Jump to content

Recommended Posts

Getting a lot of these lately multiple machines. Ideas?

 

Event type: Task cannot be performed

Result: Unable to start tasks

Object: NT AUTHORITY\SYSTEM

Object\Name: SYSTEM

Size: 2 GB

Reason: Connection failed, physical error

 

 

 

Event type: Action blocked by Self-Defense

Application\Name: KLNAGENT.EXE

Application\Path: C:\Program Files\Kaspersky Lab\NETWORKAGENT\

Application\Process ID: 2712

Application\Options: "C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe"

Component: Protection

Result\Description: Blocked

Action: Modify

Object: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\KES8\Report\connector.rpt

Object\Type: File

Object\Path: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\KES8\Report\

Object\Name: connector.rpt

Edited by Sparkey70

Share this post


Link to post

Actually, we are dealing with the same issue (self defense blocks KLNAGENT modification of connector.rpt), and it may be tied to more than just the connection errors. We have been having random systems show "error updating component (KLAVA)" when running an update task from policy, other systems yield a "black list of licenses is corrupted or not found" error, and yet others having an "error in interaction with KSC" connection error. Those exact email notifications are listed below for the sake of documentation:

 

 

Event Error updating component happened on computer XXXXXX in the domain $$$ on Friday, May 04, 2012 9:12:29 AM (GMT-05:00)

Event type: Error updating component

Result: Error updating component

Object: KLAVA

Object\Path: KLAVA

Object\Name: KLAVA

 

--------------------------------

 

Product: Kaspersky Endpoint Security 8 for Windows Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)

Computer: XXXXXX

Domain: $$$

 

Notifications:

Critical event: 5/14/2012 7:29:22 AM:

Event type: Black list of licenses is corrupted or not found

Application\Name: Kaspersky Endpoint Security 8 for Windows

Component: Protection

Result\Description: Invalid key file

 

----------------------------------

 

Event Error in interaction with Kaspersky Security Center happened on computer XXXXXX in the domain $$$ on Monday, May 14, 2012 8:24:01 AM (GMT-05:00)

Event type: Error in interaction with Kaspersky Security Center

Result: Failed to receive file

 

----------------------------------

 

 

On ALL of our systems, we see the klnagent.exe action blocked by self-defense, but on clients that show the errors above, the klnagent.exe block is usually the most recent error, usually between 1 and 15 minutes before the others occur. They may not be related at all, given that not all clients exhibit the above errors every day. We have an open ticket with Kaspersky on both the klnagent error and the others, and we were asked to enter exclusions in the policy for the klnagent.exe file and the connector.rpt file, and see what happens. Instead we have temporarily disabled self-defense, and tomorrow we'll see if we receive any errors. I will try and remember to post the results here.

 

 

 

Share this post


Link to post
Actually, we are dealing with the same issue (self defense blocks KLNAGENT modification of connector.rpt), and it may be tied to more than just the connection errors. We have been having random systems show "error updating component (KLAVA)" when running an update task from policy, other systems yield a "black list of licenses is corrupted or not found" error, and yet others having an "error in interaction with KSC" connection error. Those exact email notifications are listed below for the sake of documentation:

Event Error updating component happened on computer XXXXXX in the domain $$$ on Friday, May 04, 2012 9:12:29 AM (GMT-05:00)

Event type: Error updating component

Result: Error updating component

Object: KLAVA

Object\Path: KLAVA

Object\Name: KLAVA

 

--------------------------------

 

Product: Kaspersky Endpoint Security 8 for Windows Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)

Computer: XXXXXX

Domain: $$$

 

Notifications:

Critical event: 5/14/2012 7:29:22 AM:

Event type: Black list of licenses is corrupted or not found

Application\Name: Kaspersky Endpoint Security 8 for Windows

Component: Protection

Result\Description: Invalid key file

 

----------------------------------

 

