Message "Need to restart" each 5mn

isla34 · June 26

Since monday the 21 of June I get the message "Need to restart" each 5mn !!!!! This block the F-secure scan " F-secure get an error and a restart is needed".

The restart does nothing ! The same happen with VPN on or off.

I am using the version 25.5 where the correction implemented in version 25;4 must be ?

What shall I do ?

TVC15 · June 26

Hello @isla34

Did you happen to try what was suggested below, from this thread?

https://community.f-secure.com/en/discussion/comment/141545#Comment_141545

https://help.f-secure.com/product.html?home/total-windows/latest/en/task_B83B23EC89184DFE9CC401233EF85F9C-latest-en

Kind regards.

Firmy · June 26

Hello @isla34

Thank you for bringing this to our attention.

Kindly generate an fsdiag and share it with us. We will check it for you and let you know our findings. Please share the fsdiag directly to us via private message.

Thank you and have a lovely day.

Marmot · June 26

For Firmy - as requested, fsdiag before my FS reload.

I haven't a clue what it tells you but I'm sure you will let me know.

Thank you.

Edit: PII removed

isla34 · June 26

For TVC15

I send also the Fsdiag file to Firmy..

Let me know tomorrow if your solution worked. I hesitate always a bit to desinstall and reinstall software but you said its easy. Let's wait at first for Firmy answer today.

TVC15 · June 26

https://community.f-secure.com/en/discussion/comment/141551#Comment_141551

I absolutely agree, work with Firmy, as I wasn't sure of when you may get a response and was just posting an option :)

Hopefully, from the log files submitted, they will come out with a quick fix or an inclusion of it in the next build update, v25.6.

Firmy · June 27

Hello @Marmot

To protect your privacy, please avoid sharing your fsdiag file publicly in this forum. We have removed it for security reasons. If we need to review this information, we’ll reach out to you directly via private message.

You mentioned that you’ve already uninstalled and reinstalled the app. Could you please confirm if the issue still persists after the reinstallation? Are you still encountering the same error?

Thank you.

Marmot · June 27

Following re-installation there has been no recurrence of the 'restart' problem. I have also run 2 complete scans, yesterday and today with no issues found. So it looks like the problem is solved.

Just an aside which maybe relevant. I originally (15 years ago?) chose F-Secure because it was relatively light on processing demand compared to other virus protection. Over the period of the 'restart' problem I did notice that scanning significantly slowed down other software. This also now seems to have resolved itself.

fsdiag file: thank you for removing it, I wasn't sure how else to send it to you. Did you find anything useful to the problem - so that I don't repeat it in future e.g. software downloads.

Thank you.

Firmy · June 29

Hello @isla34

Thank you for your cooperation. We have received the fsdiag and reviewed the findings.

It appears that Kaspersky Total Security was previously installed on the device, last seen in 2022. Could you please confirm if the application has been fully removed?

If Kaspersky still appears, we recommend using the Kaspersky Removal Tool to clean up any leftover components.

Additionally, we noticed that both F-Secure ID Protection and F-Secure Freedome are installed. Since F-Secure Total already includes the features of both, we suggest removing them to avoid duplication. Before doing so, please ensure that:

Your passwords have been successfully synced with F-Secure Total.
You export a password backup (recommended).

For the cleanest experience, you may use the F-Secure Uninstallation Tool to remove all F-Secure applications. Please note that this will require you to reinstall F-Secure Total afterwards, but it ensures a clean setup.

Kindly let us know once the steps are completed or if you need any assistance along the way.

Thank you again, and have a lovely day.

Marmot · July 2

Thanks for the procedure. I have not used Kaspersky since about 2008 and not on this machine. I can only think that it was a remnant 'junk' software provided when I bought this PC in 2022.

I have run the Kaspersky delete tool. As a result F-Secure quarantined Unkis.vbs (I understand this is a visual basic script file, probably introduced by Kaspersky) and vbs/KillAV.VPD (appears to be potentially more malicious).

Fully deleted F-Secure and re-installed. Did complete scan. Nothing nasty found and nothing in Quarantine. Is is reasonable to assume the vbs files are removed or is there anything else I should do?

Thanks for your help.

isla34 · July 2

The F-secure msg is still there with the version 25.6:

By using the Powershell (Admin) :

displayName : Kaspersky Total Security
instanceGuid : {4F76F112-43EB-40E8-11D8-F7BD1853EA23}
pathToSignedProductExe : C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\wmiav.exe
pathToSignedReportingExe : C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\avp.exe
productState : 266240
timestamp : Sat, 02 Apr 2022 18:43:26 GMT
PSComputerName

I run "Kavmvr" to remove the "remaining Kaspersky Sw" selecting "Kasperty …TotalSecurity 21MR3" but still the same output using Powershell(Admin)..

If you can help me to know how to remove correctly Kaspersky, it will be helpfull !

Thanks for your help

isla34 · July 2

Sure I will uninstall F-secure ID protection and F-secure Freedome and reinstall correctly F-Secure Total to avoid the unpleasant F-secure error message and to have only one F-secure Total; bevor I will like to remove correctly Kaspersky as Marmot said it may remain malicious parts.

Ukko · July 2

I have run the Kaspersky delete tool. As a result F-Secure quarantined Unkis.vbs (I understand this is a visual basic script file, probably introduced by Kaspersky) and vbs/KillAV.VPD (appears to be potentially more malicious).

Based on its name "Unkis.vbs" sounds as it is something like "Uninstall Kaspersky Internet Security"? And "vbs/KillAV.VPD" looks more like the name of some item detection.

Somehow F-Secure detected a part of dedicated security software removal tool as a tool to 'kill' AV or some kind of hack-tool. Perhaps reasonable.. if somewhere, sometime, it was used in such a way by malicious actors. Or this .vbs script contains something generic for such uninstall operations (unattached to certain security solution).

I think that the utility creates these files somewhere in temporary folders and it is interesting when they were detected (in other words, whether the uninstallion "process" that was intended was completed or was interrupted when creating/using scripts for the action). Likely they were intended to be 'temporarily' - so should not be longer in system unless some unexpected routine.

I run "Kavmvr" to remove the "remaining Kaspersky Sw" selecting "Kasperty …TotalSecurity 21MR3" but still the same output using Powershell(Admin)..

I tried to search this tool out of interest with other user's experience with detection.

For me, the tool is called as "kavremvr.exe" (/utilities/ConsumerUtilities/ in their official website in
"Removal tool for Kaspersky applications on Windows (kavremover)" article).

when you use it, is there any report on the work done? For example, article says - you need to click "OK" when process is done and then restart system.

Thanks!

Marmot · July 2

There didn't seem to be any report after completing the Kaspersky removal tool, just 'Completed restart system'.

Having completed those actions I don't seem to have any recurring problems.

Regards.

Message "Need to restart" each 5mn

Answers

Categories