Jump to content
stinga

ATTENTION: AutoPatch "D" issues

Recommended Posts

Hi Everyone,

 

We're seeing sporadic issues on XP and Win7 computers of which the only new change is the AutoPatch. We're having to test further to determine. The issues are.

 

-Kaspersky Outlook mail checker add-in issues. Exactly similar to this fix found at Kaspersky.

http://support.kaspersky.com/kolt/?eid=207694005

 

-Long login times where no cached profile is found. If a cached profile is present there are no issues. If one is not, 10-15 minute log in times.

 

Has anyone seen any issues at all?

 

THanks,

Bruce

Share this post


Link to post

Simliar issue with Lotus Notes 8.5.1 & 8.5.2 .... this is since update.. we have over 350machines and 30% have this problem as many have not rebooted there machines today but expect all to come back with error tomorrow. This needs resolving urgently

Share this post


Link to post
Hi Everyone,

 

We're seeing sporadic issues on XP and Win7 computers of which the only new change is the AutoPatch. We're having to test further to determine. The issues are.

 

-Kaspersky Outlook mail checker add-in issues. Exactly similar to this fix found at Kaspersky.

http://support.kaspersky.com/kolt/?eid=207694005

 

-Long login times where no cached profile is found. If a cached profile is present there are no issues. If one is not, 10-15 minute log in times.

 

Has anyone seen any issues at all?

 

THanks,

Bruce

 

I've ran into the mail checker one (w/ Outlook 2007) since autopatch D was released -- however mine is a little different (not verbatim to the support article linked) -- where I attempt to attach a document from a external application and send it via outlook (or via the right-click context pane (right-click,send-to, mail recipient). Outlook will abend, and I have to restart outlook where it throws a dialog box that suggests disabling the anti-spam add-in.

 

I've opened a ticket regarding this issue (and left a voicemail this morning), but haven't received a response yet (and it's been a few days on the ticket :( )

 

Share this post


Link to post
I've ran into the mail checker one (w/ Outlook 2007) since autopatch D was released -- however mine is a little different (not verbatim to the support article linked) -- where I attempt to attach a document from a external application and send it via outlook (or via the right-click context pane (right-click,send-to, mail recipient). Outlook will abend, and I have to restart outlook where it throws a dialog box that suggests disabling the anti-spam add-in.

 

I've opened a ticket regarding this issue (and left a voicemail this morning), but haven't received a response yet (and it's been a few days on the ticket :( )

 

 

One of our symptoms is exactly that of yours. I have a case opened with them and they had said this is occurring in the cases where the client has not been rebooted since recieving the patch. The other symptom is that the client has been rebooted and the issue still occurs. They had said that it continues to appear after a reboot because the plug-in is still disabled and that enabling it will fix it. We're still testing this fix method but can say the support link above that I enclosed does fix the problem.

Share this post


Link to post
One of our symptoms is exactly that of yours. I have a case opened with them and they had said this is occurring in the cases where the client has not been rebooted since recieving the patch. The other symptom is that the client has been rebooted and the issue still occurs. They had said that it continues to appear after a reboot because the plug-in is still disabled and that enabling it will fix it. We're still testing this fix method but can say the support link above that I enclosed does fix the problem.

 

I'm still able to reproduce after re-registering the dll, and restarting the application.

Share this post


Link to post

Anyone know how to uninstall patch D?! When our computers rebooted this morning after yesterday's automatic update, we have been bombarded with issues. Previously excluded programs are getting quarantined, fatal errors printing, Outlook closing...

Share this post


Link to post

Dear All,

 

what the hell is going on. after installing patch D lots of software EXE's getting quarantine? :angry:

how do we fix this?

Share this post


Link to post

Please check which module moves this files into the quarantine. I think it´s proactive defense.

Share this post


Link to post
Please check which module moves this files into the quarantine. I think it´s proactive defense.

 

we have disabled the PD & seems to be so far is OK. what is the permenent solution for this?

Share this post


Link to post
we have disabled the PD & seems to be so far is OK. what is the permenent solution for this?

 

We got some clue about this. in PD settings there is an option call input output redirection. defualt actition set to quarantine. after set prompt actition it is asking to quarantine.

 

Dear KL please check this issue ASAP.

Share this post


Link to post

I know there is an address for false positive but I don´t remember this in the moment. I will search.

Share this post


Link to post

Dear friends, we are aware of the problem with Patch D.

Unfortunately, the error occurs with enabled proactive protection.

We are investigating the issue and will do our best to deal with it.

At the moment the only recommendation is to temporarily disable the proactive protection.

 

Share this post


Link to post

we can advice customer not to disable all sub component of PDM but only those instead :

 

input/output redirection (Application Activity Analyzer)

suspicious DNS request

 

Share this post


Link to post

Same problem whit Outloot plugin.

 

Many customer with this problem, any solution? Problem start with patch D , reboot not fix problem..

 

post-157852-1291418181_thumb.jpg

Share this post


Link to post

We are getting random Outlook crashes and a bunch of false positives as described above since installing patch D.

 

I too am curious on a status update regarding this issue?

 

Also the fix above did not solve the problem for us using Outlook 2007.

Edited by RedTechie

Share this post


Link to post

I'm running in to the same problem at my agency as well.

Unregistering and re-registering the mcou.dll and mcouas.dll files seem to fix the issue but it's really a pain to do this on a one-by-one basis.

 

Anyone have a solution that can be applied at an administrative level?

