Jump to content
mrralan

[Merged again] Multiple component updates today requiring reboots

Recommended Posts

I received two updates today requiring a reboot. After the first reboot, I received another update requiring another reboot. Anyone else experience this? Let's hope Kaspersky didn't push out a problem update again.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Mod edit:

 

Important info on how to return to the standard Kaspersky update servers if you have applied the beta fix and general update info:

 

The permanent fix for the Klif.sys update error has been uploaded to our update servers.

At this time please do all of the following that apply –

1. If you update from the Administration kit, re-enable the “update application modules” in the Update section of your policy for windows workstations. This should be located in one of your groups folders, in the subgroup folder named Policies.

2. If you update from the web and do not use an Administration Kit, please re-enable “update applications modules” in the Settings of your Kaspersky interface, under Update.

a. You may also need to specify your update source directly in this case as the beta server does not contain the full list of available servers. The issue here is that the update source will not automatically switch to Kaspersky Lab’s update servers.

b. In this case please specify http://downloads1.kaspersky-labs.com/ as the update source and download from it at least one time before switching back to Kaspersky Lab’s update servers. This will allow it to pull down the full list of available update servers.

 

In all cases, the module update will cause a reboot, and when viewing the Service section of the Kaspersky interface, you should see product hotfix “g” installed.

 

Thank you,

 

Technical Support | Kaspersky Lab

Edited by Don Pelotas
Added info regarding the klif.sys fix and how to apply it (02-17-2009)

Share this post


Link to post

Yup, I Just got spammed by Kaspersky telling me that my servers need to be restarted. I wonder if there is a change log somewhere, so that I don't have to goto my manager without any information in regards to why I have to restart 59 production servers....

 

Anyone know where the change logs can be found?

Share this post


Link to post
Yup, I Just got spammed by Kaspersky telling me that my servers need to be restarted. I wonder if there is a change log somewhere, so that I don't have to goto my manager without any information in regards to why I have to restart 59 production servers....

 

Anyone know where the change logs can be found?

I was told it was a update to the IDS module.

Share this post


Link to post
I was told it was a update to the IDS module.

 

Why twice? Did the first update have an issue?

Share this post


Link to post
Why twice? Did the first update have an issue?

I think one was a module update to the IDS and the other was signature updates that required a reboot. Don't quote me but thats what I gathered from talking to tech support.

Share this post


Link to post

I also called support, and they told me it should only prompt for reboot once. I also confirmed that on one of my DEV servers, so I'm not sure why you had to do it twice. Signature updates never prompt for restart, it's only Module updates.

Share this post


Link to post
I also called support, and they told me it should only prompt for reboot once. I also confirmed that on one of my DEV servers, so I'm not sure why you had to do it twice. Signature updates never prompt for restart, it's only Module updates.

Yes, I never had a signature update require a reboot. I just got another prompt to restart. That makes 3. Two yesterday in an hour and one right now. What's going on Kaspersky?

Share this post


Link to post
Yes, I never had a signature update require a reboot. I just got another prompt to restart. That makes 3. Two yesterday in an hour and one right now. What's going on Kaspersky?

I didn't take module updates yesterday just sigs and I was still prompted to reboot.

Share this post


Link to post
Yes, I never had a signature update require a reboot. I just got another prompt to restart. That makes 3. Two yesterday in an hour and one right now. What's going on Kaspersky?

 

I am new to Kaspersky at a small business (under 100 employees), and seeing this issue too. Do I need to continue rebooting workstations, or reboot the server? How often does this type of problem happen at Kaspersky? It's very frustrating and we've just begun the migration to Kaspersky from Symantec Corporate Edition.

Share this post


Link to post

I have the same problem.

 

To make matters worse it looks like Kaspersky put out another update that is causing problems.

 

I have windows XP Pro SP2 & SP3 machines that are freezing after one of the KAV update reboots, the machines basically become a brick about a minute after the reboot. You can move the mouse but you cannot click on anything, use windows hotkeys, no keyboard, no network, no anything. The only thing that works is hold the power button in to force a poweroff.

 

I've had some temporary luck running a system restore from safemode, but as soon as KAV updates it is right back to the same problem.

 

I'm about to try uninstalling KAV on a test machine then reinstalling KAV to see what happens.

