Unknown computers keep connecting to my account

[althetrainer]

I have Kasperski Standard that I am using for two home computers.  However, I keep getting emails from Kasperski telling me new computers added to my account.  I logged in to remove them but they kept coming back.  I have 2-step authentication set up but that didn't seem to be able to stop them.  What else could I do?

[Flood and Flood's wife]

37 minutes ago, althetrainer said:

• I have Kasperski Standard that I am using for two home computers. 
• However, I keep getting emails from Kasperski telling me new computers added to my account. 
• I logged in to remove them but they kept coming back. 
• I have 2-step authentication set up but that didn't seem to be able to stop them. 
• What else could I do?

Hello @althetrainer, 

Welcome!

1. Is a VPN also used? IF 'yes', is it Kaspersky or another provider? 
2. The devices (you're) deleting from (you're) MyKaspersky account & the emails - do they *match* up? 
3. Do the dates & times for the emails *match* the dates & times of those devices in (your) MyKaspersky account?
4. Are both SMS & Authenticator enabled as 2FA? 
5. Please post a full screen, screen-shot of one of the emails  *hide* any  private information before posting, we'd like to compare the email with *known* Kaspersky emails? 

Thank you🙏
Flood🐳+🐋

Edited December 20, 2023 by Flood and Flood's wife
Added questions

[althetrainer]

1 hour ago, Flood and Flood's wife said:

Hello @althetrainer, 

Welcome!

1. Is a VPN also used? IF 'yes', is it Kaspersky or another provider? 
2. The devices (you're) deleting from (you're) MyKaspersky account & the emails - do they *match* up? 
3. Do the dates & times for the emails *match* the dates & times of those devices in (your) MyKaspersky account?
4. Are both SMS & Authenticator enabled as 2FA? 
5. Please post a full screen, screen-shot of one of the emails  *hide* any  private information before posting, we'd like to compare the email with *known* Kaspersky emails? 

Thank you🙏
Flood🐳+🐋

1) I don't use a VPN

2) Yes, the name provided by the email and shown in my account matched (see attachment)

3) Date and time matched (Just connected again about an hour ago.

4) I don't quite understand this question.  I downloaded the authentication app on my phone.  Whenver I log in, I receive a 6-digit code in my phone to use on my pc for log in.  Did I answer your question?

5) The email is too large to be captured by one screen shot so I did it in three sections.  I will also attach a screen shot of the said device added to my account. 

[Flood and Flood's wife]

7 minutes ago, althetrainer said:

1) I don't use a VPN

2) Yes, the name provided by the email and shown in my account matched (see attachment)

3) Date and time matched (Just connected again about an hour ago.

4) I don't quite understand this question.  I downloaded the authentication app on my phone.  Whenver I log in, I receive a 6-digit code in my phone to use on my pc for log in.  Did I answer your question?

5) The email is too large to be captured by one screen shot so I did it in three sections.  I will also attach a screen shot of the said device added to my account. 

Hello @althetrainer, 

Thank you for posting back & the information & yes, you answered our questions!

1. So, just to be clear, the device: DESKTOP-QKEEF96 (Desktop) is *unknown* to you - is that correct? 
2. Please open Kaspersky Standard application, select the Headset🎧, opens the Customer service window - hide the License key - post back a full screen, screen-shot please? 
3. In (your) MyKaspersky account, go to: https://my.kaspersky.com/MyLicenses#/portal/pages/licenses/all & post back a  full screen, screen-shot of the subscriptions - hide any private information. 
4. In (your) MyKaspersky account, go to: https://my.kaspersky.com/MyDevices#/portal/pages/devices & post back a  full screen, screen-shot of the devices - leave enough device ID information for us to distinguish those devices as *separate* to any *unknown* devices.  

Thank you🙏
Flood🐳+🐋

[althetrainer]

33 minutes ago, Flood and Flood's wife said:

Hello @althetrainer, 

Thank you for posting back & the information & yes, you answered our questions!

