Jump to content
normanHSDad1

Kapersky blocks valid application with access database after update on 04/09/2014

Recommended Posts

I have a VB6 program that utilizes an Access database. As soon as the Kaspersky databases were updated today, I can no longer run my VB6 program.

The error message I get is "Cannot Open Database. It may not be a database that your program recognizes, or the file may be corrupt."

 

Several of my coworkers using Kaspersky are having the same problem after today's update. Until Kaspersky databases were updated, all was OK.

 

Any help would be appreciated.

 

Thanks,

 

Norman

 

**********

Updated by Kaspersky Lab

**********

Please, see this post with possible fix and instructions: http://forum.kaspersky.com/index.php?s=&am...t&p=2218257

**********

Rolled back databases are on update servers. Please, run databases update, it should prevent occurring the issue. If system.mdb (0 bytes) exists on the system - it was created by our Kaspersky AV and should be deleted.

It can be safely deleted manually (but only if it's 0 bytes size!). Our engineers are working on the standalone utility to scan and delete the file automatically from affected PCs. http://forum.kaspersky.com/index.php?s=&am...t&p=2218402

**********

Official reply from Kaspersky Lab:

 

"We've created and tested the utility to rename zero system.mdb file - instructions can be found below in this post.

Please, do not change system registry - it's much more dangerous way.

 

On behalf of KL dev team I want to apologies once again.

We have a lot of test cases and test procedures for updatable modules but the following specific case wasn't covered.

 

We will improve our test procedures learning this lesson but also believe it's important to explain the reason of the issue and be transparent for our customers.

 

The reason of the issue is the following:

1) yesterday we updated "system watcher" protection module of Kaspersky security products,

2) this module analyses behavior of the running application in the system to proactively detect new malware,

3) but because this detection is at-runtime, not at-startup some files and registry keys can be already modified/deleted at the moment of detection,

4) this is why system watcher makes backup copies of files/keys before modification by unknown applications run in the system.

 

The real issue:

5) unfortunately, there was a bug in this functionality related to a rare case when an application tries to open file for writing which does not exist.

System watcher makes a backup copy of this non-existing file but opens file for reading with mistaken attributes (OPEN_ALWAYS instead of OPEN_EXISTING) - this results in creating a new file with 0 bytes size.

 

6) MS JET (at least 3.5 and 4.0) tries to read SystemDB file and if it simply doesn't exist - continue its work. But if the file exists with unexpected internal structure - JET stops working with an exception (it's not a right behavior but JET is older than Windows XP). "

**********

Instruction how to restore application functionality:

 

1. Update the product

2. Find catalogue with affected(crashing) application

3. If zero sized «system.mdb» file created today exists in the catalogue then remove or rename it (for example into «system.mdb_backup»)

 

The steps described can be performed by administrators themselves by implementing a script that can run on all machines in a network.

If for any reason the catalogue with the application is unknown or it is impossible to implement such script then console utility «MdbFix.exe».

 

MdbFix.exe utility description:

 

The utility is searching for zero sized «system.mdb» file created after 09.04.2014 00:00 GMT+0 in all catalogues of all local disks. If such file is found it gets renamed into «system.mdb._kav.bak»

The utility is reporting about all made actions into its log and console. By default the log is getting created on system disk root or alternatively a path can be set through the following key: –l <path_to_the_log >

**********

We fixed the problem via AV databases update.

Now it's not necessary to use MdbFix.exe tool.

MdbFix.zip

Share this post


Link to post

Even I am facing the same error in all my programs utilizing Access database. This is also occuring to other users since today. There is file called System.mdb with size 0KB. If I pause protection and rename System.mdb file the program works without Run Time Error 3049.

Edited by Ganesh iyer

Share this post


Link to post

Same here.

 

We use access database also and have narowed down problem to JET and MS dll's in system32 folder.

 

I have posted problem in topic before, bu here are details:

 

Dear everyone.

 

We are vendors for small application writen in Visual Basic 6 based on MS Access 2000 database.

 

We received a lot of complaint after update this morning on 04/09/2014 (wednesday) that they cannot connect application to database.

 

After carefull examination we established that kaspersky blocks some of Microsoft JET components in system32 folder (of x86 machines) because when we stop antivirus protection of Kaspersky and reinstall aplication, everything works fine until we start kaspersky again and run application for the first time after, it blocks.

 

Application uses JET engine 3.5 or 4.0 version, it is based on DAO recordset communication with databases.

 

Error our application gets is:

 

"Cannot open the Microsoft Jet engine workgroup information file"

 

witch has no sence because we use single file access database and no workgroup information file.

 

Interesting thing is that after unsuccessfull start of an application suddenly there is system.mdb file by executable of application, but 0 bytes in size.

