We have been using this for about 4 months on roughly 80 pcs. Several users have seen been complaing of slow system performance. I feel like we have modified the settings almost to the point of having no protection at all. We are starting to disable the Proactive Protection with only slight increase in performance. Another complaint is that every hour when the clients check for updates, the screen locks up completely for 15 -30 seconds. Attached is GSI file. Please advise.

I just finished a dpleoyment of 6.0 and have also found signifcant performance degradation POS Kiosk we use to record patient observations. The kiosk pull data from a local SQL DB and fuinctrion quite well when Trend Micro was running. The situation has become so bad, that at the presnt time we have turned off KAV at one location, to find that perfoirmance is back where it was prior to the deployment.

All kiosk exceed Kaspersky's recommended hardware requirements. Any help would be appreciated.

We are seeing a severe performance hit on our computers too in the past few weeks. We've had numerous complaints from people running out of virtual memory. Most of our PC's are Pentium 4 2.6 GHz Hyper-threaded machines with 512 KB of memory running Windows XP SP2.
We are running version 6.0.2.690 because 6.0.3.837 does not run well in our environment. 6.0.3.837 has the same performance issues in our testing though.

Our clients only have File Anti-Virus module installed.

Here's what we've seen:
Very high virtual memory usage. The AVP.exe process (under the System account) is using 120 -130 meg of memory.
To view virtual memory usage, goto Task Manager, Processes then click View>Select Columns. Place a check mark in "Virtual Memory Size" and press OK.
These instructions were for Windows XP. Windows Vista machines may have similar setup.

I tested when first installing Kaspersky and virtual memory usage is normal. Something like 20 megs. After the latest definition update it climbs to the 120 - 130 meg range.

We opened a case with Kaspersky early last week and they told me that it was a known issue and there should have been an update late last week, however I haven't seen any progress yet.
Hopefully soon we'll see an update.

I'm working on slowing the frequency of updates down to twice a day because of numerous complaints that machines are freezing while updating.
I doubt we're the only ones experiencing the abnormally high virtual memory usage. It took us a little bit to figure out what was going on. I'm curious if others are having the same virtual memory issues we are having?

I've been seeing the virtual memory issues, too.

DKnoll,

Your setup sounds very similar to ours. However, we have all the components installed. I have set our computers to update only when their systems are starting up. I opened a ticket on Monday. I have since sent over 2 sysinfo files. I have been told they are still looking into it. My users are getting EXTREMELY frustrated. We have started adding 2GB of RAM to the computers. This seems to be working but having to get approval for $2K worth of RAM on top of what we already spent on the KAV system is going to be a hard sell to management!

Out of 850 computers, we've had a only a handful complain about their computers being slow.
When I say slow, I mean it takes over 5 minutes to open IE.
When I disabled KAV, everything was normal.
One user said that after a reboot, everything was normal at first, but the computer would slow more and more as he opened applications.
This issue just started this morning.

I could be mistaken, but all the issues we have been having seems to have started after we applied the KLIF.sys update to resolve the BSOD we were getting. I am using klif.sys file version 6.12.10.332 modified 2-17-2009. Anybody applied this?

Same thing, 99% of my users are very pleased with the performance *increase* of Kaspersky. Those PC's that are "slower" with Kaspersky tend to have so much junk on them, it's easier to just re-image.

Alright, here's my problem.
Less than 1% of our users are experiencing this issue, and I can find no reason why they're affected and others aren't.
The issue: Kaspersky will show the yellow cog on its icon as if it's scanning, but there's no scan task running. When you go into Windows Task Manager and sort by Memory Usage, avp.exe is on top using a crazy amount of memory (at least 40MB - I've seen it exceed 100MB). All other applications run at a snail's pace.
If I pause protection, avp.exe will remain on top for memory usage for maybe 30 seconds, and then it will drop dramatically. Then I can re-enable KAV, and everything will work fine.
This issue was first reported to me April 1st.

Has anyone opened a case with Kaspersky Support on this yet? If so, did they provide a fix or work around?

We have an install base of about 3000 nodes. We have had numerous reports on slowness over the pas 30-60 days.

I opened a case a little over a week ago. I have sent 2 GetSysInfo files to support, asked for status and also offered to give any other info they might need to help with their investigation. I even sent them a link to this thread. I haven't heard anything yet.