Event Error in interaction with Kaspersky Security Center happened on computer XXXXXX in the domain $$$ on Monday, May 14, 2012 8:24:01 AM (GMT-05:00)

Event type: Error in interaction with Kaspersky Security Center

Result: Failed to receive file

 

----------------------------------

On ALL of our systems, we see the klnagent.exe action blocked by self-defense, but on clients that show the errors above, the klnagent.exe block is usually the most recent error, usually between 1 and 15 minutes before the others occur. They may not be related at all, given that not all clients exhibit the above errors every day. We have an open ticket with Kaspersky on both the klnagent error and the others, and we were asked to enter exclusions in the policy for the klnagent.exe file and the connector.rpt file, and see what happens. Instead we have temporarily disabled self-defense, and tomorrow we'll see if we receive any errors. I will try and remember to post the results here.

 

Ditto on the errors... Thanks and I hope you find a solution.. I have since upgraded (with some success) the newest agent the KSC and endpoint. Hopefully we can find an answer.

 

Share this post


Link to post
Ditto on the errors... Thanks and I hope you find a solution.. I have since upgraded (with some success) the newest agent the KSC and endpoint. Hopefully we can find an answer.

 

 

Wow a new one today.. I cannot figure out wtf the d@mn thing is trying to do or not do but attack itself and cause itself more harm than good. Maybe Kaspersky find itself is its own virus.. Weird when I remove the product completed the machine works like a brand new computer and not 7 years old!

 

Event type: Action blocked by Self-Defense

Application\Name: CS ADMIN KIT.MSC

Application\Path: C:\Program Files (x86)\Kaspersky Lab\KASPERSKY SECURITY CENTER CONSOLE\

Application\Process ID: 3024

Application\Options: "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center Console\CS Admin Kit.msc" -32

Component: Protection

Result\Description: Blocked

Action: Modify

Object: REGISTRY\USER\S-1-5-21-2528526332-954969253-3045190492-6118\SOFTWARE\KASPERSKYLAB\PROTECTED\KES8\WINDOWS\DEVICECONTROL_TEMPLATESDLG\BODY.BODYEX#DATA

Object\Type: Registry key

Object\Path: REGISTRY\USER\S-1-5-21-2528526332-954969253-3045190492-6118\SOFTWARE\KASPERSKYLAB\PROTECTED\KES8\WINDOWS\DEVICECONTROL_TEMPLATESDLG\

Object\Name: BODY.BODYEX#DATA

Share this post


Link to post
Wow a new one today.. I cannot figure out wtf the d@mn thing is trying to do or not do but attack itself and cause itself more harm than good. Maybe Kaspersky find itself is its own virus.. Weird when I remove the product completed the machine works like a brand new computer and not 7 years old!

 

Event type: Action blocked by Self-Defense

Application\Name: CS ADMIN KIT.MSC

Application\Path: C:\Program Files (x86)\Kaspersky Lab\KASPERSKY SECURITY CENTER CONSOLE\

Application\Process ID: 3024

Application\Options: "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center Console\CS Admin Kit.msc" -32

Component: Protection

Result\Description: Blocked

Action: Modify

Object: REGISTRY\USER\S-1-5-21-2528526332-954969253-3045190492-6118\SOFTWARE\KASPERSKYLAB\PROTECTED\KES8\WINDOWS\DEVICECONTROL_TEMPLATESDLG\BODY.BODYEX#DATA

Object\Type: Registry key

Object\Path: REGISTRY\USER\S-1-5-21-2528526332-954969253-3045190492-6118\SOFTWARE\KASPERSKYLAB\PROTECTED\KES8\WINDOWS\DEVICECONTROL_TEMPLATESDLG\

Object\Name: BODY.BODYEX#DATA

 

There's definitely something wrong with the Self-Defense component. We ran with self-defense disabled all day yesterday, and things seems to go much smoother, although we moved all managed computers to a virtual admin server and I'm not sure if we have all the notifications set up correctly yet, so I might just be flying blind. I have done some checking through the critical events though, and it was much cleaner than usual. Another day or two should paint a better picture.

