Windows XP strange bahavior after installation Kaspersky Business Space Security Options

[Radek Hruby]

Hi all, we have approximately 160 servers and workstations in our environment. We bought licences for Kaspersky Business Space Security recently and installed that product to ten servers (file server version) and ten workstations (workstation version 6.0.3.837 hotfix d.e.i) for evaluation. The server version works fine but we're experiencing some strange behaviour with workstations (Windows XP Professional SP2 or SP3 + IE 6 or 7 + MS Office 2007). Basically sometime users can't run programs as Outlook, IE, MS Word etc. When they double-click on an icon nothing happens or the program opens but
closes automatically. It is possible run the program when they repeat double-click more times (twice, three times …). That happens once or twice a day. Only solution we found is a computer restart. I tried to disable all antivirus features except “File-Antivirus” and disable “Self-Defense” but the problem still persists. Das anyone have the same experience (or even better - a solution)?

[mastropizza]

hi,
could you pls post a getsysteminfo log from one of those problematic computers?
M

[Radek Hruby]

I tried to post it through that web page but it didn't seem to do anything so I'm attaching Sysinfo here.

Attached File(s)

 sysinfo.zip ( 260.62K ) Number of downloads: 1

 

[mastropizza]

Hi,
your log states that there are some potentially incompatible softwares running on that PC:

1) MS FW client
2) Symantec: symevent.sys is up and running

Moreover your NIC drivers are old and you need to update them.
Try to remove at least Symantec component!
M

[Radek Hruby]

OK I removed PcAnywhere, Microsoft ISA Client and updated NIC drivers. The user is factually cut off from the Internet right now but ... hopefully that will help.

[mastropizza]

hi Radek,
could you pls post another GSI log?
M

[Radek Hruby]

Hi,

GSi parser works for me today so I can see status "Orange" (it was "Red" yesterday) - only issue is dlservice.exe (unknown). That is DeviceLock service and I really can't remove it. I'm attaching the log anyway.

Thanks for help.

Attached File(s)

 ie_sv_evanog.zip ( 147.1K ) Number of downloads: 2

 

[mastropizza]

hi,
yes your log now is clean...that said, have you tried to completely disable KAV? And if this does not solve, have you tried to uninstall KAV in order to understand if it's really KAV the cause of that problem?
M

[Radek Hruby]

Hi,

I tried to disable KAV - didn't help. Yes when I removed KAV, everything was OK. I'm keeping an eye on that "fixed" computer right now.

[mastropizza]

so, if i've got your problem properly, sometimes you have problems when opening win32 applications and, moreover, you cannot browse Internet...am i wrong?
If the problem is fixed by uninstalling KAV the cause might be found within one of the KAV's drivers.....klim5.sys (NDIS) and klif.sys are on the top of the ranking...
Thus, you can firstly try to install KAV without NDIS (setup.exe /pNOKLIM5=1): this might help at least to surf the net.......hopefully!
Secondly, you can try to work with a new version of klif (still in beta test): if you contact me via PM i can give you that driver version.
M

[Radek Hruby]

so, if i've got your problem properly, sometimes you have problems when opening win32 applications and, moreover, you cannot browse Internet...am i wrong?
If the problem is fixed by uninstalling KAV the cause might be found within one of the KAV's drivers.....klim5.sys (NDIS) and klif.sys are on the top of the ranking...
Thus, you can firstly try to install KAV without NDIS (setup.exe /pNOKLIM5=1): this might help at least to surf the net.......hopefully!
Secondly, you can try to work with a new version of klif (still in beta test): if you contact me via PM i can give you that driver version.
M

The "only" problem is with opening applications. The Internet issue is related to that fact I had to remove MS ISA Client and pcAnywhere - that is not dirrect KAV problem. I'm going to install KAV with that parameter and send you a pm. Radek

[mastropizza]

no, the "application" problem is not related to NDIS filter therefore you can leave it (it means: install KAV via wizard, no command line)...try to substitute the klif i gave you and let us know about the result.
M

[Radek Hruby]

Hi,
are you sure you sent me the right klif.sys? My current version is 6.12.10.334 and that one I got from you is 6.12.10.332. I swapped them anyway and now let see.

[Radek Hruby]

Everything seems to be fine with that klif.sys, so thank you very much. Radek

[mastropizza]

[gcarey]

Hi Mastropizza
I'm a colleague of Radek's

He is gone on holidays this morning and i think may have spoken too soon!

This morning the KAV updater overwrote the 6.12.10.332 Klif.sys file with version 6.12.10.334
Since then the problems have started all over again!

Is there some way to stop teh updater replacing this file?
Thanks!

[mastropizza]

Hi
you have to set KAV Updater to not update application modules...
Ciao
M