Jump to content
Mahmoudbadawy

How to Exclude Google drive file stream from scan ?

Recommended Posts

Hello!

Yes, the full path to the programm is recommended. 

What are the exact issues with the program? 

Thanks!

Share this post


Link to post

Hi Ivan,

With KES installed, Google Filestream does not work properly, windows explorer (explorer.exe) suffers closures and hangs,, and sometimes empty letter drives appear in computers.

Crash errors from Google FileStream logs:
drive_fs_main.cc:792:wWinMain Nonstandard filter drivers present: klbackupflt.sys klif.sys klvfs.sys unrecognized
drive_fs_main.cc:792:wWinMain Nonstandard filter drivers present: klif.sys unrecognized

-What are and what do the files klbackupflt.sys klif.sys klvfs.sys?
 

 

Multiple versions of Google File Stream are affected:
C:\Program Files\Google\Drive File Stream\25.1.63.1725\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.252.271.15\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.196.245.2031\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.1.85.1653\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.157.185.3\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.102.133.409\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.1.99.2312\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.157.180.325\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.157.165.2150\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.252.280.1656\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.1.53.29\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.196.245.2031\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.196.222.1747\GoogleDriveFS.exe
C:\Program Files\Google\Drive File Stream\25.1.92.1924\GoogleDriveFS.exe

 

Thanks and regards.

Share this post


Link to post

Could you please check what is the exact component that causes this behaviour? 

Please trun off each component one by one and check if the problem reproduces. 

Thanks!

Share this post


Link to post

Without KES 10 SP2 installed GoogleDriveFS.exe is working properly.

With KES 10  SP2 installed GoogleDriveFS.exe is not working properly.

The GoogleFileStream logs discussed above show error/crashes with Kaspersky libraries klbackupflt.sys klif.sys klvfs.sys.

All GoogleFileStream application components have been added to trusted applications and exclusions as you have seen in the images.

Could you explain in detail what you are referring to please with "check what is the exact component that causes this behaviour"?

What do you mean? What exactly do we have to check?

Thanks.

Share this post


Link to post

I mean that you disable all the components of KES without turning KES off in the policy or in GUI and check if the problem still occurs. 

Thanks!

Share this post


Link to post

I've done some testing on this as we have the same issue as KASVORIS.

We are using WIndows 7 x64 with Kaspersky Endpoint Security 10 (version 10.3.0.6294)

If i disable the File Anti-Virus - it works fine.

As soon as we turn on File Anti Virus module - Google file stream begins to fail, and explorer hangs when files are saved or accessed. None of the other modules affect the file stream access.

 

Edited by Peterchu_uk

Share this post


Link to post

Yep! Tried everything!

Added G:\

also tried "G:\Team Drives\"

 

Even excluded the File stream appdata directory running on C:\ under the user profile.
and program EXE located under Program files\Google\

I made sure to include sub-folders for the exclusion.

Also added GoogleDriveFS.exe to "Trusted applications" list (Using full path)

Capture.PNG.6dd0ba30ce050ed26763468a9e2f9867.PNG

It appears to be a bigger problem in Windows 7 than in WIndows 10. Problem is less noticable in Windows 10, explorer crashes randomly when accessing folder directories.

 

Please let me know if you need any additional information.

Edited by Peterchu_uk

Share this post


Link to post

Please collect the traces of KES while reproducing the issue with only the faulting comnent enabled. 

Thanks!

Share this post


Link to post

Traces from KES sent to your message box. (Sorry didn't feel comfortable posting public traces with my username in them)

 

Please let me know if i got the right "traces" for you. If not, i'll try again if you let me know where to look. :D

Edited by Peterchu_uk

Share this post


Link to post

You can post it here, upload to a file sharing ressource or send via PM to the user KLCentralSupport. 

Thanks!

Share this post


Link to post

Hello. 

Could you please try installing KES 11 and checkin whether you are able to work with Google drive file stream. 

Share this post


Link to post

Thanks, i can confirm that KES 11 + Windows 7 x64 works "better" with Google File Stream - but not completely fixed.

Making multiple read access to file stream causes system to lock up. For example - opening two files at the same time. Or opening too many files in a short space of time.

Is there no possibility of a patch for KES 10.3 to fix this relatively small issue? Upgrading an entire fleet is certainly no small task.

Edited by Peterchu_uk

Share this post


Link to post

How do i confirm if version is MR2?

All i can see is version number 10.3.0.6294. 

It appears MR2 and MR1 share the same version number??

 

Edited by Peterchu_uk

Share this post


Link to post

I will update once i have something.

I ran out of time for today. Will pick this up tomorrow. :-)

 

Many thanks for your help.

 

Share this post


Link to post

Dear Sirs, 

We continue with the same problems with KES 11.0.0.6499 and  latest versión of Google Drive File Stream (25.252.289.1553).
Google Drive File Stream release notes: https://support.google.com/a/answer/7577057?hl=en

SO: Windows 10 Anniversary Update (10.0 Build 14393)

Suddenly the GoogleFileStream despite being open has a exception.

When that happens, the logs of the FileStream show the following among other things:

    Log File: "%localappdata%\Google\DriveFS\Logs\drive_fs.txt"
    018-05-25T15:34:59.827ZI [3848] drive_fs_main.cc:780:wWinMain Nonstandard filter drivers present: klbackupflt.sys klif.sys klvfs.sys unrecognized

    Log File: "%localappdata%\Google\Software Reporter Tool\software_reporter_tool.log":
    [0525/095617.208:ERROR:scanner_sandbox_interface.cc(520)] Failed to open CSIDL_SYSTEM\drivers\klupd_klif_arkmon.sys: Acceso denegado. (0x5)
    [0525/095617.240:ERROR:scanner_sandbox_interface.cc(520)] Failed to open CSIDL_SYSTEM\drivers\klupd_klif_kimul.sys: Acceso denegado. (0x5)
    [0525/095617.240:ERROR:scanner_sandbox_interface.cc(520)] Failed to open CSIDL_SYSTEM\drivers\klupd_klif_klark.sys: Acceso denegado. (0x5)
    [0525/095617.255:ERROR:scanner_sandbox_interface.cc(520)] Failed to open CSIDL_SYSTEM\drivers\klupd_klif_klbg.sys: Acceso denegado. (0x5)
    [0525/095617.255:ERROR:scanner_sandbox_interface.cc(520)] Failed to open CSIDL_SYSTEM\drivers\klupd_klif_mark.sys: Acceso denegado. (0x5)

We do not understand why in the logs of GoogleFileStream, exceptions appear where it is referred to libraries of Kaspersky, considering that everything is put in the exclusions and in trusted applications.

Exclusions In attached images.

What can we do at this point?

Thanks a lot.

Best regards.

Kaspersky Scan Exclusions - KES 11.0.0.6499.jpg

Kaspersky Trusted Applications - KES 11.0.0.6499.jpg

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.