Jump to content
richardstevenhack

Black.lst corrupted AGAIN - Cannot exit KAV

Recommended Posts

I am REALLY getting tired of this nonsense.

 

I rebooted a machine, KAV comes up with a dialog that says "License reminder" in the title (which is nonsense because licenses are up to date), and the message "Black.lst is corrupted. Run updater".

 

Except you CAN'T run the Updater or even get KAV to respond because it's frozen.

 

And you can't EXIT the program via Task Manager because of the system protection.

 

When in HELL is KAV going to fix this Black.lst issue. This has been going on for MONTHS!

 

If this issue is not fixed shortly, I will recommend to all my clients to dump KAV and switch to another AV solution. There is no excuse for this kind of shoddy coding.

Share this post


Link to post

Sorry you're having such a rough time Richard, my suggestion would be to make a custom policy/task for the affected machine and have it uninstall/reinstall. The issue you're experiencing is related to the machine turning off during an update, leaving an incomplete file segment necessary for the software to function. This happens infrequently if machines are powered off when an update isn't happening, but the worst can happen, especially if the machine is just unplugged during the update.

 

If you can get KAV to stop running, all you need to do is run a Repair Install on the software and it's good to go.

Share this post


Link to post

I have the same issues. It happens almost daily. I have called support multiple times and nothing they have done has fixed the issue. I have learned to live with it.

Share this post


Link to post

The issue's caused by updates being improperly timed or interrupted. If the clients update times are controlled by the Admin Kit, and updated when new updates are available in the Repository there shouldn't be a problem.

Share this post


Link to post

Me, too :-(

Every day this message appears on 2-3 different WKS.

KAV Support says, you should enable protokoll 500 if the WS ok. And stop reporting if problem occures.

But we have over 720 PCs, I don´t know how to do it? I enabled now protokoll on 3 machines and hopefully one of this machine get this error again.

Don´t know how to fix it? :-( Is it possible to enable protokoll 500 on every 700 machines for 1 day over a task? In this time min. 2 machines must get this error while reporting....

Share this post


Link to post

I followed this instruction (not helped much) but the main problem is that users annoying because of the warning message and i want to hide this message. Disabled the interaction @admin kit with user interface but message appear.

post-7944-1288163904_thumb.jpg

post-7944-1288163994_thumb.jpg

post-7944-1288164003_thumb.jpg

Share this post


Link to post
I followed this instruction (not helped much) but the main problem is that users annoying because of the warning message and i want to hide this message. Disabled the interaction @admin kit with user interface but message appear.

 

I just wanted to voice my concern as well as I have a number of users who receive this message on a regular basis. There must be an issue other than complete disruption during an update task. Like others if I could simply suppress the message it would be 'fine', but unfortunately this isn't possible.

 

kevgo.

Share this post


Link to post
I just wanted to voice my concern as well as I have a number of users who receive this message on a regular basis. There must be an issue other than complete disruption during an update task. Like others if I could simply suppress the message it would be 'fine', but unfortunately this isn't possible.

 

kevgo.

I quite agree and its only happened in the recent months, in the earlier i never seen this problem. (maybe since upgraded to workstation 6 mp4) :angry:

Share this post


Link to post

I have reviewed the logs and have noted that this issue has affected 103 of my users over the past 7 days. This by far is not acceptable, and

as Kori I have made the recommended changes as suggested by the support article.

 

I'll open an incident with Kaspersky and report back any findigns of interest.

 

kevgo.

Share this post


Link to post

Kaspersky Support suggested the following:

 

- I had a single update task for all my clients (4000) It was suggested that separate update tasks should be created for each of my groups.

 

- Update schedule should be set to every 2 hours, no 'run missed tasks', randomized every 2 min.

 

- Assign Update agents for each respective group. I asked how many would be appropriate and 100 was mentioned for 4000 clients.

 

- Network agent policy set to 60 min, turned off collecting info for installed applications.

 

I have made the above changes but continue to have users receive the black.lst messages.