I called support again today because the issue still exists in our environment. They suggested for me to send a couple of Get SystemInfo files from two different machines. I sent 3. Hopefully they will find something that alleviates this issue.

ehawk01, did you open a case with Kaspersky yet?

I spent a couple hours on Friday working with support. They have not found anything useful yet. Just wanted to see if I could help point them in the right direction.

Just curious, what version of KAV and Hotfix are you running? I am on 6.0.3.837 hotfix h.

I have now klif.sys file version 6.12.10.334, 6.0.3.837 hotfix i
There was a problem with iswift, now my PC is no more so-o-o slow.

how did you get hotfix i ?

i have tried the updater & i am still on hotfix h

we have many people complaining the samething... workstation performance has degraded to the point where they want to remove Kaspersky.

any assistance would be appreciated

Interesting. We are looking into maybe moving from Trend to Kaspersky, and hope there aren't going to be any performance issues with it.

I wouldn't if I were you. I administrated Trend at my last job and it was so much more reliable and easier to manage. Here we have Kaspersky and have had too many problems after many of their updates. After the first problem I thought that would be it. But then it happend again, and again, and again. Hopefully, we will switch to Trend here in the future.

I asked the tech I have been in contact with about hotfix I. He said I should already have it. I downloaded it to the admin kit then pushed it out to a few desktops. Virtual memory was still running pretty high, but the system seems to running OK. I have scheduled to push this out to the rest of the systems within the next few hours. I will post my results later.

NOW, it's personal.
My computer is showing the symptoms. I am running hotfix i.
The yellow cog keeps flashing as if it's running a scheduled scan when it isn't.
Memory usage for avp.exe is up to 81MB.
I paused protection, and it hijacked my CPU for about 60 seconds, and then it stopped. 15 seconds or so later, it released its grip on my memory too.
About 30 seconds after I resumed protection, it moved its way back up to the top of my processes, with 63MB used.

I tried running an update, and the memory usage jumped to 135MB. Although my computer was idle when I went to lunch, it was still at 135MB when I returned.

Sounds like a Memory Leak.

Sounds like Kaspersky has no clue to me.

any updates on this issue?

Hello,

If you think your computers are concerned by a memory leak issue, then gather all these logs:

- Getsysteminfo report
- Export of the System event log
- Poolmon log (see: http://support.microsoft.com/kb/177415)

Poolmon utility will help to underline if a thread is affected by a memory leak.
Then create a new support ticket: http://support.kaspersky.ru/helpdesk.html?LANG=en

I am running 6.12.10.334.

Slowness still exists.

Anyone had a break-through?

I do not think it is a memory leak issue. I have this running on over 100 computers and they ALL are slow during update. I repeat ALL computers are slow during the update process. XP and Vista machines.

I have staggered the updates by 15 min., but I know that is not the problem. Even if I manually do an update the PC hangs during the process. It is obvious something is wrong with Kaspersky, but Kaspersky does not want to admit it.

Not sure if this helps, but I found a solution to an issue in another thread that was very similar. Printing was extremely slow on one machine so I had to add an exception in the Trusted Zone area in the settings of the policy. I just added the path to the executable for the spooler service and set the options to not scan traffic or control the application activity. I ended up doing this for all the main apps my users need and this improved the performance vastly.

Maybe in your case there is a network process or other TSR running in the background that needs to be excluded from Mr. Kaspersky's watchful eye.

Hope this leads to a solution.

Well this is interesting. The last 2 days the slowness on update is not happening. Nothing has changed on any of our computers, but they are not hanging now when they update. I also noticed that it only takes about 25 to 30 seconds now to update, where before it was about 2 minutes.

I will keep an eye on it.

ALL of my users are affected by this slowness (I receive regular complaints); even performing an update for KAV on a freshly-installed system at night (when I've got full bandwidth) takes forever (and yes, this includes subsequent updates). Copying data to a USB thumb drive takes 10x the time (and that's a generous estimate). Standard computer use is noticeably worsened (as compared to other anti-virus solutions, even).

For example, I got this email today:Frankly, I've got nothing to suggest for him.

