Task & script being removed

[Iain_B]

Hi,

I have created a task in Task Scheduler that every 10 minutes runs a vbs script that accesses the internet. It's a type of cron.

Up until about 1 day ago, it was working fine. However, in the last day or so, Kaspersky insists on deleting both the task entry and the vbs script. I have added the script file to the Security / Manage applications / Trusted, but it still deletes the file. Also, when trying to restore the vbs file from my backup, it now deletes the file from the backup!! Strangely, even though the task has been remored from the task manager, I am still getting an error message every 10 minutes saying the the vbs script file cannot be found. So the task seems to be running, even though it has been removed from the list!

How can I stop these being deleted and have the task running as before?

[Iain_B]

... also, even though the task has been deleted, 2 additional tasks that I have added, and subsequently been deleted by Kaskpersky, are running. I am getting the two error messages every 10 minutes. I cannot find the tasks in order to delete them.

[Flood and Flood's wife]

Hello @Iain_B, 

Welcome!

• Read before you create a new topic!

1. Which Kaspersky software is installed: Standard, Plus, Premium? 
2. Which OS version & build? 
3. In Kaspersky Reports, find the events that represent the issue(s), save the Report, upload to cloud & post the share link or post full screen images so we can see what you see please? 

Thank you?
Flood?+?

Edited March 13, 2023 by Flood and Flood's wife
Modified 3.

[Iain_B]

1. Standard version

2. Windows 11 Home - Version 22H2

3. System Watcher report:

http://www.vantagesoft.co.uk/Kaspersky_Report1.txt

Intrusion Prevention report:

http://www.vantagesoft.co.uk/Kaspersky_Report2.txt

Edited March 13, 2023 by Iain_B

[Flood and Flood's wife]

4 hours ago, Iain_B said:

1. Standard version. 

2. Windows 11 Home - Version 22H2

3. System Watcher report. 4. Intrusion Prevention report - filtered

Hello @Iain_B, 

Thank you for the information!

• Please check the Kaspersky Standard version, on the Windows taskbar or hidden icons, select About?  
• Regarding the tasks that are running that you're unable to find, Shutdown the computer using Shutdown, not Restart, power on by pressing the power button, login, then proceed with the following steps:

IF you) trust the object(s) please do the following steps:

1. Open Kaspersky Standard GUI, go to & disable: Performance → PC Speed-up ⚙️Settings → PC resource consumption -> Perform recommended actions automatically -> select SAVE, select Confirm -> for the confirmation popup. 
2. (You) may also need to *temporarily* disable: Delete malicious tools, adware, auto-dialers and suspicious packers.
3. The Kaspersky application will ask you to decide which action to take on detected objects.
4. Select for “Quarantine”
5. Restore the quarantined object(s). 
6. Create exclusion rule(s) for the object(s).
7. Enable -> Performance → PC Speed-up → ⚙️Settings → PC resource consumption -> Perform recommended actions automatically.
8. IF Delete malicious tools, adware, auto-dialers and suspicious packers was disabled, enable it. 
9. Shutdown the computer using Shutdown, not Restart, power on by pressing the power button, login, recheck if the issue is resolved? 

Please share the outcome with the Community? 

            

       

Thank you?
Flood?+?

Edited March 13, 2023 by Flood and Flood's wife
Added additional dot point

[Iain_B]

Standard version 21.9.6.465

Thank you  - it all seems to be working as it did before. 
I am now going to have to create a rule for my backup USB sticks otherwise it will be wanting to delete my backup copies!
This is because the rules relate to paths as well as file names.

Edited March 13, 2023 by Iain_B

[Iain_B]

It is still deleting my backup copy on my USB stick.
A rule has been made for it and it is a trusted application - both relating to the USB stick (E:/).
How can I stop this?

[Flood and Flood's wife]

1 hour ago, Iain_B said:

It is still deleting my backup copy on my USB stick.
A rule has been made for it and it is a trusted application - both relating to the USB stick (E:/).
How can I stop this?

Hello @Iain_B, 

1. Post the Kaspersky Report that shows the detection of the backup copy events only please?
2. Post a full screen image of the exclusion (you) created for the USB please? 

