Hi

We purchased Kaspersky Open Space Security for our network of 15 XP machines and our 2000 server in September this year. I have had no issues at all with the XP machines but I have been unable to install the server version on our 2000 Sp4 server. I have been in contact for a while with the Australian vendor office who we purchased the software off and they have been working with us including requesting System info reports that they have sent to Kaspersky in Russia & to tell you the truth the Australian operation has done everything they can, the team and Russia asks a few questions, do this and that and do not really seem to have made any effort to resolve it for us. So as a last desperate attempt to resolve this I was hoping someone on the forum could assist.

The problem is - if you carry out the install, it completes and when you reboot you get no further that the Windows 2000 screen and the server sits there doing nothing. I have waited a number of hours but it gets no further. If then you boot into safe mode it takes 30 minitues to get to the desktop and the log files show no errors. The only way to get the server working again is to use the KAV removal tool.

Kaspersky in Australia requested a system info file using the getsysteminfo.zip tool, this was sent off. They came back with that they could not see any conflicts so it was sent to Russia.

Russia came back with a request that we re-install and -

“What if you disable start of KAV at system start? will the server boot faster in this case? if tell that with KAV installed the boot time takes about 15-20 min. And what time did it take without KAV? “.

I got back to them with that the server will not boot at all with KAV enabled, if I disabled KAV at system start the system would still not boot. If I removed KAV boot time was 3 - 4 minutes.

After hearing no reply for a few days I chased them up and they requested that I confirm my answers - so I did that - I confirmed the answers, I gave were my answers again - it does not boot.

Russia came back again with

“For all that - to dispel mistakes - whether the system really never start with KAV installed or it start after long delay? first submitted you claimed that the server ''has longer startup time than usually''. What is the true, in fact? Please precise this.”


So once again I confirmed what the system was doing. They came back with (after I chased them again)...So what is your answer “does the server takes too long to boot or it never boots up ? So again I confirmed what happens - it does not boot.

After chasing them again..... Russia asked if we used Windows Defender and what SuperCheck (English) 3.3.20.22 was so I confirmed that we did not use Windows Defender on the server and that Supercheck was used by our RAID card.

I chased them again and they came back with...

"Could you check if Windows Update KB954211 is installed on their server? I didn't find it in sysinfo but I ask because we got reports from customers who tell that they face similar symptoms (system never boots) on Win2K Server with KAV 6.0 FS installed and this happened since KB954211 was installed. So please kindly verify this point. Thanks"

I emailed them back to confirm that update was installed, I uninstalled it and then re-installed KAV, unfortuantly with the same result that the server does not boot.

I chased them again and on the 31st Oct they requested...

"Please ask the user to send us System & Application event logs and also ask if he is able to provide us the image of his configuration grabbed e.g. with VMware Converter tool which converts the physical system into virtual one. “

So I sent them off, and have waited and waited, and sent a couple of emails. I have accepted that I will not get any further with Russia (prehaps its the language difference) so I am now pleading for assistance off the forums. Has anyone had a issue with installing on 2000 server or a similar problem with machines not booting ??

Any assistance given would be greatly appreciated.

Thanks

Jason

Hello,

Try to remove KAV FS using this cleaner and then reinstall the latest build 6.0.3.837

After that and if you still face this issue, disable startup of all other programs and services using msconfig utility. This utility is not embedded into MS Server 2000, you need to download it.

Having similar problems to the original poster, luckily for me this is my test platform so I reinstalled the OS SP4 and fully updated it, installed 6.0.3.837 and rebooted, I then let KAV do an update and rebooted at which point it would not start up. Got past the white Windows 2000 screen to the bluey/tealy screen where it normally displays that it's starting etc. in a little window but this does not happen it just sits there with a bluey/tealy screen.

Safe mode boots ok, msconfig did not help. I've even tried it as a bare windows install, no windows updates applied (our CD has SP2 built in) but encountered the same problem.

What if you run the update during the installation process of KAV FS ? Some applications modules will be updated and need a reboot to be effective.

Otherwise I ve no other idea, you d better send the image of your system like hollands&partners did for investigation

I have had the same issue with KAV 6 fro Win Server... Machine is a Dell server / RAID 5 / running Win 2000 server SP4... KAV 6 worked well until Windoze wanted KB954211... If it installs, the system starts and ends with the teal screen. I remove this hotfix then the system starts normally.


