how does it work the updating of the app itself? Should the app itself advise me that an application-update is ready?

 

MANY THANKS IN ADVANCE!!!

[Flood and Flood's wife]

6 hours ago, Tizio Cajo said:

I recently bought my first wonderful Kaspersky product: Kaspersky PLUS. My doubt comes from THIS video. At 1'47", Kaspersky ransomware-test starts. At 2'13" System Watcher notifies the ROLLBACK of the encrypted file. Kaspersky Premium is used in the test (instead I bought PLUS, but it should be the same).

Here my doubt: is this rollback possible ONLY for previously backed-up files (Backup feature in Kaspersky settings)? OR, instead, the rollback is a feature that applies to ALL the files (even those NOT previously backed-up)?

1. (I confess I yet wrote my doubt to the support services, but strangely they didn't give me a clear-cut answer...)

-----

If you have time, I'd have a couple of other questions:

2. - I downloaded the Kaspersky Plus installer, and I install it on Windows 11, but I didn't find any spec about 64bit or 32bit version. And after the installation I saw in Task Manager that avpui.exe is a x86 (32bit) app... Does it mean that Kaspersky Plus is a 32bit app? Is not there a 64bit version? And if the app is instead 64bit, how can I verify to have installed the right 64bit version?

- When I boot Windows, nothing says to me that Kaspersky is actually running in backup or the database is correctly updating. The only thing I see in Task Manager is just the Kaspersky Lab launcher (32bit) with the Kaspersky (32bit) inside (in Task Manager > Details, I see avpui.exe). Is that enough to tell that Kaspersky is properly running and updating?

3. - Aside the database daily updating, how does it work the updating of the app itself? Should the app itself advise me that an application-update is ready?

Hello @Tizio Cajo, 

Welcome!

1. System watcher does not require files to have been backed up by Kaspersky Backup. Also, post the incident reference # logged for the issue please, it's prefixed with INC0000? 
2. From Moderator @Schulte, the comment was written related to the original KAV/KIS/KTS/KSC  - it still applies to the new generation Kaspersky Standard, Plus, Premium: 

   Quote:

   "KAV/KIS/KTS/KSC are modular, all contain the GUI - 32-bit process and SYSTEM drivers. There's no point in making the GUI a 64-bit process. However, the drivers that do actual SYSTEM level protection have been 64-bits for a while now. The selection which drivers to use, happens automatically when the software is installed."

   End quote

3. How do Kaspersky subscribers know when Kaspersky application / patch updates are available?  Kaspersky application / patch updates arrive *silently*; they wait for seven days / 168 hours, if the computer is *not* rebooted during that period - at the end of the period the Kaspersky application will notify with the following: The *blob* in the main GUI will turn orange with -> Please restart your computer, Reboot, in the Notification centre, the Details will show: Please restart your computer, Reboot. The installation of new application modules is almost done. Please restart the computer to complete the installation. In Windows Hidden icons, the Kaspersky icon will turn red - with Restart your computer to complete update. In Windows Notification centre it may show: Please restart your computer to complete update. 
4. The Timeline (2) gives a brief activity history of the application, more detailed information is found in Kaspersky *Reports*; Kaspersky Reports can be accessed by selecting Reports (3) in the Security window OR wherever a Report icon (3) is shown; READ: Reports window.
5. Selecting the Question ? mark (4) in any Kaspersky application window, will open the Kaspersky Help documentation associated with that specific page

 

Thank you🙏
Flood🐳+🐋

Edited December 4 by Flood and Flood's wife
grammar

[Tizio Cajo]

Hi Flood&Wife!!! Thanks for Your kind and detailed reply. Just a little doubt remains: when I boot Windows, nothing says to me that Kaspersky is actually running in background. Yes, I see the avpui.exe and the Kaspersky Lab launcher in Task Manager, but I don't know actually if the app is working under the hood. (To tell for sure if Kaspersky is working, I need to open the app, and I need to do it manually since I don't find any "boot on Windows start" option.) So, how can I know for sure that Kaspersky is silently working under the hood? Many thanks in advance!

[Flood and Flood's wife]

55 minutes ago, Tizio Cajo said:

Thanks for Your kind and detailed reply. Just a little doubt remains: when I boot Windows, nothing says to me that Kaspersky is actually running in background. Yes, I see the avpui.exe and the Kaspersky Lab launcher in Task Manager, but I don't know actually if the app is working under the hood. (To tell for sure if Kaspersky is working, I need to open the app, and I need to do it manually since I don't find any "boot on Windows start" option.) So, how can I know for sure that Kaspersky is silently working under the hood? Many thanks in advance!

Hello @Tizio Cajo, 

You're most welcome!

Thank you for the additional question!

1. Additional to our previous, READ: System Watcher settings, specifically Action to perform if malicious or other activity can be rolled back.                     
2. In Performance Settings PC performance optimization, make sure Launch Kaspersky at computer startup (recommended) is *checked*                                                                                    
3. IF Kaspersky is not working / running / active, in Windows security there will be alerts & the Kaspersky icon will not be present in Windows *Hidden icons*        
4. Another tip, sometimes, finding Kaspersky features in the GUI, can be a little difficult - use the SEARCH field & a simple word search:                                                                                      

Thank you🙏
Flood🐳+🐋

Edited December 5 by Flood and Flood's wife
image formatting

[Tizio Cajo]

Flood+W, You are fantastic! Thanks SO much.

[harlan4096]

Also, System Watcher rollback feature has its limitations (in maximum number of files to restore), and of course, it does not work as a backup/restore tool. So Your best bet is to perform full system backups to external devices (and then keep them disconnected to the system), with tools such a Macrium, Hasleo, AOMEI BackUpper, etc...

[Tizio Cajo]

Thanks Harlan! Of course I'll do that!

[shadowtabby144]

On 12/11/2024 at 8:24 AM, Tizio Cajo said:

Thanks Harlan! Of course I'll do that!

Heyo.

 

I just wanted to add that I have personally have been using kaspersky for years.   I have also tested out eset and other AV's but none of them came close to kaspesky's protection.   I love kaspersky security software and will be keeping to them.  I personally use the Kaspersky Prem.  Never have had malware on my PC since.

 

What made me change, is because I used to use AVG, eset, bit defender, quick heal, and a few others (NOT at the same time).  Every time I got malware, they did crap all to help remove it.   Change to kaspersky.  It made sure that my PC was clean befor installing it.  And boom nothing since.