1. So, just to be clear, the device: DESKTOP-QKEEF96 (Desktop) is *unknown* to you - is that correct? 
2. Please open Kaspersky Standard application, select the Headset🎧, opens the Customer service window - hide the License key - post back a full screen, screen-shot please? 
3. In (your) MyKaspersky account, go to: https://my.kaspersky.com/MyLicenses#/portal/pages/licenses/all & post back a  full screen, screen-shot of the subscriptions - hide any private information. 
4. In (your) MyKaspersky account, go to: https://my.kaspersky.com/MyDevices#/portal/pages/devices & post back a  full screen, screen-shot of the devices - leave enough device ID information for us to distinguish those devices as *separate* to any *unknown* devices.  

Thank you🙏
Flood🐳+🐋

1) Yes, that's the one unknown to me and keeps coming back after being removed multiple times.

2) Screen shot attached.

3) Screen shot attached.

4) I blacked out the two device names actually belong to me, leaving only the unknown one visible.  If you need my other two IDs please let me know.

[Flood and Flood's wife]

3 hours ago, althetrainer said:

 Yes, that's the one unknown to me and keeps coming back after being removed multiple times.

 I blacked out the two device names actually belong to me, leaving only the unknown one visible.  If you need my other two IDs please let me know.

Hello @althetrainer, 

Thank you for posting back & the information!

1. We did want a *little* of the legitimate device IDs, but, it's ok, in the end we don't need it. 
2. So, again, just to be clear, when the *unknown* device reconnects - it's always the same ID ->: DESKTOP-QKEEF96 (Desktop) - it never changes? 
3. The *unknown* device that's connecting is doing so with a Kaspersky Internet Security subscription.  
4. We see there's 5 Inactive subscriptions - are they all *expired*? 
5. Change (your) MyKaspersky account password. 
6. Run a Full scan, allow it to complete - IF you have two computers & are using both, please run a Full scan on both. 
7. Change the Router password. 
8. At the completion of the Full scan - assuming it's clean, shutdown both active computers, using Shutdown, not Restart, do not restart at the moment. 
9. Disconnect the power cables from the computers. 
10. Disconnect the Router/Modem cable from the computers.
11. Turn OFF the Router/Modem & leave it OFF. 
12. ****At this point, everything is OFF & everything is disconnected****
13. Turn on the Router/Modem & connect the cable to the computers. 
14. Replug the power cables into the computers. 
15. Turn on the computers by pressing the power button(s). 
16. Log into the computers, recheck for the *unknown* computer? IF it returns, please log a case with Kaspersky Customer Service, on the support page: https://support.kaspersky.com/b2c#contacts, select either Chat or Email, then fill in Application malfunction, Other template; please include any screen images of the error & a *detailed* history. Support may request logs, traces & other data; they will guide you. 

Please share the outcome with the Community, when it's available? 

Thank you🙏
Flood🐳+🐋

Edited December 20, 2023 by Flood and Flood's wife
grammar

[althetrainer]

15 minutes ago, Flood and Flood's wife said:

Hello @althetrainer, 

Thank you for posting back & the information!

1. We did want a *little* of the legitimate device IDs, but, it's ok, in the end we don't need it. 
2. So, again, just to be clear, when the *unknown* device reconnects - it's always the same ID ->: DESKTOP-QKEEF96 (Desktop) - it never changes? 
3. The *unknown* device that's connecting is doing so with a Kaspersky Internet Security subscription.  
4. We see there's 5 Inactive subscriptions - are they all *expired*? 
5. Please run a Full scan, allow it to complete - IF you have two computers & are using both, please run a Full scan on both. 
6. Change the Router password. 
7. At the completion of the Full scan - assuming it's clean, shutdown both active computers, using Shutdown, not Restart, do not restart at the moment. 
8. Disconnect the power cables from the computers. 
9. Disconnect the Router/Modem cable from the computers.
10. Turn OFF the Router/Modem & leave it OFF. 
11. ****At this point, everything is OFF & everything is disconnected****
12. Turn on the Router/Modem & connect the cable to the computers. 
13. Replug the power cables into the computers. 
14. Turn on the computers by pressing the power button(s). 
15. Log into the computers, recheck for the *unknown* computer? IF it returns, please log a case with Kaspersky Customer Service, on the support page: https://support.kaspersky.com/b2c#contacts, select either Chat or Email, then fill in Application malfunction, Other template; please include any screen images of the error & a *detailed* history. Support may request logs, traces & other data; they will guide you. 

