Jump to content

Task & script being removed


Iain_B

Recommended Posts

Hi,

I have created a task in Task Scheduler that every 10 minutes runs a vbs script that accesses the internet. It's a type of cron.

Up until about 1 day ago, it was working fine. However, in the last day or so, Kaspersky insists on deleting both the task entry and the vbs script. I have added the script file to the Security / Manage applications / Trusted, but it still deletes the file. Also, when trying to restore the vbs file from my backup, it now deletes the file from the backup!! Strangely, even though the task has been remored from the task manager, I am still getting an error message every 10 minutes saying the the vbs script file cannot be found. So the task seems to be running, even though it has been removed from the list!

How can I stop these being deleted and have the task running as before?

Link to comment
Share on other sites

... also, even though the task has been deleted, 2 additional tasks that I have added, and subsequently been deleted by Kaskpersky, are running. I am getting the two error messages every 10 minutes. I cannot find the tasks in order to delete them.

Link to comment
Share on other sites

Flood and Flood's wife

Hello @Iain_B

Welcome!

  1. Which Kaspersky software is installed: Standard, Plus, Premium? 
  2. Which OS version & build
  3. In Kaspersky Reports, find the events that represent the issue(s), save the Report, upload to cloud & post the share link or post full screen images so we can see what you see please? 

Thank you?
Flood?+?

Edited by Flood and Flood's wife
Modified 3.
Link to comment
Share on other sites

Flood and Flood's wife
4 hours ago, Iain_B said:

1. Standard version. 

2. Windows 11 Home - Version 22H2

3. System Watcher report. 4. Intrusion Prevention report - filtered

Hello @Iain_B

Thank you for the information!

  • Please check the Kaspersky Standard version, on the Windows taskbar or hidden icons, select About?  
  • Regarding the tasks that are running that you're unable to find, Shutdown the computer using Shutdown, not Restart, power on by pressing the power button, login, then proceed with the following steps:

IF you) trust the object(s) please do the following steps:

  1. Open Kaspersky Standard GUI, go to & disable: Performance → PC Speed-up ⚙️Settings → PC resource consumption -> Perform recommended actions automatically -> select SAVE, select Confirm -> for the confirmation popup. 
  2. (You) may also need to *temporarily* disable: Delete malicious tools, adware, auto-dialers and suspicious packers.
  3. The Kaspersky application will ask you to decide which action to take on detected objects.
  4. Select for “Quarantine”
  5. Restore the quarantined object(s). 
  6. Create exclusion rule(s) for the object(s).
  7. Enable -> Performance → PC Speed-up → ⚙️Settings → PC resource consumption -> Perform recommended actions automatically.
  8. IF Delete malicious tools, adware, auto-dialers and suspicious packers was disabled, enable it. 
  9. Shutdown the computer using Shutdown, not Restart, power on by pressing the power button, login, recheck if the issue is resolved? 

Please share the outcome with the Community? 

 image.thumb.jpeg.e4fea5166d767d2019e393801cfed1f4.jpeg image.thumb.jpeg.e90631983fe3a976c4865acbcd3b77c1.jpeg image.thumb.jpeg.29a1c1d737a520669726b8315baf4b77.jpeg         

 image.thumb.jpeg.de82c8d55b82d52617a2bcd432cd2b5d.jpeg      image.thumb.jpeg.55e356e7330471eb6590dc428c2b2391.jpeg

Thank you?
Flood?+?

Edited by Flood and Flood's wife
Added additional dot point
Link to comment
Share on other sites

Standard version 21.9.6.465

Thank you  - it all seems to be working as it did before. 
I am now going to have to create a rule for my backup USB sticks otherwise it will be wanting to delete my backup copies!
This is because the rules relate to paths as well as file names.

Edited by Iain_B
Link to comment
Share on other sites

It is still deleting my backup copy on my USB stick.
A rule has been made for it and it is a trusted application - both relating to the USB stick (E:/).
How can I stop this?

Link to comment
Share on other sites

Flood and Flood's wife
1 hour ago, Iain_B said:

It is still deleting my backup copy on my USB stick.
A rule has been made for it and it is a trusted application - both relating to the USB stick (E:/).
How can I stop this?

Hello @Iain_B

  1. Post the Kaspersky Report that shows the detection of the backup copy events only please?
  2. Post a full screen image of the exclusion (you) created for the USB please? 

Thank you?
Flood?+?

Link to comment
Share on other sites

OK - I've re-created all of the events again. I have had to disable Kaspersky in order to make a new backup copy on the USB stick. The USB is E:/ drive.

You now have 3 new reports - two (shorter) ones as before, plus another one:
http://www.vantagesoft.co.uk/Kaspersky_Report3.txt
http://www.vantagesoft.co.uk/Kaspersky_Report4.txt
http://www.vantagesoft.co.uk/Kaspersky_Report5.txt

Plus two pictures:
Showing the 'Trusted' list, with the mouseover showing the detail.  After the file is deleted, the entry still remains, but the size goes down to 0.00 KB:
http://www.vantagesoft.co.uk/Trusted.jpg

Trying to open it in NotePad, showing that the file is already locked (then it was deleted):
http://www.vantagesoft.co.uk/NoAccess.jpg

So I am now having to pause Kaspersky to make the backup on the USB, remove the USB, and then Resume protection so that the backup copy does not get deleted.

Edited by Iain_B
Link to comment
Share on other sites

  • 2 weeks later...
Flood and Flood's wife
On 3/22/2023 at 11:49 PM, Iain_B said:

It is still being detected.

Hello @Iain_B

Thank you for the information!

Prior to March 13th/2023, the vbs script/ cron *was* working, something changed, Kaspersky started blocking, please submit the detections to Kaspersky support - https://support.kaspersky.com/b2c#contacts -  to be sent to the Virus Lab, to determine why Kaspersky Standard 21.9.6.465 has a problem with the file(s), follow this guide: Kaspersky application blocks my website or application. What should I do?; - if you share files with the Kaspersky support/Virus Lab experts, zip the files, password protect the files with password: malware or infected & tell the support team the password. 

?**Make sure support understand the script was working previously & they tell that to the VLab experts & please post the Incident reference number?**?

Please share the outcome with the Community? 

Thank you?
Flood?+?

Edited by Flood and Flood's wife
Link to comment
Share on other sites

  • 6 months later...

I have a brand new computer with Windows 10 Pro (I do not like 11!).

I had two scheduled tasks working perfectly up to today, when I tried re-installing Kaskerky again.  AGAIN, both of these scheduled tasks are being removed.  I have disabled the "Delete malicious tools etc".  I am getting reports, but not enough information is given in the pop-up to know whether it is the scheduled task, or something else. 

For instance, I have a "Malware detected" pop-up which has detected a "Trojan.Multi.GenAutorunTask.a" in System memory.  I do not know if this is from the task scheduler, or a real trojan!

Unless I can allow these scheduled tasks, I shall have to uninstall Kaspersky again!

Link to comment
Share on other sites

25 minutes ago, Berny said:

@Iain_B 
 

Can you please check your reports and post a screenshot with the full details from the detection.

That was all that it said on the popup. There was no option to permanently allow it, even if it did refer to the task scheduler. It seems that Kaspersky does not like scheduled tasks that include things like Powershell, and does not allow a work-around.

Link to comment
Share on other sites

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now


×
×
  • Create New...