The fact that we're stuck on KAV6 when non-business customers are two versions ahead is even more troublesome to me, as it shows that Kaspersky's priorities put corporate customers like us completely out of sight.

I moved us away from Trend Micro for performance and ethical reasons. Kaspersky was top-rated in its ability to find malware with minimal resource cost. While it is certainly more capable than Trend Micro at finding things, it fails utterly in the performance department.

bump for an official kaspersky answer

same problem on german version....
is this the way kaspersky want to say: business users go away ?

same here italian version
I need solution!

We are having problems with the update process slowing our PC's to a crawl too.

Sometimes updates can take 10-20 minutes during which time the hard drive is being hammered and the PC is almost unusable (CPU use doesn't seem to increase by a significant amount).

Most of our users have 512Mb - 1Gb of RAM (a few older PC's only have 256Mb!).

During an update process, I seem to have 3 copies of avp.exe running taking up (one takes up 10,000Kb, one 6,000Kb and one starts at around 12,000Kb but rises to 140,000Kb!).
klnagent takes up 10,000Kb.
After the update has completed, one of the avp.exe processes quits and the 140,000Kb one drops back down to around 12,000Kb.

I have sent in a couple of GetSystemInfo logs to Kaspersky support & they asked me to run "C:\Program Files\Kaspersky Lab\NetworkAgent\klnagchk.exe" to check that the agent was talking to the server OK (which it was).

I suspect that either the update process uses a very inefficient way of accessing the disk or it's taking up so much RAM that Windows is constantly swapping data to/from the page file.
I thought McAfee was bad but at least users' PC's were just about usable when an update was being performed.

Does anyone from Kaspersky read these forums?

From other posts, it doesn't look like there will be any major update to the business AV applications until 2010

If I can't get a solution to this then we will have no option to switch to another AV provider otherwise users may start throwing their PCs & laptops out the nearest window
Some companies are offering quite attractive competitive upgrade prices at the moment...

I spoke with Kaspersky Support about this yesterday. For some background I work in an environment with several thousand nodes, XP/Vista/Server2000/03. Mostly Dell machines with a bit of HP and other brands. Users have complained since fairly early on there have been slowdowns. In many cases we found through troubleshooting that a bunch of machines simply are fragmented to hell and back, 45+% fragmentation. After cleaning up the machines and removing some other real-time scanning programs, performance improved a great deal, for obvious reasons.

But there are a number of cases where a machine is fully defragmented and cleaned up and access to local/network resources is slow. I have excluded a number of custom applications and other standard ones (such as Office) but this continues to be a problem. I have tested the update memory usage on my machine and it spawns a 3rd avp.exe process, climbs to 150MB, 50% CPU for a minute or so, then drops to between 4-5MB. It's really strange.

The Support guy told me there is a known issue with Broadcom 570xx NICs (including the NetXtreme and other gigabit adapters) that would not play with the NDIS packet filter Kaspersky installs by default, because the drivers are evidently not fully NDIS compliant. Originally when we started making packages without NDIS it was to combat other things that would write to the TCP/IP stack such as Cisco VPN Client (Deterministic Network Enhancer) and other bizarre wireless NICs, etc. We did not see the crashing and other problems on workstations really but the engineer reported pretty much exactly what the symptoms were - slowness when accessing network resources even on highspeed LAN.

However, since the Broadcom family has shipped in most (if not all!) Dell workstation in the past few years, this is obviously a pretty large problem. I am currently working with a client of ours to remove and reinstall the product without NDIS in hopes that it cures their woes. But, if the default install option is going to grind a huge percentage of typical corporate machines to a halt, this really should be communicated to companies considering rolling this out - it's simply bad practice. I realize that this may not be (or it might!) be Kaspersky's fault, but having more information UP FRONT is crucial. We now have a pretty big mess on our hands and a lot of screaming clients.

Some clients do not have NDIS across the board but still complain despite me adding all of their main apps as exclusions. I am not sure what I will do with them yet but I have some ideas. If I can't figure it out, I'll make sure Kaspersky is burning the midnight oil on it.

Well that might explain most of my problems. I have Dell's across the board and even though for a few days things seemed to be faster, the last 2 days have been back to slow. The update process is crawling our computers again.

Let us know what you find out.

