Lorenzo97

Hi @Vasily Burov, unfortunately I was not able to see the issue again till now. I disabled the logger because it was using too much space every day. I think that this issue is related with the periodic scan the product does. In fact, the issue is mostly on Monday (when the scan runs). I will try to enable logging on Sunday. Maybe those info help. Best regards.

Hi, @Vasily Burov, no VPN installed, just Windows Defender as AV.

Dear support team, After our server automatically updated to KART for Business 6.4.0.378 we started experiencing strange and random system hangs that required manual power cycling the machines in order to be able again to log in or use the services hosted. Do you have any reports for similar problems? We didn't yet tried uninstalling the product yet but the Kaspersky update was the only one thing we did before experiencing such a behavior. Many thanks and best regards.

Hi @Vasily Burov ! We have Internet but I cannot visit the link provided. Apparently our DNS blocker is limiting the connection. We will investigate the issue. Many thanks and best regards

Hi @Vasily Burov! Thank you, that fixed the issue. I didn't reboot it before because it was in use and I had to wait the night. For your information, the top yellow bar that you see when you open the software where it says "Complete the user registration form" doesn't work with the message "Failed to get the registration form. Please try again later" when clicked. This is just an information, as soon as it does not impair product effectiveness it is not an issue (for me). Thanks again to you and all support team for the great assistance! Cheers

Hi @Vasily Burov I packed my testing stuff and uploaded it here: https://tlgur.com/d/4kxZqyj8 (harmless, it contains 3 clean PDF and a batch script that injects plaintext into them). Just unzip into a folder and you should be able to run it. This was the same script with which I discovered a similar issue in the past: https://forum.kaspersky.com/topic/kaspersky-anti-ransomware-for-business-kart-6-not-blocking-malicious-executables-27839/#comment-115494 After you fixed it last time it worked well since now. Before opening the ticket, I tried running it on another machine with Kaspersky Security Cloud. That PC correctly detected the bat as a threat, quarantined it and restored the damaged files as planned. I made a short video (with explanation) of me running the test software on the Windows Server machine: Many thanks for the support! Best regards

Dear support team, Today we rebooted our servers and newer product version KART 6.1.0.90 was installed. I then tried to execute a sample "malicious" (harmless) bat file to corrupt data in some sample PDFs to test the behavior of the new scanner. As soon as I launched the script, the software detected it as Trojan and correctly reverted back the modified files. The problem is that, also if the malicious file path is correctly reported in the "blocked items" section, the KART software is no longer preventing it from running again. Simply by running the script again, the files are again compromised and then reverted back by the remediation engine. Before this update, the service was running correctly. This is for me a really serious issue, I would like to point it out so that it can get fixed as soon as possible! System configuration of Windows Server 2016 and some KART screenshots can be found in the pictures below. Please let me know if you need anything else. Many thanks

My KART updated to 6.0.0.393(a) version. I confirm that the critical security problem is now fixed. Thank you @Vasily Burov for releasing the fix quickly. Best regards

Hi @Vasily Burov thank you and all the Kaspersky team for the quick support. So let's wait for the upcoming update! Best whishes

Hi, @Vasily Burov thank you for the quick response! Meanwhile I tried to corrupt files shared via SMB and that feature works as expected. The IP address of the machine is blocked and no further corruption can happen. I attach the pictures of my test about launching a malicious executable on the machine where KART 6 is running. File is being marked as blocked but you can still run it afterwards with no problems. I use Windows server 2016 standard edition setted up as domain controller build 1607 - 14393.5356 Thank you!

Dear Kaspersky community, today KART 6 free edition was automatically installed on my Widows server 2016 standard edition with latest updates. After the reboot, I tried to create a sample "malicious" bat file to corrupt data in some PDF to test the behavior of the new scanner. As soon as I launched the script, the software detected it as Trojan and correctly reverted back the modified files. The problem is that, also if the malicious file path is correctly reported in the "blocked items" section, the KART software is no longer preventing it from running again. Simply by running the script again, the files are again compromised and then reverted back by the remediation engine. Before the update I was running the 4 version and once a file was detected it couldn't be run anymore if listed in the blocked apps section (until manually unlocked, of course). This is for me a really serious issue, I would like to point it out so that it can get fixed as soon as possible! Many thanks