Share this post


Link to post
There's definitely something wrong with the Self-Defense component. We ran with self-defense disabled all day yesterday, and things seems to go much smoother, although we moved all managed computers to a virtual admin server and I'm not sure if we have all the notifications set up correctly yet, so I might just be flying blind. I have done some checking through the critical events though, and it was much cleaner than usual. Another day or two should paint a better picture.

 

 

So you disabled the self defense?

post-398902-1337266484_thumb.jpg

Edited by Sparkey70

Share this post


Link to post

I am seeing the same thing on some of my machines but not all. The machines having this issue are at one location and are all Windows XP machine. I am going to attempt an install on a Windows 7 machine at the same location to see what the result is. Other locations that have KES 8.1.0.831 installed on Windows 7 all update fine with no errors.

Share this post


Link to post
So you disabled the self defense?

 

Yep, we disabled, but although the frequency of update errors seems to have been reduced, I did receive one today. Our interaction errors have also been minimized but not eliminated. We're going to run this way for a little longer, then switch back to enabled self-defense and see if errors pick up again.

Share this post


Link to post
we have also the same errors, and we want self defense active...

 

same errors here. and we also want to keep the self defense active

Share this post


Link to post

We completed our testing with enabling and disabling self-defense, and it does not seem to be the culprit for most of the issues I listed above. Here is what we know:

 

1. Disabling self-defense stops the KLNAGENT errors as expected. We'll have to look at a policy exclusion to prevent this from happening without disabling self-defense.

 

2. Interaction errors with KSC do not seem to be tied to self-defense in any way. They happen occasionally (for us), and do not seem to negatively affect anything. We have about 165 systems and we receive between 0 and 2 a day. This is one of our pending issues with Kaspersky, but I'm guessing we'll just need to ignore them unless they become more frequent.

 

3. KLAVA update errors seem to happen a few minutes after the first successful update after bootup. We have an update task that is scheduled to run miss tasks, so on boot it runs the update. The first update succeeds, but then the event log shows it scheduled again, and it runs about 10 to 15 minutes later, and fails updating the KLAVA object, whatever that is. This is one of our pending issues with Kaspersky, and does not seem to be tied to self-defense.

 

4. Blacklist errors happen with computers that have not been on in a long time. If an update fails when this error occurs, subsequent errors seem to resolve the problem. Not tied to self-defense.

 

I hope this helps.

Share this post


Link to post
Getting a lot of these lately multiple machines. Ideas?

 

Event type: Task cannot be performed

Result: Unable to start tasks

Object: NT AUTHORITY\SYSTEM

Object\Name: SYSTEM

Size: 2 GB

Reason: Connection failed, physical error

Event type: Action blocked by Self-Defense

Application\Name: KLNAGENT.EXE

Application\Path: C:\Program Files\Kaspersky Lab\NETWORKAGENT\

Application\Process ID: 2712

Application\Options: "C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe"

Component: Protection

Result\Description: Blocked

Action: Modify

Object: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\KES8\Report\connector.rpt

Object\Type: File

Object\Path: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\KES8\Report\

Object\Name: connector.rpt

 

Go to the properties on the group update task. Check the box that say's Randomize the task start with interval. Set it to like 5 min.

Share this post


Link to post
Go to the properties on the group update task. Check the box that say's Randomize the task start with interval. Set it to like 5 min.

 

 

Its set to 20 mins already

Share this post


Link to post
Its set to 20 mins already

 

 

THIS IS RIDICULOUS!!! SOME ONE FIX THIS THING!!!!!!

 

WAKE UP THIS IS JUST ONE MACHINE!!!!!!! almost a 1/4 million errors!!!

post-398902-1339081466_thumb.jpg

Share this post


Link to post

Hi all,

 

Have you been in contact with Technical support regarding this issue?

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.