Please share the outcome with the Community, when it's available? 

Thank you🙏
Flood🐳+🐋

2) There were two devices that kept coming back, another one GWNR51416 (desktop) finally stopped after being removed multiple times in the past two days.  This one, QKEEF96 (desktop) still comes back, usually within an hour after removal.  

3) Seems to be the case but the KIS license expired last year and I am currently running Standard - the active one.

4) Yes, I only have one active license, the rest of them all expired. Though I don't know why they show up under my account.

5) - 15) I will do that tomorrow.  This is 1am MST, I am running out of juice. Will report back once I go through all the steps.  

Thank you very much for taking time to walk me through.  I hope the issue will be resolved quickly.  Much appreciated. 

[Flood and Flood's wife]

38 minutes ago, althetrainer said:

2) There were two devices that kept coming back, another one GWNR51416 (desktop) finally stopped after being removed multiple times in the past two days.  This one, QKEEF96 (desktop) still comes back, usually within an hour after removal.  

3) Seems to be the case but the KIS license expired last year and I am currently running Standard - the active one.

4) Yes, I only have one active license, the rest of them all expired. Though I don't know why they show up under my account.

5) - 15) I will do that tomorrow.  This is 1am MST, I am running out of juice. Will report back once I go through all the steps.  

Thank you very much for taking time to walk me through.  I hope the issue will be resolved quickly.  Much appreciated. 

Hello @althetrainer, 

You're most welcome!

Take your time, there's no rush, it's important to do things carefully & methodically, at your own pace *and* when everything is sorted the last job on the list will be to request Kaspersky Customer Service delete the expired licenses - but - do not spend any time worrying about them at the moment.  

We'll wait for you to update the topic. 

Thank you🙏
Flood🐳+🐋

[althetrainer]

18 hours ago, Flood and Flood's wife said:

Hello @althetrainer, 

You're most welcome!

Take your time, there's no rush, it's important to do things carefully & methodically, at your own pace *and* when everything is sorted the last job on the list will be to request Kaspersky Customer Service delete the expired licenses - but - do not spend any time worrying about them at the moment.  

We'll wait for you to update the topic. 

Thank you🙏
Flood🐳+🐋

Thank you.  Just a quick update.  I managed to run full scans on both computers today, reports came clean. Didn't have time to reset the router password and onward but I logged in to remove the unknown device, expecting to see it back in a couple of hours.  To my surprise, it did't happen.  I checked security reports, noticed three additional attempts to connect to my account but failed to add.  It has been 10 hours no new devices were added to my account.  Since I am busy preparing for Christmas I might as well just observe for the next few days before I take the next step.  If all goes well I won't be back until after Christmas. Thank you again for your time and assistance.  Happy holidays. 

[Flood and Flood's wife]

14 minutes ago, althetrainer said:

1. I managed to run full scans on both computers today, reports came clean.
2. Didn't have time to reset the router password and onward but I logged in to remove the unknown device, expecting to see it back in a couple of hours.  To my surprise, it didn't happen. 
3. I checked security reports, noticed three additional attempts to connect to my account but failed to add.  It has been 10 hours no new devices were added to my account.  

Hello @althetrainer, 

Thank you for the update & we hope you got some rest? 

1. Excellent. 
2. The router password change & power OFF - leaving off & disconnected from the computers for 5 to 15  minutes is important as is removing the Power cables from the computers, once they've been shutdown - if (you) can find the time to do these steps - it  would be good - they don't really take that long - altho reading thru the steps - they may appear onerous. 
3. Just checking the System audit Report - you're *absolutely* certain the two detections for 20th December 2023, were from the * unknown device*, when the *Detail* of each of those events is shown, in the lower portion of the Report screen, may we have a full screen, screen-shot of that information please? 

