CF93

And it’s STILL not fixed by Kaspersky. Ridiculous. This free product was designed to market Kaspersky products and convince small businesses to buy the full solution. That’s a laugh. Hi! Sorry again for that failure. It will be completely fixed in upcoming update. We need additional time to implement the fix and test it thoroughly. Did you get the BSOD on last product update to 3886(i) version? Thanks. Hello, I’m happy to read that the problem is solved at last. Can you tell us what are all the causes and consequences of this problem when it strikes a computer ? Are the consequences identical on all Windows OS and serser version ? It would be good to know this in order to restore a computer correctly. Thank you for your help

Hi, this is a good news but Kaspersky is very late on solving this bad problem. I wonder how many people have been impacted in the world before a solution...

@pdwk and you have done a great work on this topic and it has helped me a lot too, thank you. For my tests, regarding the second setup of KART on my VM, despite the KART update notice, Windows log says that there was no update and KART is not updating yet.

LOL. So it was. Oops. I checked again and there is NO LowerFilters on any of our 2016 installations. Those servers have also never been touched by KART so I am confident that there is no LowerFilters entry by default. Hello, Thank you for your answer, you have been quicker than be, I was doing some testing on a VM yesterday and today :-) So I've seen too that on a fresh setup of Windows 2016 there is no LowerFilters regkey, there is only the UpperFilters as you say. I join a pdf with the number of files into Catroot/Driverstore folders/subfolders and the VSS regkey values of this fresh setup. I add that "UpperFilters REG_MULTI_SZ volsnap" is the default value but backup softwares can add there value to this key too, so if there are not working with this value, their value must be added too. On my VM, I have also tried to setup KART again... and it harms again... On my prod server, I've seen that the b*st*rd update was installed on 11/03/2021, it has made my server unbootable after reboot on 02/04/2021 with "critical service failed" bsod. I have restored my server many times until 08/04/2021 before suspecting KART and deleting it from the OS (my worst 2 weeks of the year), and now I have banned KART to hell forever with all Kaspersky stuffs ! Because it seems that, more than a month after, maybe nothing has been done by Kaspersky to solve this... On my VM, I've used KART_4.0.0.861.0.4497162.0_en_US.exe (version 3.0.1.1807) for the setup, the same setup I used a year ago to install it on my prod server. I've made the setup twice : -On the first setup yesterday, I have seen a KART update notice some minutes after the end of the initial setup and the UpperFilters regkey has disappeared before reboot but the files into catroot and Driverstore hasn't been deleted even after many reboots. KART version is 3.0.1.861 (or 3.0.1.3660 on properties) after the update. -On the second setup today, after the update notice after the end of the initial setup, the UpperFilters regkey and the files into catroot and Driverstore hasn't been deleted even after reboots but the KART version has not changed (still 3.0.1.1807 after "update")... I've joined some screenshots of all this. I will try to monitor the VM on the next days. For the joke, one year ago the 01/04/2020 my prod server was crypted by a ransomware and this is why I installed KART on it... this year the 02/04/2021, KART has corrupted my server, so ransomware and antiransomware are allied... I hate these April Fools...

Thanks for your good advice, I will try this and tell the result if no one can answer.

More info for this : https://community.kaspersky.com/kaspersky-anti-ransomware-tool-for-business-4-0-74/any-connection-between-kart-5-3660-and-bsod-critical-service-failed-16041

Again I agree. I *know* it was KART directly causing the issue (ProcMon log), but the reason why remains a mystery. Since its internal workings are unknown, maybe it thought it was protecting my servers and workstations from a ransomware attack. Maybe a Windows Update updated/changed just the right amount of files that triggered KART to “protect” me. After our environment became “normal” again I spent some time trying to replicate the issue. I had Reflect backups of two machines from a week prior to the problem so I restored those and tried to let the problem re-occur. It never did. Windows updated as expected, KART updated and everything worked normally. I also installed Win10 in a VM and installed KART4. I let everything update (Win10 20H2 and KART5) but still the problem did NOT reoccur. An unofficial inventory of our environment (and including friends and family) shows that not every KART5 system suffered and I cannot find any common links between those that did. My negative side thinks that a bad KART5 update was released, pulled and re-released without telling anyone. Thus only a few unlucky systems were affected. The files are deleted at boot so it’s possible a bugged KART5 was released and only systems that were rebooted between that release and the bugfix release were impacted. It’s unfortunate but I knew this was free software. I knew there was no support. I accept that. I get the bonus of free but there actually was a cost. I’m not yelling, I’m not demanding Kaspersky be held accountable. I came here to get help and to possibly help others with what I learned. I appreciate all the input that was given. I do hope @steve_paul_quinn does manage to get an official response from K and can share it with us. Hello, First thank you for your posts, I’ve read that KART deletes Catroot and Driverstore folders and Upperfilters regkey, can you tell us if KART does other modifications to Windows ? Maybe you could share your procmon log. Thank you again, your posts, and all others in this topic, helped me not going crazy...

Hello, I’m happy to find this topic after quite 2 weeks of intense searching and troubleshooting because I have the same problem with KART on Windows 2016 server. I managed to restore the server and to have it booting but VSS is still not working, I’ve seen the reg fix in this topic but I’ve not tried it yet because when I look into windows 2016 registry I see that it lacks UpperFilters and LowerFilters key too (compared to a Win10), see Attachments. Is LowerFilters missing from someone else Windows 2016 ? Is LowerFilters needed on Windows 2016 ? If yes, what is the its good value ? Thanks for your help