 

All 70 workstations are running windows XP Pro SP2 or SP3 with KAV workstation 6.0.3.837 hotfixs up to F, I haven't even looked at the servers yet - they should be temporarily ok since I'm the only one who reboots them.

 

I'll post any news or developments I come up with. Next stop is to log a support case.

 

regards,

 

Joe.

Share this post


Link to post
I have the same problem.

 

To make matters worse it looks like Kaspersky put out another update that is causing problems.

 

I have windows XP Pro SP2 & SP3 machines that are freezing after one of the KAV update reboots, the machines basically become a brick about a minute after the reboot. You can move the mouse but you cannot click on anything, use windows hotkeys, no keyboard, no network, no anything. The only thing that works is hold the power button in to force a poweroff.

 

I've had some temporary luck running a system restore from safemode, but as soon as KAV updates it is right back to the same problem.

 

I'm about to try uninstalling KAV on a test machine then reinstalling KAV to see what happens.

 

All 70 workstations are running windows XP Pro SP2 or SP3 with KAV workstation 6.0.3.837 hotfixs up to F, I haven't even looked at the servers yet - they should be temporarily ok since I'm the only one who reboots them.

 

I'll post any news or developments I come up with. Next stop is to log a support case.

 

regards,

 

Joe.

 

 

An update to my previous post.

 

Uninstalling KAV and reinstalling did not work, as soon as KAV updates to the current files and patch level the problem reappears.

 

At the moment I am left to uninstalling KAV from the workstations and running without A/V protection until Kaspersky support figures out the problem.

 

Regards,

 

joe.

Share this post


Link to post
I am new to Kaspersky at a small business (under 100 employees), and seeing this issue too. Do I need to continue rebooting workstations, or reboot the server? How often does this type of problem happen at Kaspersky? It's very frustrating and we've just begun the migration to Kaspersky from Symantec Corporate Edition.

 

I have been using Kaspersky for a little over a year now and this is the 4th time a component update has caused issues. The last one wasn't too long ago and it prevented Kaspersky from updating signatures. You can turn off the component updates but then you are running without the latest patches. This is unacceptable. At my last job I managed Trend Micro and it never had issues like this. Trend Micro was the easist, most reliable Anti-virus I ever set up and managed. Unfortunately, we don't have that here...at least not now.

Share this post


Link to post
An update to my previous post.

 

Uninstalling KAV and reinstalling did not work, as soon as KAV updates to the current files and patch level the problem reappears.

 

At the moment I am left to uninstalling KAV from the workstations and running without A/V protection until Kaspersky support figures out the problem.

 

Regards,

 

joe.

 

Here we're having the same problems, 15 computers with problem... also tried to uninstall, and after the first update, the problem returns.

The Kaspersky phone support is with more than 20 min waiting...

Edited by label five

Share this post


Link to post

Same problem here in our company. Since last update Windows Vista Workstations need 30 min or more to shutdown.

Share this post


Link to post
Same problem here in our company. Since last update Windows Vista Workstations need 30 min or more to shutdown.

 

Steff,

 

Just a thought.

 

Check to see if Windows update just installed KB951847 on your workstations. It is a huge update to .NET and it takes about 30 min to install.

 

Regards,

 

Joe

Share this post


Link to post

Just a question on this. If the users do not restart are new updates applied?

 

FYI, I have rebooted multiple computers after the latest updates and have not had any issues at this point.

Share this post


Link to post
Just a question on this. If the users do not restart are new updates applied?

 

FYI, I have rebooted multiple computers after the latest updates and have not had any issues at this point.

 

I believe the updates do not apply until the reboot. So if a "problem" update module is pushed it's possible the computer will not be affected if a new "corrected/fix" update is pushed to it before the reboot.

Share this post


Link to post
I believe the updates do not apply until the reboot. So if a "problem" update module is pushed it's possible the computer will not be affected if a new "corrected/fix" update is pushed to it before the reboot.

 

Thanks for the response. I have rebooted a couple of systems today and have had no issues.

Share this post


Link to post
I believe the updates do not apply until the reboot. So if a "problem" update module is pushed it's possible the computer will not be affected if a new "corrected/fix" update is pushed to it before the reboot.

