Jump to content
IztokK

KAV 5.0.205 & Adobe Acrobat 6.0 Pro

Recommended Posts

I have problems with real-time VBA macros monitoring. With default KAV

settings in MS Word 2003 I can't create PDF files. If i dissable real-time

VBA macros monitoring (in KAV) everthing is OK. If I change Calling to API function I still can't create PDF files. :(

 

Regards,

 

Iztok

 

PS: Support in Slovenia and at support@kaspersky.com is very bad. They don't know how to solve this problem!!!!! :( :angry:

 

 

Here is report from Macros execution monitoring:

 

 

C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PDFMaker.dot Macros is trying to execute a potentially dangerous macro command API function 'RegCreateKeyExA' from library 'advapi32.dll' 4.8.2005 10:50:38

 

C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PDFMaker.dot Execution of a potentially dangerous macro command API function 'RegCreateKeyExA' from library 'advapi32.dll' of macro was blocked 4.8.2005 10:50:38

 

C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PDFMaker.dot Macros is trying to execute a potentially dangerous macro command API function 'RegSetValueExA' from library 'advapi32.dll' 4.8.2005 10:50:38

 

C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PDFMaker.dot Execution of a potentially dangerous macro command API function 'RegSetValueExA' from library 'advapi32.dll' of macro was blocked 4.8.2005 10:50:38

Share this post


Link to post
I have problems with real-time VBA macros monitoring. With default KAV

settings in MS Word 2003 I can't create PDF files. If i dissable real-time

VBA macros monitoring (in KAV) everthing is OK.  If I change Calling to API function I still can't create PDF files.  :(

 

Regards,

 

Iztok

 

PS: Support in Slovenia and at support@kaspersky.com is very bad. They don't know how to solve this problem!!!!!  :(  :angry:

Here is report from Macros execution monitoring:

C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PDFMaker.dot Macros is trying to execute a potentially dangerous macro command API function 'RegCreateKeyExA' from library 'advapi32.dll' 4.8.2005 10:50:38

 

C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PDFMaker.dot Execution of a potentially dangerous macro command API function 'RegCreateKeyExA' from library 'advapi32.dll'  of macro was blocked 4.8.2005 10:50:38

 

C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PDFMaker.dot Macros is trying to execute a potentially dangerous macro command API function 'RegSetValueExA' from library 'advapi32.dll' 4.8.2005 10:50:38

 

C:\Program Files\Microsoft Office\OFFICE11\STARTUP\PDFMaker.dot Execution of a potentially dangerous macro command API function 'RegSetValueExA' from library 'advapi32.dll'  of macro was blocked 4.8.2005 10:50:38

 

I had a problems with old version from Workstation (<5.0.177). Now I have 5.0.200 and Macroprotection: "Call API-Function" Action=Ask

Share this post


Link to post
I had a problems with old version from Workstation (<5.0.177). Now I have 5.0.200 and Macroprotection: "Call  API-Function" Action=Ask

 

Hello!

 

I have 5.0.205 and Calling to API function - Allow macro command execution and I still can't create PDF files. :(

 

Iztok

Share this post


Link to post

What now? :unsure:

 

Nobody (Support in Slovenia, at support@kaspersky.com and on this forum) knows how to solve my problem!! :o

 

 

Should I change AV? :unsure:

Share this post


Link to post
IztokK, what happens if you use the "High speed" setting in macros.

 

Hello!

 

Works, but KAV pop-up windows with 'Attention! An atempt to execute a suspicious macro detected!'. Six times per one PDF! :unsure: Too many pop-up windows!!

My virus protection is set to minimum. Not only for Macros, but also for files. KAV now scan only all infectable files (default settings All files) and exclude Archives. :o

 

Regards,

 

Iztok

Share this post


Link to post

i guess you just have to play a bit with those macro rules and find the rule that is making you the problem, then simple set it to allow. i dont see no other options. however you should know that even if you turn off this advance macro protection (officeguard) you will still have the standard signature and heuristics based protection... if you are in ljubljana i can come and give you a hand ;)

Share this post


Link to post

Hello!

 

I found solution:

 

Set Allow macro command execution for next commands:

- Access to ActiveX object

- Calling to API function

- Creating ActiveX object on a remote computer

- Deliting files

- Opening file for writing

 

30 minutes for finding solution. This is job for support not for users!!!

Share this post


Link to post
30 minutes for finding solution. This is job for support not for users!!!

 

well i dont know if you are right...

 

the fact is that office guard is only part of kav pro and kav wks, both of this products should be used by advance users that should have the knowladge and experiance to setup the advance settings in this products.

 

additionaly the people at KL dont know what kind of files and macros their users are using, so they are not able to give you a direct solution.

 

however it is true that it would be good if the support would work a bit more active with the users to find the solution. but we got a promise that they are working on this isue and i have to say that i have the filling things are slowly getting better ;)

 

another thing i can add to this is that by setting all of those rules to "allow" is almost the same as if you turn off the advance macro protection completly.

Share this post


Link to post
well i dont know if you are right...

 

 

 

additionaly the people at KL dont know what kind of files and macros their users are using, so they are not able to give you a direct solution.

 

 

 

 

This is standard and all known file PDFmaker.dot from Adobe. Not just one unknown file. In this file are all macros for creating PDF files.

 

however it is true that it would be good if the support would work a bit more active with the users to find the solution. but we got a promise that they are working on this isue and i have to say that i have the filling things are slowly getting better

 

2 or 3 years ago KAV has great support, I don't know why is now support very bad?

 

another thing i can add to this is that by setting all of those rules to "allow" is almost the same as if you turn off the advance macro protection completly.

 

OK, tell me better solution.

Share this post


Link to post

Why I can't exclude files (like PDFmaker.dot) in macro tab and all macro commands from this files. This would be great solution. If this is possible?

Share this post


Link to post
Why I can't exclude files (like PDFmaker.dot) in macro tab and all macro commands from this files. This would be great solution. If this is possible?

 

yes i was thinking about the same thing... setting all this rules to allow is not the best solution since by this you lower the protection level. but it seems as this is the only solution at the moment. this is why i agree with you that it would be extremly importaint to be able to exclude by file just like we are able to exclude it with the normal signature based detection (exclude by file and/or verdict). i think it is possible to do this in the kav/kis 2006, but it seems in kav5 this is not possible...

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.