Thank you🙏
Flood🐳+🐋

Edited December 21, 2023 by Flood and Flood's wife
spelling😌

[althetrainer]

1 hour ago, Flood and Flood's wife said:

Hello @althetrainer, 

Thank you for the update & we hope you got some rest? 

1. Just checking the System audit Report - you're *absolutely* certain the two detections for 20th December 2023, were from the * unknown device*, when the *Detail* of each of those events is shown, in the lower portion of the Report screen, may we have a full screen, screen-shot of that information please? 

Thank you🙏
Flood🐳+🐋

I did get some rest, thank you! It does look like the same unknown device.  Here's the rest of the report. 

[Flood and Flood's wife]

19 minutes ago, althetrainer said:

It does look like the same unknown device.  Here's the rest of the report. 

Hello @althetrainer, 

Thank you for the update!

👉Did you also get the emails, for those two entries? 

*IF (you) highlight an event at the top of the report, the Details are shown at the bottom of the Report window*

The reason we ask is we also have the same System Audit: We detected your My Kaspersky account was visited from another device - but the Kaspersky Report is not reliable (ioo), we logged into our MyKaspersky account - at the time of the events, shown in our report, using an Edge browser, using the same computer.... 

 

Please post back? 

Thank you🙏
Flood🐳+🐋

[althetrainer]

Spoke too soon.  The other one that I removed a few days ago returned just now.  Not only a visit but was added to my account.  Not only they added a new device successfully but also kicked out my second pc.  

[Flood and Flood's wife]

1 minute ago, althetrainer said:

Spoke too soon.  The other one that I removed a few days ago returned just now.  Not only a visit but was added to my account.  Not only they added a new device successfully but also kicked out my second pc.  

Hello @althetrainer, 

Thank you for the update!

Go straight to  Kaspersky Customer Service!

Please share any updates that you can when they're available?

Thank you🙏
Flood🐳+🐋

[althetrainer]

8 minutes ago, Flood and Flood's wife said:

Hello @althetrainer, 

Thank you for the update!

👉Did you also get the emails, for those two entries? 

*IF (you) highlight an event at the top of the report, the Details are shown at the bottom of the Report window*

The reason we ask is we also have the same System Audit: We detected your My Kaspersky account was visited from another device - but the Kaspersky Report is not reliable (ioo), we logged into our MyKaspersky account - at the time of the events, shown in our report, using an Edge browser, using the same computer.... 

 

Please post back? 

Thank you🙏
Flood🐳+🐋

Here's a screen shot with the top device highlighted. I didn't get any email messages regarding the visits, only when a new device was added successfully.  

Edited December 21, 2023 by althetrainer

[althetrainer]

8 minutes ago, Flood and Flood's wife said:

Hello @althetrainer, 

Thank you for the update!

Go straight to  Kaspersky Customer Service!

Please share any updates that you can when they're available?

Thank you🙏
Flood🐳+🐋

Never mind.  I found a chat.  On it now... Do you happen to have a clickable link to Kaspersky Customer Service?  I was looking for it initially but couldn't find it, ended up in this forum.  Thank you very much! 

Edited December 21, 2023 by althetrainer

[Flood and Flood's wife]

6 minutes ago, althetrainer said:

Never mind.  I found a chat.  On it now... Do you happen to have a clickable link to Kaspersky Customer Service?  I was looking for it initially but couldn't find it, ended up in this forum.  Thank you very much! 

Hello @althetrainer, 

Thank you for the Report above. 

Hopefully you're progressing with Kaspersky Customer Service, via Chat, the link is: https://support.kaspersky.com/b2c#contacts, on the support page, scroll down towards the bottom of the page (not all regions have Chat, Phone & Remote)

Thank you🙏
Flood🐳+🐋

[althetrainer]

6 minutes ago, Flood and Flood's wife said:

Hello @althetrainer, 

Thank you for the Report above. 