 

You are correct, as long as the workstation is not restarted the problem update is not fully applied and the workstation will function normally. This is the current state of my admin workstation right now. You just have to deal with a pop-up every so often saying that the workstation needs to be restarted.

 

The rest of my workstations I opted to uninstall KAV, as users do not always listen to what they are told and do some things out of habit.

Share this post


Link to post

I got confirmed from our reseller that it is a known problem and Kaspersky is working on a fix.

 

Rgds,

Share this post


Link to post

Is there any update on this? We have been switching from Symantec Corp Ed to KAV this last week and this is huge deal breaker. It just affected our CFO and he is NOT happy which now make my life very bad as he is my boss. I am think about trying to cancel the 3yr subscription that we just signed up for last week.

Share this post


Link to post
Is there any update on this? We have been switching from Symantec Corp Ed to KAV this last week and this is huge deal breaker. It just affected our CFO and he is NOT happy which now make my life very bad as he is my boss. I am think about trying to cancel the 3yr subscription that we just signed up for last week.

 

Answers for your CFO (in order of CFO importance):

 

Lower licensing costs than Symantec even without a rebate for replacing a compettative product, if you didn't get a compettative replacement rebate from your reseller you might want to look into it.

 

When there is a problem, twenty minutes on hold for Kaspersky support is nothing. Symantec is a lot worse, I've been on hold for over an hour waiting for Symantec support.

 

Better scanning engine and removal. KAV catches more and removes more than Symantec. I was sold when Symantec couldn't clean up the CEO's kid's laptop, even in a safe-mode removal. As a last ditch effort I installed a demo of KAV, it removed most of the infections under a normal boot and the remaining infections in a safe-mode removal - things that Symantec couldn't do.

 

Faster scanning engine, scans and realtime protection do not impact user productivity. Most times they don't even notice KAV is running.

 

I made the switch from Symantec a year ago and couldn't be happier with KAV both for work and home use, my CFO is happier as well. He likes it when things cost less, they just work, and he doesn't hear people complaining.

 

When Symantec called to remind me that my service contract was expiring last year, I told them that we would not be renewing it and why - they didn't even blink, they didn't even try to keep our business.

 

Yes, Kaspersky needs to get their act together and resolve the problem with updates wrecking havoc, luckily I have only been affected by two update problems with this one being the worst. But, KAV is faster to respond to everything than Symantec is. If you think Symantec doesn't have the same issues, go back about a year and a half when an update to their scanning engine cripled most PC's and over night the time to scan almost doubled and users were very vocal about how slow their PC's were. At that time Symantec would not ackowledge that there was a problem. On the personal side, when someone comes to me saying that their PC is slow, my first question is "do you have a Symantec product" more often than not they have NIS, remove it and replace it with KIS or KAV and WOW better protection and faster scanning.

 

Not quite the same but it makes my point, search the Symantec forums for Backup Exec (yes I use it), there are lots of complaints about version updates slowing down the backup jobs. In one post a Symantec employee recomended that the user go back to the previous major version to get the speed back.

 

No transition is perfect, but hang in there you'll soon see the benefits of KAV.

 

Regards,

 

Joe

 

(an IT Manager in Silicon Valley - ya that's right, Symantec's backyard)

Share this post


Link to post
Answers for your CFO (in order of CFO importance):

 

Lower licensing costs than Symantec even without a rebate for replacing a compettative product, if you didn't get a compettative replacement rebate from your reseller you might want to look into it.

 

When there is a problem, twenty minutes on hold for Kaspersky support is nothing. Symantec is a lot worse, I've been on hold for over an hour waiting for Symantec support.

 

Better scanning engine and removal. KAV catches more and removes more than Symantec. I was sold when Symantec couldn't clean up the CEO's kid's laptop, even in a safe-mode removal. As a last ditch effort I installed a demo of KAV, it removed most of the infections under a normal boot and the remaining infections in a safe-mode removal - things that Symantec couldn't do.

 

Faster scanning engine, scans and realtime protection do not impact user productivity. Most times they don't even notice KAV is running.

 

I made the switch from Symantec a year ago and couldn't be happier with KAV both for work and home use, my CFO is happier as well. He likes it when things cost less, they just work, and he doesn't hear people complaining.

