• Announcements

    • Rodion Nagornov

      Недоступность форума // Forum maintenance   08/16/2017

      В связи с техническими работами форум будет недоступен с 20.00 (МСК) 18.08.2017. Максимальное время недоступности - до 20.00 (МСК) 20.08.2017. *** Due to maintenance forum will be unavailable since 8pm (+3 GMT) 18-Aug-2017. The longest possible time of maintenance - till 8.pm (+3 GMT) 20-Aug-2017.

NDIS filter and the registry fix

6 posts in this topic

Like a lot of people I've found that the NDIS Filter in KAV 7 prevents me accessing my LAN Workgroup. The usual suggestion here is to disable the filter and doing so does indeed allow me to access the Workgroup, it also looks like I'm still fully protected using Windows XP Home Edition.


However when I experienced this problem a while ago I found a technical article on the Kaspersky site that gave a fix to this problem be editing a registry value (I think it may have had something to do with the TCP/IP stack). I increased the value by 1 and could access the network Workgroup properly.


I have since added a switch and a wireless access point to the network (my machine now accesses the LAN via the switch) and I again have the NDIS filter blocking Workgroup access. I had assumed that increasing the registry value again might solve things but I am unable to find this article on the Kaspersky Support site (not helped by the fact that their Knowledge Base search appears to find nothing regardless of the search terms). I've been through all the technical articles for KAV 7 and can't find it. Is this fix no longer recommend and should I resort to disabling the filter (am I right in assuming that this will leave me fully secure under XP)?

Share this post

Link to post
Share on other sites
Thanks for the advice. It solved my problem and my home network is operating just fine now.


In the meantime I received a suggestion from Kaspersky tech support which seemed designed to maintain the NDIS filter still in place. It was far too technical for me, but I've pasted it below since it may be of use to someone else:


"Yes disable the windows firewall thats probably the propblem also try this


After you install Kaspersky Anti-Virus product version 7.0/6.0 on your PC, clients cannot access network shares. Additionally, Event Viewer on the Windows server may log one or more of the following event messages in the system log:




In order to resolve the problem, you should do the following:


Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Kaspersky Lab cannot guarantee that these problems can be solved. Modify the registry at your own risk. To resolve this behavior, increase the IRPStackSize value in the registry:


* Click Start, and then click Run.

* Type regedit, and then click OK.

* Navigate to the following key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters

* In the right pane, double-click the IRPStackSize value


If the IRPStackSize value does not already exist, use the following procedure to create it:


o in the Parameters folder of the registry, right-click the right pane.

o Point to New, and then click DWord Value.

o Type IRPStackSize.


Type "IRPStackSize" exactly as it is displayed because the value name is case-sensitive.


* Change the Base to decimal.

* In the Value Data box, type a value that is larger than the value that is listed


If you created the IRPStackSize value, the default value is 15. It is recommended that you increase the value by 3. Therefore, if the previous value was 11, type 14, and then click OK.


* Close the Registry Editor

* Restart the computer


If the problem persists after you complete the preceding procedure, try to increase the value of IRPStackSize even more. The maximum value for Windows 2000 is 50 (0x32 hex).


If you are running Windows NT 4.0, and the problem persists after you complete the preceding procedure, you may have to apply Windows NT Service Pack 4 or Service Pack 5."


Share this post

Link to post
Share on other sites

Thank you, that's the one.


I appreciate you taking the time to post it up for me :D


With Kind Regards


Share this post

Link to post
Share on other sites

Your welcome, and also see if NIC drivers need update.

Share this post

Link to post
Share on other sites

Odd, this no longer works, I've increased the value significantly with no effect. It was working perfectly prior to adding the switch and the wireless access point (with just a small increase in the IRPStackSize value). It's still an NDIS Filter issue as, if I disable it the workgroup becomes accessible.


I'll try tweaking it a bit more. My NIC drivers are the latest (WHQL, off of Windows Update with nothing more recent on the manufacturer's site).


Thanks for you help.

Share this post

Link to post
Share on other sites

Upping the IRPStackSize value (even to its maximum) no longer works (since the addition of the switch and access point) but setting KAV 7 to compatibility mode does, I can access (with I assume full security) the workgroup and keep the NDIS filter enabled.

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now