Hopefully you're progressing with Kaspersky Customer Service, via Chat, the link is: https://support.kaspersky.com/b2c#contacts, on the support page, scroll down towards the bottom of the page (not all regions have Chat, Phone & Remote)

Thank you🙏
Flood🐳+🐋

Thanks! I started a chat then realized it's not live.  They sent me a canned email stating a case file had been created for me now I am waiting for their response.  Edit: It is live, just very slow. LOL

Edited December 21, 2023 by althetrainer

[Flood and Flood's wife]

10 minutes ago, althetrainer said:

Thanks! I started a chat then realized it's not live.  They sent me a canned email stating a case file had been created for me now I am waiting for their response.  Edit: It is live, just very slow. LOL

Hello @althetrainer, 

Thanks for the update!

Unfortunately the chat tool is a bit clunky - no audio - on either side is a serious disadvantage!! 

***At the END of the chat - make sure you ask the Chat operator to email you a Copy of the Chat Transcript - IF they tell you you can send it to yourself by selecting the Email icon - tell them there is NO Email icon for the Kaspersky Customer - the Chat Operator has an Email icon, the Kaspersky Customer does not ***

Good luck!!

& thank you🙏
Flood🐳+🐋

[althetrainer]

3 minutes ago, Flood and Flood's wife said:

Hello @althetrainer, 

Thanks for the update!

Unfortunately the chat tool is a bit clunky - no audio - on either side is a serious disadvantage!! 

***At the END of the chat - make sure you ask the Chat operator to email you a Copy of the Chat Transcript - IF they tell you you can send it to yourself by selecting the Email icon - tell them there is NO Email icon for the Kaspersky Customer - the Chat Operator has an Email icon, the Kaspersky Customer does not ***

Good luck!!

& thank you🙏
Flood🐳+🐋

Damn. I just closed the chat.  Though likely the issue is not gone.  The operator pretty much just removed the unknown device for me but nothing else.  Then an email was sent to me stating the issue was resolved. Haha.  I am sure I will be chatting with them again soon. Will definitely let them know there's no email icon on my end. 

[Flood and Flood's wife]

2 minutes ago, althetrainer said:

Damn. I just closed the chat.  Though likely the issue is not gone.  The operator pretty much just removed the unknown device for me but nothing else.  Then an email was sent to me stating the issue was resolved. Haha.  I am sure I will be chatting with them again soon. Will definitely let them know there's no email icon on my end. 

Hello @althetrainer,

Thanks for the update!

1. Oh! that's not the outcome we expected, did the operator *understand* the issue?  
2. Please share the Incident reference number, it's prefixed with INC0000? 

Thank you🙏
Flood🐳+🐋

[althetrainer]

12 minutes ago, Flood and Flood's wife said:

Hello @althetrainer,

Thanks for the update!

1. Oh! that's not the outcome we expected, did the operator *understand* the issue?  
2. Please share the Incident reference number, it's prefixed with INC0000? 

Thank you🙏
Flood🐳+🐋

1) I tried to explain to him there were multiple unknown devices trying to add to my account but he said he had already removed the one shown and that there's nothing else he could do.  He told me to return to chat should another unknown device added to my account then they would escalat the case.  

2) Case number is INC000016019403

[Flood and Flood's wife]

11 minutes ago, althetrainer said:

1) I tried to explain to him there were multiple unknown devices trying to add to my account but he said he had already removed the one shown and that there's nothing else he could do.  He told me to return to chat should another unknown device added to my account then they would escalat the case.  

2) Case number is INC000016019403

Hello @althetrainer,

Thanks for the update & INC!

As a precaution, change (your) MyKaspersky password, the account is 2FA protected so in theory it *should* already be secure, however, it doesn't hurt to do this & IF you have time please do the steps we recommended yesterday, they are important to do. 

IF *another* unknown device connects - go straight back to Kaspersky Customer Service & make sure they manage the issue with appropriate care - deleting the device & nothing else - is not satisfactory - especially if you've told them you've already done that dozens of times!

