Too long memory check

[mikhail.rokhin]

 

 

16Gb RAM was always checked for a few minutes, situation has changed due to recent Windows update to Windows 10 21H1 x64 to version 10.0.19043.1110 .

At the same time in VirtualBox guest Windows 10/11 there is no such problem.

FYI.

[Yury N.]

Hello.

Please provide traces https://support.kaspersky.com/15677

[mikhail.rokhin]

No traces, dir is empty.

[mikhail.rokhin]

Hello.

Please provide traces https://support.kaspersky.com/15677

It would be nice to have automated telemetry in the tool.

The size of traces is huge 1.5Gb , though it is 7zipped into 9 volumes by 5Mb allowed here per attachment and zipped as .7z is prohibited.

[mikhail.rokhin]

And there is another strange behaviour of KVRT - it tends to write access to \Device\Harddisk0\DR0 and is blocked by Windows Defender.

[Yury N.]

Please run the console under administrator and call “bitsadmin /list /allusers /verbose > C:\bits.log” command. It will probably take a long time like scanning of KVRT “System memory”. And send the resulting C:\bits.log file.

[mikhail.rokhin]

Please run the console under administrator and call “bitsadmin /list /allusers /verbose > C:\bits.log” command. It will probably take a long time like scanning of KVRT “System memory”. And send the resulting C:\bits.log file.

 

[Yury N.]

C:\ProgramData\Microsoft\MapData\mapscache\BitsTemp\{F14CE86F-DF51-48AD-B312-DF39114E62B4}.tmp
C:\ProgramData\Microsoft\MapData\mapscache\BitsTemp\{7822CED5-4B8E-4EE7-A538-7C1AE17CFD9A}.tmp

Please send to me a personal message with this files in the password protected archive.

[mikhail.rokhin]

C:\ProgramData\Microsoft\MapData\mapscache\BitsTemp\{F14CE86F-DF51-48AD-B312-DF39114E62B4}.tmp
C:\ProgramData\Microsoft\MapData\mapscache\BitsTemp\{7822CED5-4B8E-4EE7-A538-7C1AE17CFD9A}.tmp

Please send to me a personal message with this files in the password protected archive.

They absent, the only files are:

{6E749465-4698-4379-A20E-EE68B7E552E8}.tmp

{8BE12DE8-9BF9-45BA-B4E7-493F3D872C6B}.tmp

[Yury N.]

They absent, the only files are:

{6E749465-4698-4379-A20E-EE68B7E552E8}.tmp

{8BE12DE8-9BF9-45BA-B4E7-493F3D872C6B}.tmp

Ok, send them.

[mikhail.rokhin]

They absent, the only files are:

{6E749465-4698-4379-A20E-EE68B7E552E8}.tmp

{8BE12DE8-9BF9-45BA-B4E7-493F3D872C6B}.tmp

Ok, send them.

It’s impossible to attach files to personal message. 

[Yury N.]

Seems bug in Microsoft MapsBingGeo service. Under this service was created 67000 the same BITS tasks. To delete these tasks you need to call “bitsadmin /reset”.

[mikhail.rokhin]

Seems bug in Microsoft MapsBingGeo service. Under this service was created 67000 the same BITS tasks. To delete these tasks you need to call “bitsadmin /reset”.

Looks like it barely helps? :

C:\WINDOWS\system32>bitsadmin /reset

BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

0 out of 0 jobs canceled.

C:\WINDOWS\system32> bitsadmin /list /allusers /verbose

...
 

        125296 / 125296 WORKING https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=10,1133,9898045,0 -> C:\ProgramData\Microsoft\MapData\\mapscache\BitsTemp\{B30C3DA0-C5DF-4E46-9978-C71C2A8464AA}.tmp
        77213 / 77213 WORKING https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=10,1133,39592177,0 -> C:\ProgramData\Microsoft\MapData\\mapscache\BitsTemp\{4C6476AD-9F67-4074-965A-B248C5C0FE5C}.tmp
        79610 / 79610 WORKING https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=10,1133,39592179,0 -> C:\ProgramData\Microsoft\MapData\\mapscache\BitsTemp\{E5B48F9C-529E-4AE5-B021-F808E2BA84E9}.tmp
        72212 / 72212 WORKING https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=10,1133,39592182,0 -> C:\ProgramData\Microsoft\MapData\\mapscache\BitsTemp\{F14CE86F-DF51-48AD-B312-DF39114E62B4}.tmp
NOTIFICATION COMMAND LINE: none
owner MIC integrity level: SYSTEM
owner elevated ?           true
This job is read-only to the current CMD window because the job's mandatory
integrity level of SYSTEM is higher than the window's level of HIGH.
Peercaching flags
         Enable download from peers      :false
         Enable serving to peers         :false

CUSTOM HEADERS: NULL

Listed 1 job(s).

 

[mikhail.rokhin]

Seems bug in Microsoft MapsBingGeo service. Under this service was created 67000 the same BITS tasks. To delete these tasks you need to call “bitsadmin /reset”.

Additionally BITS service should be restarted to remove all jobs.
 

C:\WINDOWS\system32>bitsadmin /list /allusers /verbose

BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

Listed 0 job(s).
 

[mikhail.rokhin]

Seems bug in Microsoft MapsBingGeo service. Under this service was created 67000 the same BITS tasks. To delete these tasks you need to call “bitsadmin /reset”.

 

Thank you for development & support!

It helped, but I wonder why does it affect KVRT so dramatically?
And I wish you integrate automated telemetry and recovery (like ‘Waas Medic Agent‘ tends to be).

[Yury N.]

 

It helped, but I wonder why does it affect KVRT so dramatically?
And I wish you integrate automated telemetry and recovery (like ‘Waas Medic Agent‘ tends to be).

Too many tasks, usually several pieces. We'll think how we can improve.

Thanks for the report!

[mikhail.rokhin]

\Microsoft\Windows\Maps MapsUpdateTask via Scheduler might be temporary disabled, until ongoing MicroSoft patch.