 

kevgo.

Share this post


Link to post

My computer lab environment (1000 systems) uses a product called deepfreeze which upon restart erases any actions taken by students during the session. This is a great product in an education environment but not so good for AV products as machines are constantly polling and pulling numerous updates on restart. I have decided to have all the lab computers hit the Kaspersky server pool for updates. This action appears to be helping address the issue by offsetting load. A slave server may be the next step if required.

 

kevgo.

Share this post


Link to post

Many of my clients receiving the black.lst error message also give an error message stating that two tasks cannot run at the same time although there is only a single update task. Further testing showed that these error messages are due to corruption on the local client and the content in the bases and cache folder need to be deleted and another update task run to address the issue. Also.. there appears to be a higher # of incidents with machines running in a virtual environment, for instance Win 7 running on a Mac via VMWare Fusion or Parallels.

 

kevgo.

Share this post


Link to post
My computer lab environment (1000 systems) uses a product called deepfreeze which upon restart erases any actions taken by students during the session. This is a great product in an education environment but not so good for AV products as machines are constantly polling and pulling numerous updates on restart. I have decided to have all the lab computers hit the Kaspersky server pool for updates. This action appears to be helping address the issue by offsetting load. A slave server may be the next step if required.

 

kevgo.

 

DeepFreeze is a nice piece of software. I have only used it on a few PCs but there is at least one option for doing updates.

You can have a time frame (I chose an hour in the early am 0300 to 0400) where the PC is in an 'unfrozen' state. I would have updates done at that time then have the computer reboot. During that time the DeepFreeze software can point to a file that it can run at that time. I had ours point to a batch file which in turn would run other programs/updates if necessary. This type of set up worked fine for my meager set up.

 

On the black.lst issue. We have about 150ish PCs with either Win2k or WinXP (just now getting some Win7) and have a few issues every now and then with the black.lst problem. I haven't found a definite link to anything specific. It definitely could be that a PC is shutdown at that time could be ONE way to cause the issue. I know the updates can sometimes slow PCs down and people may just decide there is an issue and reboot the PC.

 

We have our Kaspersky hidden with no user action for the most part so the users do not know an update is happening.

 

The best fix I know of however, is just to uninstall and reinstall Kaspersky. That's a definite problem though, with as many PCs as some people mention they have.

 

I would wonder why it is nearly always the black.lst file that has the problem? Maybe it is one of the first files that are checked when Kaspersky initializes?

Share this post


Link to post

Thanks for the input. We have used Deepfreeze maintenance windows in the past with mixed success. Graduate students working into the wee hours of the morning would 'freeze' garbage into the machine in question. The good news with Kaspersky is that there is a command line option to force updates (avp update) which would work well in this scenario. Essentially with deepfreeze in our labs we are content with accepting the fact that definition files may be dated.

 

In terms of the black.lst issue I have no problems accepting that disrupting the update process can cause issues. Unfortunately it is much more pervasive than that in our environment and it appears to be server load related. If all of the clients attempt to update at the same time some of the requests are dropped and corruption occurs at the client level. Hopefully once this issue is cleaned up, I have enough update agents specified to prevent a reoccurrence. I was able to confirm the issue is with the clients and not a phantom server task.

 

kevgo.

Share this post


Link to post
Thanks for the input. We have used Deepfreeze maintenance windows in the past with mixed success. Graduate students working into the wee hours of the morning would 'freeze' garbage into the machine in question. The good news with Kaspersky is that there is a command line option to force updates (avp update) which would work well in this scenario. Essentially with deepfreeze in our labs we are content with accepting the fact that definition files may be dated.

 

In terms of the black.lst issue I have no problems accepting that disrupting the update process can cause issues. Unfortunately it is much more pervasive than that in our environment and it appears to be server load related. If all of the clients attempt to update at the same time some of the requests are dropped and corruption occurs at the client level. Hopefully once this issue is cleaned up, I have enough update agents specified to prevent a reoccurrence. I was able to confirm the issue is with the clients and not a phantom server task.