I don't think it is a cure-all. I think that is simply one of the many possible common threads in this. Running GSI and putting it through the parser at gsi.kaspersky.fr has given me even more to chew on. A lot of these machines may be using drivers from 2002-2003 and I have been updating the drivers to a very recent release as I see them. I am hoping this helps.

Either way I'll know more by Friday as I work on this and I'll post any useful findings I get. I'm under the gun to figure this out and determine whether or not we keep the product, so it is about all I am working on

A few things that I have done that may help out or discovered:

I have seen some positive reports from my test bed users after removing NDIS on the workstations and also updating their NIC drivers as needed. A number of the Broadcoms are using drivers from 2001 or 2002 - the latest ones from the vendor are quite recent. Did the same thing with some Intel drivers too. Per support I also opted to kill Proactive Defense in my enterprise policies.

As far as controlling the 'update freezing' problem, I found something interesting. When you make the install package for KAVWKS 6 and you check the properties, you can choose to install additional 'tasks' such as Scan My Computer, Update, etc. When you leave these alone, you maintain total control over scanning and update behavior. But in the update case, it appears the default install option in a standalone (every 2 hours) is used. So in other words, KAV will update every 2 hours IN ADDITION to the schedule you have set. You cannot lock this setting down in the Admin Kit, you have to do it on the client side.

You can run a commandline via a login script though to change this, here is what I came up with to fix this across the board:

*First configure the updater settings the way you would like (for example, schedule it once a day, run missed, etc) in the GUI. Apply those settings.
*Open command prompt and cd to the install directory
*Run 'avp.com export updater xxxxx.cfg' - this will output the updater only settings to config file
*Copy said file to a share and run 'avp.com import xxxxx.cfg /password=yourkavpassword'
It should return no error code and when you check the update settings they should be modified. Works like a charm.

That may help you get control of the update portion, perhaps have it run at midnight on your PCs to get rid of the lag/freezing. It's not ideal but it is helpful.

I'm still waiting for more feedback on changes to my clients so I will keep this thread bumped.

*bumping the thread*

The problem continues with our users.
The symptoms make this issue difficult to track. It appears randomly to only a few users a week. The issue last for only an hour or two per user. I haven't heard an instance of a user having the problem twice. If the user has over 1GB of RAM, they don't usually notice the issue, so it's not reported.

I sent a SysInfo to Kaspersky support, and they told me that I ran it in Safe Mode (which I did NOT), so they obviously have no clue.

It's likely that users with 1GB or more don't have much disk swapping going on so they don't notice it. It's definitely more prevalent on users with 512 or so, and in some cases I have found some users with <256MB (in which case, yeah you need an upgrade).

In case anyone wants to know how to script doing a GetSystemInfo for a bunch of workstations, you can just have it run this command: "getsysteminfo.exe /s /NB /r=\\server\share\" - I have this running at many clients and have been running the outputs through the parser to see any trends. This command names each textfile after the hostname too so it's pretty helpful.

Are NIC driver updates really that helpful for Kaspersky performance in general? We're not scanning network drives in our enterprise policy so I don't see how it would be useful.

OK, I have a user experiencing the problem that defies the statements in my previous post.
He has 1GB memory and experiences the problem every day upon login.

Here's what happens (sounding like a broken record):
Upon login, avp.exe jumps to the top of the Mem Usage list in the Task Manager, usually over 140M. CPU usage will vary, but for the most part at or near the top of the list as well. It will stay up there indefinitely, slowing down all other applications significantly.
If I pause protection in Kaspersky, after about 15-20 seconds avp.exe will drop way down the list. When I resume protection, everything appears to work normally again. Avp.exe will only be using 7MB when idle, and may jump up to 25MB when I start opening programs again.
If I log out of Windows and log back in, it starts all over again.

I did a KAVlog7 trace and a GetSystemInfo and I'm sending the results to Kaspersky. I hope they don't tell me that I ran it in Safe Mode again...I'll have to switch to Panda.

Awesome, the support guy I was working with has his Out of Office message set:

"I will be out of the office until at least Wednesday February 25, 2009. I will not have access to email."

I was working with this guy 3 weeks ago. He apparently had access to his e-mail then.