Share this post


Link to post
I'm running in to the same problem at my agency as well.

Unregistering and re-registering the mcou.dll and mcouas.dll files seem to fix the issue but it's really a pain to do this on a one-by-one basis.

 

Anyone have a solution that can be applied at an administrative level?

 

Regarding the registration of the DLL we are providing this batch file via a file share for the user to click on, not the most ideal solution but better than giving them a list of commands to run. You could technically create a package in the admin kit using this batch file but it would need to be modified. Right now it kills Outlook instead of gracefully closing it therefore I'd advise users to close Outlook first then run it. This is just posted "as is" to perhaps send you in the right direction for fixing the registration of DLL issue in bulk.

 

Interactive Version with prompts for the user:

@echo off

echo Your Outlook client must be closed, please save any open work

pause

echo Closing Outlook if Running

TASKKILL /IM OUTLOOK.EXE

@ping 127.0.0.1 -n 5 -w 1000 > nul

echo Unregister Outlook AV Modules

regsvr32 /s /u "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcou.dll"

regsvr32 /s /u "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcouas.dll"

@ping 127.0.0.1 -n 5 -w 1000 > nul

echo Register Outlook AV modules

regsvr32 /s "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcou.dll"

regsvr32 /s "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcouas.dll"

 

This is a less verbose version that could serve as a starting point for use on the admin kit. The admin kit will accept (EXE, MSI, BAT, CMD). VBscript has a method for closing Outlook properly, you could duplicate this in VBScript and compile the script for deployment via the admin kit. If you're pressed for time you could deploy "as is" and deal with any potential PST corruption that might occur from killing Outlook but I'd advise against it for use against thousands of systems.

 

@echo off

TASKKILL /F /IM OUTLOOK.EXE

@ping 127.0.0.1 -n 5 -w 1000 > nul

regsvr32 /s /u "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcou.dll"

regsvr32 /s /u "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcouas.dll"

@ping 127.0.0.1 -n 5 -w 1000 > nul

regsvr32 /s "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcou.dll"

regsvr32 /s "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcouas.dll"

 

Share this post


Link to post
Regarding the registration of the DLL we are providing this batch file via a file share for the user to click on, not the most ideal solution but better than giving them a list of commands to run. You could technically create a package in the admin kit using this batch file but it would need to be modified. Right now it kills Outlook instead of gracefully closing it therefore I'd advise users to close Outlook first then run it. This is just posted "as is" to perhaps send you in the right direction for fixing the registration of DLL issue in bulk.

 

Interactive Version with prompts for the user:

@echo off

echo Your Outlook client must be closed, please save any open work

pause

echo Closing Outlook if Running

TASKKILL /IM OUTLOOK.EXE

@ping 127.0.0.1 -n 5 -w 1000 > nul

echo Unregister Outlook AV Modules

regsvr32 /s /u "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcou.dll"

regsvr32 /s /u "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcouas.dll"

@ping 127.0.0.1 -n 5 -w 1000 > nul

echo Register Outlook AV modules

regsvr32 /s "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcou.dll"

regsvr32 /s "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcouas.dll"

 

This is a less verbose version that could serve as a starting point for use on the admin kit. The admin kit will accept (EXE, MSI, BAT, CMD). VBscript has a method for closing Outlook properly, you could duplicate this in VBScript and compile the script for deployment via the admin kit. If you're pressed for time you could deploy "as is" and deal with any potential PST corruption that might occur from killing Outlook but I'd advise against it for use against thousands of systems.

 

@echo off

TASKKILL /F /IM OUTLOOK.EXE

@ping 127.0.0.1 -n 5 -w 1000 > nul

regsvr32 /s /u "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcou.dll"

regsvr32 /s /u "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcouas.dll"

@ping 127.0.0.1 -n 5 -w 1000 > nul

regsvr32 /s "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcou.dll"

regsvr32 /s "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\mcouas.dll"

 

 

We still get the problem after running the above script or manually registering/un-registering the dll. (Windows XP, Outlook 2007)

Share this post


Link to post

I received this response from Kaspersky support:

 

the Workstation Anti-Virus patch (autopatch D) release caused Proactive Defense to mistakenly quarantine innocent files causing false-positives. We recommend to disable Proactive Defense component in the meantime until this patch is fixed; but ultimately I advise to disable this component permanently. It is a heuristics analyzer that is already embedded in other Anti-Virus components and won’t be needed. In the next Workstation AV v8.0 release (current v6.0), Proactive Defense is taken out.

 

Share this post


Link to post

PD taken out ?

What 's the h....

 

Did they think this should be a good long term solution in or deer to deal with this type of issued ?

 

Anyway , when will the next kws 8.0 launched out ?

Any clue about this new version ?

Share this post


Link to post

We have received the same sort of reply from Kaspersky support.

 

Although that explains the random false positives we received last week. It still doesn't explain the Outlook issue.

 

I don't understand how that has anything to do with Outlook crashing? We have tried turning Proactive Defense off without any luck regarding the crashes.

 

I don't think they even know what the problem is.

Share this post


Link to post

Latest email from support that I received indicates that they're still trying resolve the issue and do not have a fix for the outlook issue yet.

 

Proactive defense doesn't have anything to do with outlook crashing (at least in my case), as I've had it disabled since I Installed 6.0.4.1424.

 

Share this post


Link to post
I received this response from Kaspersky support:

That's strange, as far as i know Proactive Defense is the only tool against registry keys' modifications. If someone knows better please enlight me.

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.