 

When Symantec called to remind me that my service contract was expiring last year, I told them that we would not be renewing it and why - they didn't even blink, they didn't even try to keep our business.

 

Yes, Kaspersky needs to get their act together and resolve the problem with updates wrecking havoc, luckily I have only been affected by two update problems with this one being the worst. But, KAV is faster to respond to everything than Symantec is. If you think Symantec doesn't have the same issues, go back about a year and a half when an update to their scanning engine cripled most PC's and over night the time to scan almost doubled and users were very vocal about how slow their PC's were. At that time Symantec would not ackowledge that there was a problem. On the personal side, when someone comes to me saying that their PC is slow, my first question is "do you have a Symantec product" more often than not they have NIS, remove it and replace it with KIS or KAV and WOW better protection and faster scanning.

 

Not quite the same but it makes my point, search the Symantec forums for Backup Exec (yes I use it), there are lots of complaints about version updates slowing down the backup jobs. In one post a Symantec employee recomended that the user go back to the previous major version to get the speed back.

 

No transition is perfect, but hang in there you'll soon see the benefits of KAV.

 

Regards,

 

Joe

 

(an IT Manager in Silicon Valley - ya that's right, Symantec's backyard)

 

Joe,

 

I don't have problem with KAV neither does my CFO - his problem is it just stopped his desktop computer from working.

 

This update problem just leaves a negative impression for me and my company with us being so new to KAV. This issue a side I really like the product; it's very flexible and easy to use. I chose it [KAV] over Symantec b/c it is smaller (cpu/ram) footprint and cheaper. I never recommend Symantec AV products to anyone personal or business -wise.

 

With all that said is there any solution yet? I basically can't leave work until this is fixed and I'm in Michigan so it going on 6:30 pm (EST). I really didn't need to spend another 11+ hr day at work.

 

Chad

 

( an IT Manager in freezing cold Lansing, MI)

Edited by pcc

Share this post


Link to post
Joe,

 

I don't have problem with KAV neither does my CFO - his problem is it just stopped his desktop computer from working.

 

This update problem just leaves a negative impression for me and my company with us being so new to KAV. This issue a side I really like the product; it's very flexible and easy to use. I chose it [KAV] over Symantec b/c it is smaller (cpu/ram) footprint and cheaper. I never recommend Symantec AV products to anyone personal or business -wise.

 

With all that said is there any solution yet? I basically can't leave work until this is fixed and I'm in Michigan so it going on 6:30 pm (EST). I really didn't need to spend another 11+ hr day at work.

 

Chad

 

( an IT Manager in freezing cold Lansing, MI)

 

Nothing official yet.

 

If the PC is bricked, reboot in safe mode and perform a system recovery. I've been rolling back to Feb. 3rd (7pm Pacific) on the handful that bricked on me and then uninstalling KAV on them and the rest of the workstations, because I haven't worked out which update caused this mess. I also stopped update distribution to the PC's for the time being.

 

Yes, the workstations are unprotected but the servers and network still are - this was the quickest since I could use a KAV admin task to uninstall KAV on all the workstations at once. Meaning I didn't spend all night at work and when everyone came in this morning everything was running.

 

If you can determine which update caused this you could rollback prior to the release of that update and disabling KAV updates so that the offending patch is not reinstalled.

 

If the PC is not bricked yet, make sure the user knows not to reboot it no matter how annoying the prompt from KAV gets and they won't have a problem.

 

The KAV admin uninstall task took no time at all, the system recoveries can take about a half hour each - your results may vary.

 

If anyone has worked out the time of the offending update or a better work around please post the information.

 

Joe

Share this post


Link to post

I just got off the phone with tech support. There is problem with IDS module that was updated. It doesn't affect every machine according to them. An official KB or update fix should be posted by tomorrow morning.

 

The only solution they could give at this point is to either:

Is to change KAV startup from "Automatic" to "Manual" through Windows services which disables KAV

OR

Go to Windows\system32\drivers and rename klif.sys to something else like klif.old which again disables File Anti-virus protection but allow the other modules ( mail, web anti-virus for example) to run.

 

Neither solution is great but at least we can access the machines again.

 

Thanks.

Share this post


Link to post
Guest
This topic is now closed to further replies.

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.