Kaspersky Security 10.1.2 - Post Scan Backups

[Civic]

When scanning a number of Microsoft Windows 2012 R2 file servers using Kaspersky Security 10.1.2, the process is changing both the timestamps and attributes on the scanned files. This means that ensuing  backup is taking far longer to safeguard the increased number of changed files and this is, at the same time, using up far more backup storage space.

Is there any specific reason why the scan specifically needs to change both the timestamps and attributes of these files? 

[Guest #37]

Hi,

I don't know how you have scanning and heuristics configured, but in theory it will only review files that have been modified after last scan. Is this true?

Please upload screenshots of your configuration.

Regards

[Civic]

Appreciated Caos. Apparently my colleague who is the Domain Administrator has today been issued with a ‘registry fix’ by Kaspersky support to prevent the timestamps and attributes being changed by the scan process. She has tested this out on two servers and it works fine. Do you have a direct link to this fix so that I can post it as the solution here? 

[Guest #37]

Hi,

Then Kaspersky's technical support has sent your Domain Administrator a private fix.

This is a private fix and must be provided by Kaspersky support (use of such a fix without explicit recommendation of its use by Kaspersky support, exempts any problems on the host).
Private patches are managed only if the cases for which they were designed are met. Publishing this kind of solutions may mean that all users (without correctly evaluating the problem) try to apply the solution, having some of them problems related to a misuse of them.

Regards

[Oleg Bykov]

I think it can be posted here for future reference. To instruct KSWS to not mess with file times when doing the On-Demand scanning, add this value to the registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\WSEE\10.1\Environment]
"DontRestoreFileTimes"=dword:00000001