Please keep the Community posted? 

Thank you🙏
Flood🐳+🐋

[althetrainer]

5 minutes ago, Flood and Flood's wife said:

Hello @althetrainer,

Thanks for the update & INC!

As a precaution, change (your) MyKaspersky password, the account is 2FA protected so in theory it *should* already be secure, however, it doesn't hurt to do this & IF you have time please do the steps we recommended yesterday, they are important to do. 

IF *another* unknown device connects - go straight back to Kaspersky Customer Service & make sure they manage the issue with appropriate care - deleting the device & nothing else - is not satisfactory - especially if you've told them you've already done that dozens of times!

Please keep the Community posted? 

Thank you🙏
Flood🐳+🐋

Will do.  The irony is that my Kaspersky password is new.  I can definitely create another one tomorrow.  Thanks again for your time.  I will keep you posted should there be a new development. 

[althetrainer]

On 12/20/2023 at 11:24 PM, Flood and Flood's wife said:

Hello @althetrainer,

Thanks for the update & INC!

As a precaution, change (your) MyKaspersky password, the account is 2FA protected so in theory it *should* already be secure, however, it doesn't hurt to do this & IF you have time please do the steps we recommended yesterday, they are important to do. 

IF *another* unknown device connects - go straight back to Kaspersky Customer Service & make sure they manage the issue with appropriate care - deleting the device & nothing else - is not satisfactory - especially if you've told them you've already done that dozens of times!

Please keep the Community posted? 

Thank you🙏
Flood🐳+🐋

I returned here to give one last update on my issue, despite it's not resolved.  So far customer support is still at the "send me a screen shot" stage.  I have talked to 4 different members from the support team and was given 5 different case numbers.  Each time I was asked the same questions (gave them the same answers) and the support team member would do just one thing then told me to wait for another 24 hours.  I dealt with them throughout my Christmas and New Year holidays but the progress was extremely slow, if any.  When they finally "escalated" my case, I was sent instructions on how to trace the unknown devices.  I read through all the steps but couldn't quite figure out each step, called support for clarifications.  They explained to me up to step # 2, when I said I didn't understadn how to do step # 3. <describe the exact scenario to trace>, I was told just follow the steps.  I thought once enabled trace,  rebooted my computer Kaspersky started that's when a window would pop up where I could describe the scenario.  But no, I turned on trace, rebooted my pc, Kaspersky didn't start automatically so I manually opened it but there's nowhere I could "describe the scenario to trace".  So I contacted support again, was given yet another case #, answered the same questions, reset passwords, full scan etc etc.  I asked where could I go to describe my scenario, the agent told me to ignore the previous instructions because he was going to send me a new set of instructions.  They came in an email in steps, just like before, something about recording instead of tracing.  One of the steps was to "run the third party software" to recreate the problems.  I replied to the email stating my problem was unknown devices kept adding themselves to my account and that I didn't have any thrid party software.  The same agent simply disappeared for a couple of days.  Two days later a new agent sent me a new email asking me for a screenshot that I had sent to the previous agent twice.  

At that point, I knew no real help would be coming from the support team other than the run-arounds.  I decided to take matters into my own hand. Since my license key was good for three different devices and each time one became available an unknown device would take that spot. I could simply occupy all three of them.  I bought a semi broken computer, added it to my Kaspersky account, blocking any more unknown devices from getting in.  I don't know if this is a long term solution or if they will ever figure a way to kick my own devices out.  For now, at least I don't have to keep going back and forth with Kaspersky support team in frustration.  

I want to say thank you for your time and patience trying to assist me but I believe this won't anywhere. I have been using Kaspersky for 15 years.  When most stores in Canada dropped Kaspersky even my husband and son decided to use something I stuck by it because it's a good software.  Unfortunately, the software is only as good as its support, after 15 years I will have to say goodbye to my cyber security sweetheart and start looking elsewhere.  

All the best and Happy New Year!