Hi, I've installed Kaspersky 6 for file servers enterprise on my Windows 2003 file and domain server. After that all my network drives and programs started to run slowly.
If i disable kaspersky all network drives start to run normally again.

Can someone help me??



Thank you.

Hello,

1. What version of KAV6WSEE do you have (see dialog "About" in context menu of kaspersky tray icon)
2. When you say "If i disable kaspersky..." - do you mean stopping real-time file protection task or smth else?
3. When you say "...programs started to run slowly" are you talking about programs which execute locally on the server?

1. 6.0.1.511
2. Yes when i stop real-time protection
3. i mean, if you try to use files (any kind of file, jpg, doc, xls) located on the server from any workstation it takes too much time to open, and save.

Thanks.

1. What antiviruses are installed on the client machines?
2. Does the problem persist if there is no antivirus on the client, from which you are getting access files on the server?

I'm using Kaspersky for Windows Workstations 6.0.3.837 on the clients and Avast on just 2 clients.
All clients had noticed slow performance on the server. I think the problem is some configuration or bug on Kaspersky6fse bucause it started after i installed it on the server, previously i had no problems.

1. So, does the problem persists when you touch files on server from the client where avast is installed? (This is important for us)
2. Could you make a test: in Real-time file propection task properties set Propetction mode = "Smart mode" (see attach). Does it help?

Yes, i did yesterday. Now i checked the settings and they are as same as your print Screen. See mine attached.

I tried to load Kaspesky on the file server, on the exact moment i did, the network stoped responding for 5 minutes, after it i disabled Script monitoring and leave just real-time protection working.

It works strange, like: I'm working with network files, it is normal and suddenly the network stop responding, after 1 minute it start responding again, and so on...

Now Real-time and script monitoring are disabled on my server, it is impractical work with real-time protection activated.



Do you have other ideas?
Thank youClick to view attachment.

I don't know if it can interfere on this case but, i can't open kaspersky antivirus console on any server. I just can administrate it by administration kit is it normal? Please see attached

Hello,

You should install "Kaspersky Anti-Virus 6.0 For Windows Servers Enterprise Edition Admins Tools" - it's the separate installation packet (see attach). If you install this packet on the same host where antivirus is installed, then you'll be able to run administration console from context menu of your tray icon. Or you can install this packet on any computer and administrate antivirus remotely (see admin guide).

What about delay - could you tell us about the role of you server - is it domain controller or sth else. What king of files are you opeing when delay occurs? And please, send us system info from your server (see http://www.kaspersky.com/support/kav7/tech?qid=193238548)

Thanks. I did the installation now administration console is working.
I'm monitoring my network now. Apparently the problem is fixed, but I need to do a few more tests.

Now kav 6 is working with real-time protection ON (settings as same as my previous attaches) and Script monitoring OFF and the last setup i had done was uncheck network places on real-time protection options, please see attached.

If this problem continue occurring I'll let you know.

Thank you for now.

That's great!

But you should understand, that "Network places" object in RTP propection area properties is responsible for checking files on network sources which are being accessed from the server, where KAV6WSEE is installed.

It happened again

I realize that apparently it happens when two or more users try to use the same file(s)

We use Power Builder (development tool) this morning everything was ok until two developers tried to open the same project file.
For tests proposes i open my power builder too. It was working because i was using another project, when i tried to open the same project my power builder stopped responding. I just get it working back when i stopped kav real-time protection on the server.


I think we're getting close to fix this problem. Now i know when this problem happens.

Do you have any other idea?

Thank you.

Hello,

Could you tell us about the role of you server - is it domain controller or sth else. What king of files are you opeing when delay occurs? And please, send us system info from your server (see http://www.kaspersky.com/support/kav7/tech?qid=193238548)

The most common delays are usually occuring on our system and on our development tool.
On the system it usually occurs on reports preview because all previews has pictures on it and this pictures are stored on this server.

it is totally random, i didn't find a standard for this problem.

About the server it is a DC on our domain, all policy are standard for the server, it is a TS server, Web server and file server too.

What informations generated by getsysinfo do you need? Sorry, but I can't post all generated information, there is some private informations on that file.

Thanks.

1. From sysinfo we need: list of installed applications, list of installed drivers, hardware information
2. Read this article: http://support.kaspersky.com/faq/?qid=208279636. Try to switch off iNetSwift (in this article there is a registry key, which is responsible for disabling it). Important: after you write this key in the registry, run the following commands before testing the result:
1. net stop kavfs
2. net stop klif
3. net start klif
4. net start kavfs

Please write about the result. If it won't help, delete the key from the registry and again run 4 commands.