From the Windoesn't web site re KB954211...

"This security update resolves one publicly disclosed and two privately reported vulnerabilities in the Windows kernel. A local attacker who successfully exploited these vulnerabilities could take complete control of an affected system. The vulnerabilities could not be exploited remotely or by anonymous users.

This security update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerabilities by correcting window property validation passed during the new window creation process, correcting the manner in which system calls from multiple threads are handled, and correcting validation of parameters passed to the Windows Kernel from user mode. For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information."

Kaspersky may need to revisit their code to handle this new way of handling system calls from multiple threads... or better yet, get Microsquirt on the phone and ask them "What the hell???"

Hi Jason,
In fact I am also facing the same issues with you. After installation of KAV successfully in Windows 2000 Server SP4 then reboot and go into the Windows there is no pop-up login screen up I waited for 10 minutes then still nothing comes up then decided to remove it in safe mode. So far the support site come back to you anything yet?

Rgds,
Patrick

Hi Patrick,
This is the first chance I have had to take the server off line for a few days (holiday time) and have another attack at sorting this out (I have been trusting a E series Watchguard box but this is not perfect). To tell you the honest truth the support has been hopeless. Kaspersky contacted me after my post and requested more information - I supplied it to them and never heard from them again. After searching the forums I can only guess that the best solution is to un-install the Kaspersky for file servers install and then install the Enterprise Edition, I tried this last night and had problems with the MSDE install so I have gone back to stage one and trying the file server install again.

If they came back to me and told me that they are aware of the issue and to use one version instead of another that will be fine (prehaps telling the distributors to sell one instead of another). As you can appreciate although I started the post months ago - in a server environment where the machine is in use 24X7 its a balance of when you can take the system off line for a few day to sort out and in this case christmas.

Let me know if you ever solved the issue at your end ? I will post at the end of today to see if I get any closer.

Jason

Hi again - a update.

If you remove the update KB954211 you will find that the server will not boot unless you go into safe mode - no networking. You then need to remove KAV with the removal tool, you can then reboot. I will stop trying to fault find this configuration and will go back to the Enterprise Edition & will post how I go.

Jason

Hello,

Change the "Start" parameter of KLIF service from 1 (System) to 0 (Boot) like this:



Self-Defense of KAV should be disabled to change this reg value, otherwise you will face an error.

Reboot the system and check if the issue still occur.
This has no consequences on the protection level.

Hi - are you referring to the file server edition or the Enterprise edition ? I am very interested if its the file server edition as I managed to install the Enterprise Edition and I am totally unsatafied with that version as it fails a number of the basic eicar tests.

Thanks

Jason

Hi,

I'm referring to Kaspersky Anti-Virus 6.0 for Windows Servers, I mean the "standard" version not the enterprise one.

I'm pretty sure this solution works because I faced the same issue and solved it this way.

Hi Tybilly,

worked a treat my friend - thankyou - thankyou very much!!!! Can I suggest to Kaspersky that you be appointed as head of their support area!!

The Enterprise Edition was proving to be a disaster, it only blocked one out of all the Eicar tests and the network was dropping out every five minutes (software errors an slow response). Your solution allowed the Enterprise Edition to be deleted and the "standard" installed.

I do get a services error on startup reported that KLIF failed to start - I will investigate this more however I am happy that the Eicar tests are being blocked sucessfully.

Jason

Hi,

You're welcome

Also note that this is a workaround and it may lead to some error message as you noticed, but the antivirus protection is effective which is the most important.

Perhaps this error is fixed in the next major version 8.0 of KAV FS, maybe you should test it to check that.

4 jab 2009: i just downloaded the kav 8.0.0.454 version
installed it on w2k professional SP4 and it shows the
exact same blocking behaviour on reboot after selfdefence was activated.
It also was solved by this very same remedy changing the value of this key from 1 to 0
so it seems this problem is stil not removed, and it also happens in the non-server version of w2k

It seems also relevant that during installation of the product kav8.0.0.454 ("antivirus 2009")
(upgrading from kav7) you are forced to acknowledge a disclaimer popup
telling you that installing kav8.0.0.454 ("antivirus 2009") on windows2000"is not officially supported".
:-(