 

kevgo.

 

Deepfreeze: I can't remember for sure but is there an option to lock the computer during those 'unfrozen' times or does it just display a message?

 

Kaspersky: Do you set the time frame for downloading updates to allow a random interval during the set time?

Edited by LostUser

Share this post


Link to post
Deepfreeze: I can't remember for sure but is there an option to lock the computer during those 'unfrozen' times or does it just display a message?

 

Kaspersky: Do you set the time frame for downloading updates to allow a random interval during the set time?

 

 

Kaspersky: I have set a random interval of 2 minutes as suggested by Kaspersky. I believe the default is 1 min.

 

I am in the process of testing the following script which has been converted to a 'task for specific computers'. The script identifies the OS (those I am interested in), stops the avp.exe process, flushes the bases/cache folders, starts avp.exe and forces updates twice. This procedure appears to 'fix' machines which consistently receive black.lst errors. Please note I have yet to test on Vista;

 

@echo off

 

ver | find "2003" > nul

if %ERRORLEVEL% == 0 goto ver_2003

 

ver | find "XP" > nul

if %ERRORLEVEL% == 0 goto ver_xp

 

ver | find "2000" > nul

if %ERRORLEVEL% == 0 goto ver_2000

 

ver | find "NT" > nul

if %ERRORLEVEL% == 0 goto ver_nt

 

if not exist %SystemRoot%\system32\systeminfo.exe goto warnthenexit

 

systeminfo | find "OS Name" > %TEMP%\osname.txt

FOR /F "usebackq delims=: tokens=2" %%i IN (%TEMP%\osname.txt) DO set vers=%%i

 

echo %vers% | find "Windows 7" > nul

if %ERRORLEVEL% == 0 goto ver_7

 

echo %vers% | find "Windows Server 2008" > nul

if %ERRORLEVEL% == 0 goto ver_2008

 

echo %vers% | find "Windows Vista" > nul

if %ERRORLEVEL% == 0 goto ver_vista

 

goto warnthenexit

 

:ver_7

Echo Windows 7

REM Purging Windows 7 Kaspersky Database Files

net stop avp

del "C:\ProgramData\Kaspersky Lab\AVP60MP4\Bases\*.*" /F /S /Q

del "C:\ProgramData\Kaspersky Lab\AVP60MP4\Bases\Cache\*.*" /F /S /Q

net start avp

avp.com update

avp.com update

goto exit

 

:ver_2008

echo Windows Server 2008

REM Purging Windows 2008 Kaspersky Database Files

net stop avp

del "C:\ProgramData\Kaspersky Lab\AVP60MP4\Bases\*.*" /F /S /Q

del "C:\ProgramData\Kaspersky Lab\AVP60MP4\Bases\Cache\*.*" /F /S /Q

net start avp

avp.com update

avp.com update

goto exit

 

:ver_vista

echo Windows Vista

REM Purging Windows Vista Kaspersky Database Files

net stop avp

del "C:\ProgramData\Kaspersky Lab\AVP60MP4\Bases\*.*" /F /S /Q

del "C:\ProgramData\Kaspersky Lab\AVP60MP4\Bases\Cache\*.*" /F /S /Q

net start avp

avp.com update

avp.com update

goto exit

 

:ver_2003

echo Windows Server 2003

goto exit

 

:ver_xp

echo Windows XP

REM Purging Windows XP Kaspersky Database Files

"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.com" exit /password=UNB.KAV

del "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP60MP4\Bases\*.*" /F /S /Q

del "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP60MP4\Bases\Cache\*.*" /F /S /Q

"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.com"

"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.com" update

"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.com" update

goto exit

 

:ver_2000

echo Windows 2000

goto exit

 

:ver_nt

echo Windows NT

goto exit

 

:warnthenexit

echo Machine undetermined.

 

:exit

 

 

 

kevgo

 

 

 

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.