In short, removing NDIS from the installer for XP machines and remove/reinstalling seems to have improved things a good bit for my users (about 60 or so in this group). They seem to be happy now. Defrags, driver updates and the like seem to make a difference, but it's definitely very small until everything comes together.

Personally I think I've been fighting perceptions the whole time, but oh well!

However the memory use is still a problem when updating. Is there any idea of why it takes 130+MB to update about 500k of files on a local drive?

*bumping the thread*

I disabled Proactive Defense globally, and I haven't heard any reports of slowness since.
This is obviously not the solution I want to use permanently, but it's holding back the angry mob for now.

I did the same thing as well. According to Support this component is not really 'antivirus' in the true sense but gets its hands on everything to see if it can find unusual behavior. They went into how I could config this, disable that and I said screw it and turned it off just to see the effect. So far so good I think.

We disabled the Proactive Defense last week, and things seem to be better as well. Still not perfect, but better.

At this point I have more disabled than enabled in this program. Sad to see when you have to turn off all the "features" just to get it to work reasonably...

New to the forum and I'll probably repeat some things, but I've experienced all of the same problems and have finally (almost a year later) fixed everything. I have about 800 clients and finally, everyone seems to be happy. First issue was the NDIS Filter incompatibility with Broadcom network cards. That was fixed by modifying the kav6.kpd file. Under the [Setup] section, the Params line was changed to:
Params=/s /v"/qn AKINSTALL=1" /pNOKLIM5=1
The /pNOK... is what prevents the NDIS Filter from being installed. I've attached the my .kpd file as a .txt. Second fix for unexplainable slowness was to disable Proactive Defense, which most of you have done, so I won't go into it. We also disabled Anti-Spy. The third thing I did which has done the most good and removed ALL reports of slowness is something that I can't believe no one at Kaspersky mentioned. Maybe I missed something or chose an incorrect setting long ago when I was first setting things up. I was setting up an unmanaged client (99% are managed so I hadn't had to do this before). I performed the install from the executable I download from Kaspersky (kav6.0.3.837_winwksen.exe). I chose all of the default settings and at the end, it said that it had created firewall rules for 40 windows executables. I NEVER saw that message when setting up the console, creating packages for deployment, or creating policies. When you create a policy, it just gives you a blank slate and you get to add rules. When I saw the 40 rules, my mouth dropped. You mean, for the past year Kaspersky has been fighting with all of these Windows files when all along it had the ability to create 40 firewall rules? I exported the rules from the unmanaged client & imported them into the polcies on the server console. The remaining unexplainable slowness reports of completely disappeared! It's amazing! I had added a few rules for Office apps before importing the 40 rules, so I left those in there, afraid to remove them and break something. I've attached my Anti-Hacker "Rules for applications". I hope this saves someone a year of anguish trying everything imaginable to get Kaspersky properly configured. Just change the extension to .ini and import the file.

Given the size of your network, don't dismiss the very likely possibility that you also been fighting cruft left over from the efforts of various admins (or you, for that matter) to address previous network issues.

Case in point:

I had one workstation where Outlook 03 would crash on exit with events pointing to the Kaspersky email scanning dlls.

After poking it with a stick for a while, I removed Kaspersky completely.

The behavior then just moved to Outlook native dlls.

I know this is a known behavior in many Outlook installations using imap, but I'm pretty familiar with the various fixes and it didn't respond to any of them.

After much head scratching, I remembered that about 18 months ago, Sharepoint blew the crap out of my OWA permissions, to the point that I was up about three days straight flailing madly and ending up in places where I really had no business, including dcom and wmi.

I *still* haven't rooted out the problem, though it's now minimized to where it crashes much more quickly on exit

I had to sit down and reflect a bit on the machine's history, and the truth of the matter is that there have been enough issues that it really needs a clean install to get back to a known point.

We only have about 40 nodes, and only about half are pc's.

If you have hundreds/thousands, and multiple admins, I really hope that you also have the policy and discipline to maintain an *accurate* change log, or at least detailed notes that are honest enough to include all the "hail mary" resolution attempts.

I m having this issue as well

All my user are angry about Kaspersky !!!

I also begin to be really tired with this shitty software

We just spent 10000 euros in this protection & i m uninstalling it from all our servers & workstations cause it kills the CPU !!!!!!!!!!

TIRED !

DO something !!