 

There is virtualy no possibility that there is virus in our application or in dlls that enables database communication. Our application itself runs, but shows no database

 

Please help.

 

Domagoj

Share this post


Link to post
Even I am facing the same error in all my programs utilizing Access database. This is also occuring to other users since today. There is file called System.mdb with size 0KB. If I pause protection and rename System.mdb file the program works without Run Time Error 3049.

 

Ganesh,

 

Thanks very much for your reply. That solved the problem right immediately.

 

Best Regards,

 

Norman

Share this post


Link to post

Same here.

 

We have an VB6 Application using JET 4.0 to connect to an Access MDB without a system.mdw.

 

When we deactivate Kasperky, the program runs well.

When Kaspersky is running, we get the error "Cannot open the Microsoft Jet engine workgroup information file"

 

please help

 

Martin Roling

Share this post


Link to post

Hello!

Could you please diagnose which component exactly causes issues?

To do so, please disable all protection components, then enable them one by one and check if the issue persists each time.

Thank you!

Share this post


Link to post

Hi all,

 

Could you check, please, if the problem is reproduced if System Watcher component is disabled?

Share this post


Link to post
Hello!

Could you please diagnose which component exactly causes issues?

To do so, please disable all protection components, then enable them one by one and check if the issue persists each time.

Thank you!

 

I'm having the same problem. It's being caused by the system watcher protection. If I disable that (but not any of the others), the problem goes away.

Edited by Alex Jerebtsov

Share this post


Link to post

Same problem here, and several hundred of calls to the support for our applications.

 

The temporary solution is working, but it is a work around, and not a final solution.

 

We are loosing a lot of money with this problem....

Share this post


Link to post
I'm having the same problem. It's being caused by the system watcher protection. If I disable that (but not any of the others), the problem goes away.

 

If we deactivate 'Aktivitätsmonitor', all works fine.

Share this post


Link to post

After deleting system.mdb file with zero bytes in the same folder as the executable and disabling System Watcher, all works fine.

(If we only disable system watcher, the problem persists, MUST also delete system.mdb which gets created IFF System Watcher is enabled.)

Hopefully, this problem will get fixed soon so we can re-enable system watcher...

Edited by Norman S.

Share this post


Link to post

We are also a vendor of a programme written in VB6 using access 2000 and have exactly the same problem.

 

64 bit machines create the system.mdb in the SysWow folder

 

Deleting / renaming system.mdb and disabling system watcher stops the problem

Share this post


Link to post

We have the same problem. Is there any solution in progress without deactivate "Working Monitor" or "Aktivitätsmonitor"?

Will there be an official update soon?

 

Thanks!

Share this post


Link to post
We have the same problem with vb6 and access97.

:dash1:

Same problem with vb6 and access 2003 :icon20:

Share this post


Link to post

Thank you all for the provided information! Our developers are investigating the issue. We'll let you know when there is any news.

Share this post


Link to post

Hello friends, we have a qick fix for the problem.

 

Who is ready to try?

it's necessary to:

- disable self-defence (see instructions for KIS 2014: http://support.kaspersky.com/10239)

- unload product

- replace file "%allusersprofile%\Kaspersky Lab\%your-product-name%\Data\sw2.xms" with file from attachment (unpack it first)

%your-product-name% depends on the installed Kaspersky product. In my case: AVP14.0.0

- start product

- enable self-defence

- check if problem reproduces

sw2.zip

Share this post


Link to post

Not real sure why this was moved from the Business forum as it's happening to hundreds of our work workstations.

Share this post


Link to post

We have received the same error from more than 200 customers with a VB6 application and Access97 database.

We NEED a quick resolution!

Share this post


Link to post
Hello friends, we have a qick fix for the problem.

 

Who is ready to try?

it's necessary to:

- disable self-defence

- unload product

- replace file "%allusersprofile%\Kaspersky Lab\%your-product-name%\Data\sw2.xms" with file from attachment (unpack it first)

%your-product-name% depends on the installed Kaspersky product. In my case: AVP14.0.0

- start product

- enable self-defence

- check if problem reproduces

 

The file is locked: "Access denied". Should we de-install KAV?

Share this post


Link to post
We have received the same error from more than 200 customers with a VB6 application and Access97 database.

We NEED a quick resolution!

 

Fix is on the way to public servers.

 

Share this post


Link to post

Same Problem: I am Admin on the System, but the file is locked. The entire Fodler is not writeable, even by starting the cmd.exe with admin rights. The Windows Function to take over rights does not work!

Edited by Wanders999

Share this post


Link to post

Colleagues,

 

could yo please specify the exact environment for problem reproduction?

Especially any third-party software which is involved into problrm

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.