Nope, didn't work. I tried to disable iShift and iChecker either, but the problem still happening...
I excluded all shared folders (most used) from real-time protection (i know it is not right) and for now everything is working, no more problems happening on the past 30 minutes. It means that the problem is on Real-protection.

Another thing: I don't know if this error can have influence on my case but, i saw this error on Kaspersky antivirus log using Windows event viewer:


Event Type: Error
Event Source: SystemAudit
Event Category: Application
Event ID: 6906
Date: 05/15/08
Time: 12:24:32 PM
User: N/A
Computer: XXX (name deleted for safety reasons)
Description:
The application module integrity breached.
Module name: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\KAV for Windows Servers Enterprise Edition\6.0\Dskm\upd-0607g.pbv
Reason: system registry corrupted .
Task name: Application integrity control.

It's known bug that will be fixed in next release. Don't worry this bug does not affect the anti-virus protection.

When you exclude Network places from Real time file protection (uncheck Network places) you disable checking of files that accessed by programs running on your server. For example: test.exe executes on your protected server and try to read or execute some files from some network place, for example, from other server share folder. If you check "network places" in Real-time file protection settings these files will be checked otherwise not.

You case is another case as I understand. Your developers open Power Builder project files that is stored on share folder on your protected server. In this case these project files will be checked on their original places (not by network share folder), for example, c:\projects\testApp.pbd. And will be checked with serurity settings that defined for c:\projects\ folder. In results when you unchecked Network places it doesnt affect on your situation.

We still thinking what is wrong. Please be patient.

As intermediate solution your can include all your shared folders back but add to Trusted Zone rules for problem project files (exclude by extension these files for example *.pbd)

Whats about sys info? Can you provide it?

I think I've found the problem.

Before using kaspersky i was using trend micro anti virus. I've made uninstall of the antivirus program but i let his "manager" (called Security Dashboard) installed. Today i tried to uninstall Trend Micro Manager and for now no problem has appeared. Very carefully I'm configuring some settings back like iShift and iCheker.

I'll never think that Trend Micro's manager will interfere on Kaspersky antivirus.

If the problem occur again I'll let you know

Thank you very much for your help until now!!!

Guess...

My happiness didn't take so long.

I thought Real-time was activated last Friday, but i was wrong. I was in a hurry and i don't know what let me thought that.

Resuming.

This morning at 7:30AM I've activated real-time and it worked till 9:15AM when all computer accessing network files stopped responding!! I had to manually access the server and stop real-time, after this all computers start responding again.

PS.: I've started iShift and iChecker, maybe if i disable it again. What do you think?

Please continue helping me, I'm desperate! This problem is freaking me out

Hello,

There is no necessity to disable iSwift (not iShift ) and iChecker. As I wrote earlier, try to disable iNetSwift - for this read this article: http://support.kaspersky.com/faq/?qid=208279636. In this article there is a registry key (at the end of article), which is responsible for disabling iNetSwift. Important: after you write this key in the registry, run the following commands before testing the result:
1. net stop kavfs
2. net stop klif
3. net start klif
4. net start kavfs

I've tried this already. It didn't work.
I'll try it again now with Trend Micro Totally uninstalled.

Didn't work.

A Techsupport from Kaspersky Brazil told me to try changing my version from Kav 6 for File Server Enterprise edition to Kav 6 for file server.

What do you think about this, can it work?

Hello,

Of course it is very complicated question for me, but in your situation may be it could be a decision. There are some technological differenses between these two products. KAV6WSEE have been released later and it's functionality is wider, that's why your problem may not be present in KAV6.

We already have several issues about delays when shared files access performed. So now we are preparing new MaintenancePack for release, where serious improvement in driver have been done (bugfix and performance). So you can try to install KAV6 for now, but we'll inform you about appearance of new forum builds of KAV6WSEE (I suppose it could be in some weeks), and you'll be able to test it on your environment. We'll very appreciate if you do this, so we could be ensured that your problem has been fixed.

Thank you for your understanding.

Hello people!!
I've uninstalled KAV 6 for file server EE and installed KAV 6.0 for file servers only.
For a day i get no more problems.
Maybe the problem is on Enterprise Edition.

Thank you for helping me.

I'm having the exact same problem as you.

The server is a:
Windows 2003 64bit
Domain Controller
DNS
DHCP
File & Print

Install version Kaspersky 5.0.77 64bit.

My issue is almost identical. When realtime protection is running the server access is extremely slow. Users notice it opening and saving documents. Mainly its when they save a document. Word and Excel mostly.

This server had Symantec, I uninstalled it and ran the nonav piece but to no avail.

I'm hoping there is a real resolution to this.

Also, where do I get administration console for the file server so I can interact with it without using administation server entirely.

I'm actually going to make this a seperate topic.