Thank you?
Flood?+?

[Iain_B]

OK - I've re-created all of the events again. I have had to disable Kaspersky in order to make a new backup copy on the USB stick. The USB is E:/ drive.

You now have 3 new reports - two (shorter) ones as before, plus another one:
http://www.vantagesoft.co.uk/Kaspersky_Report3.txt
http://www.vantagesoft.co.uk/Kaspersky_Report4.txt
http://www.vantagesoft.co.uk/Kaspersky_Report5.txt

Plus two pictures:
Showing the 'Trusted' list, with the mouseover showing the detail.  After the file is deleted, the entry still remains, but the size goes down to 0.00 KB:
http://www.vantagesoft.co.uk/Trusted.jpg

Trying to open it in NotePad, showing that the file is already locked (then it was deleted):
http://www.vantagesoft.co.uk/NoAccess.jpg

So I am now having to pause Kaspersky to make the backup on the USB, remove the USB, and then Resume protection so that the backup copy does not get deleted.

Edited March 13, 2023 by Iain_B

[Flood and Flood's wife]

Hello @Iain_B, 

You're most welcome!

Thank you for the information. 

1. Please show an image of the exclusion you've created in Kaspersky Standard, Threats and Exclusions?

Thank you?
Flood?+?

[Iain_B]

I have not changed any of the settings here. I notice that only one item is ticked.

http://www.vantagesoft.co.uk/Exclusions.jpg

Thanks

[Igor Kurzin]

Hi @Iain_B, if you scan the script with Kaspersky scanner, it is not detected, right? 

 

[Iain_B]

It is still being detected. See:

http://www.vantagesoft.co.uk/detected.jpg

I had to restart the computer to stop it being deleted. When I restarted it I had to again allow it.

Edited March 22, 2023 by Iain_B

[Flood and Flood's wife]

On 3/22/2023 at 11:49 PM, Iain_B said:

It is still being detected.

Hello @Iain_B, 

Thank you for the information!

Prior to March 13th/2023, the vbs script/ cron *was* working, something changed, Kaspersky started blocking, please submit the detections to Kaspersky support - https://support.kaspersky.com/b2c#contacts -  to be sent to the Virus Lab, to determine why Kaspersky Standard 21.9.6.465 has a problem with the file(s), follow this guide: Kaspersky application blocks my website or application. What should I do?; - if you share files with the Kaspersky support/Virus Lab experts, zip the files, password protect the files with password: malware or infected & tell the support team the password. 

?**Make sure support understand the script was working previously & they tell that to the VLab experts & please post the Incident reference number?**?

Please share the outcome with the Community? 

Thank you?
Flood?+?

Edited March 24, 2023 by Flood and Flood's wife

[Iain_B]

I have a brand new computer with Windows 10 Pro (I do not like 11!).

I had two scheduled tasks working perfectly up to today, when I tried re-installing Kaskerky again.  AGAIN, both of these scheduled tasks are being removed.  I have disabled the "Delete malicious tools etc".  I am getting reports, but not enough information is given in the pop-up to know whether it is the scheduled task, or something else. 

For instance, I have a "Malware detected" pop-up which has detected a "Trojan.Multi.GenAutorunTask.a" in System memory.  I do not know if this is from the task scheduler, or a real trojan!

Unless I can allow these scheduled tasks, I shall have to uninstall Kaspersky again!

[Berny]

@Iain_B 
 

57 minutes ago, Iain_B said:

"Trojan.Multi.GenAutorunTask.a"

Can you please check your reports and post a screenshot with the full details from the detection.

[Iain_B]

I've spent too much time on this already. I have now uninstalled it again in order to have my routines run.

[Iain_B]

25 minutes ago, Berny said:

@Iain_B 
 

Can you please check your reports and post a screenshot with the full details from the detection.

That was all that it said on the popup. There was no option to permanently allow it, even if it did refer to the task scheduler. It seems that Kaspersky does not like scheduled tasks that include things like Powershell, and does not allow a work-around.