Kaseya Antivirus (KAV) - Recent Threads

timeout expired before loading plugins

Sachin Dev Verman — Fri, 17 May 2013 06:04:39 GMT

I am facing some problem while taking live connect in firefox or Internet explorer.

Kindly help us.

KAV Self Defense/Uninstall Password

Stuart Rowe — Thu, 09 May 2013 19:41:29 GMT

I have somehow changed my default uninstall password for KAV to something other than KaseyaUninstall. I know what it is changed to but obviously I am not going to post it here :)

What I am trying to figure out is where I changed it because I need to change it again to something different. I cannot for the life of me figure out how I changed the password form it's default so I can go edit it again.

Anyone?

~Stuart

Kaseya Security Center 1.1 - Feature Prioritization

Jeff Keyes (Kaseya) — Mon, 06 May 2013 19:39:42 GMT

Now that we are in controlled release with Kaseya Security Center 1.0 (which includes KAV and KAM), I'm looking for feedback on the NEXT set of features to come.

I created a single question survey....I'd LOVE your feedback!

http://surveymonkey.com/s/kaseyasecuritycenterv

Jeff

Jeff.Keyes@kaseya.com

KAV (6.0.4.1611) compatible with Office 2013?

slarge615 — Mon, 06 May 2013 18:12:22 GMT

Quick question,

Can anyone confirm whether KAV 6.0.4.1611 is compatible with Office 2013? We've been having some bizarre issues with Excel randomly crashing on new systems with KAV installed, running Windows 7 and Office 2013.

I have been unable to find any documentation anywhere that confirms/nor denies compatibility.

Thanks,
Spencer

Preventing KAV to remind End Users that the license is soon to expire

Houston Technology Group — Mon, 29 Apr 2013 02:54:38 GMT

Hello...

Just wondering if there is a way to prevent KAV (1.4) / Kaspersky AV 6 popping up the following to the end user ?

It is even more annoying because:

it makes the client pointing it out to us (although I already knew about it, but it's not really helping make us look good)
all my endpoints are set to "Auto Extend" ...

I'd have thought that is the endpoint is set to "Auto Extend", the Kaseya would automatically deploy an Extended license.key file, which in turn should prevent Kaspersky AV to remind the end user.

Any idea will be appreciated.

Francis Germain

Kaseya compatibility with AV software othern than Kaspersky

ashinspiro — Wed, 24 Apr 2013 04:26:26 GMT

Dear all,

I would like to know if anybody is using Kaseya to work with other AV softwares like Norton and others.

Do the Kaseya users have to install Kaspersky on their pcs / servers for best performance?

What if they do not wish to use Kaspersky?

Install KAV to drive other than C:

Randy C — Tue, 23 Apr 2013 17:58:18 GMT

Is it possible to install KAV server to a drive other than the c: drive?

Set account to run updates

kellie — Tue, 23 Apr 2013 06:48:54 GMT

Has anyone been able to set the runas account after installing KAV on workstations without doing it manually? I've set up a centralised store on a domain server, but one of our sites has a bunch of machines that are running as workgroup machines and so can't connect to the store unless they have the runas set.

From setting it manually, I've found the path: HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\protected\AVP80\profiles\Updater\runas which has enable, account and password that gets set with the details, but the password is encrypted and seems to be different on each machine. I've run a procedure to set these fields but when I log into the workstation to check, the settings have not passed through.

Within the profiles, there only seems to be the option to set the proxy details, not the runas.

We are still on 6.2 and KAV 1.4.

Thanks

Kellie

Modify or set KAV uninstall password per profile

mjmacka — Wed, 17 Apr 2013 20:46:50 GMT

This is kind of a question, kind of a feature request.

Does anyone know how to modify the KAV uninstall password once it has been set?

Also, is there a way of setting it for an entire profile so that that specific password is pushed out for all of the users in that group instead of the default "KaseyaUninstall" password?

Any help would be appreciated.

-----------------------

Michael McApine

Incito TS

Remote uninstall of Microsoft or Symantec antivirus

PartlyDave — Fri, 12 Apr 2013 18:56:01 GMT

We've been using Kaseya for a while and just bought the Kaseya / Kaspersky antivirus feature.

We have a couple hundred workstations, some running Symantec Endpoint protection and some running Microsoft Antivirus. Is there a better way to uninstall MS or Symantec than visiting or VNCing into each PC and doing it manually?

Thanks.

KasAVSrv.exe

eperson — Wed, 10 Apr 2013 19:39:28 GMT

Quick question, is the process KasAVSrv.exe used by KES and KAV?

Creating agent procedure for uninstalling NDIS filter from network adapter?

andrewf — Mon, 08 Apr 2013 15:09:03 GMT

One of our clients is having an issue with the NDIS driver causing spikes in bandwidth. Don't ask me how, since we have 700 other machines with KAV installed and no issue, but they requested that we remove the driver from all of their workstations. I tried using the KPacker utility to simulate the uninstall of the NDIS filter which always tests fine on the same machine it's created on but when tested on another machine it either deletes the network adapters entirely or just screws it up and doesn't let you get into the adapter properties. I've even located the registry key and the system file (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{C477F579-9F31-474D-86CC-E1567F0BFD1D}\Ndi) and tried deleting it... caused the same results. The system file is klim6.sys. Attached below is the filter I'm talking about.

Any response from Kaseya on this

mactech — Tue, 26 Mar 2013 18:51:57 GMT

I have been asking for this for a while, submitted tickets for ways to do this, etc.. Have always been told that there is not a way to do this. Very frustrating because what you say is correct, I only want to know when KAV requires my attention, not when it is doing its job. I have already submitted this as a feature request a few months back...anybody from Kaseya????

Best Practice \ recommended settings

lclark — Mon, 25 Mar 2013 22:51:51 GMT

Hello everyone,

I'm looking to try out KAV. We are currently using KES for all of our clients, but KAV has caught my interrest since the latested updates.

When I log into the VSA and begin looking through the profiles I immediatly notice that there quite a few options in there (which is great, but a little overwhelming). I jus want to know how is everyone running this? Is there any recommendations as far as enabling or disabling options in the profiles? Recommended exclusions? Has anyone had any issues with user browsing or software?

Just kind of seeking some insight on the besat way to run this for users without ruining their day.

Thanks!

KAV installation error

HugoFdS — Wed, 20 Mar 2013 20:34:25 GMT

Hi people!

We're having problems installing KAV at 02 machines.

We schedule the script to start immediatly and after some minutes it fails. At Install Status we have "Failed" and Install Error we have "No Log File".

What can we do?

Thanks!

KAV: An Anti-Virus threat was detected

Jon Bälter — Mon, 11 Mar 2013 12:33:57 GMT

In the Kaspersky module we can see that alot of agents are reporting in detected threats. But what kind of alarms are you supposed to take any action on?

Has Kaspersky blocked the threat or do we need to do anything? I´m specificly asking about the events that are logged as "suspicious" and "remidiated by user"

To monitor our clients with KAV we have the following basic eventlog monitorset that we have applied on clients.

This general idea at first when we started building this monitor set was that we initially only wanted to be alerted when KAV actually finds a virus that could not be quarantined or deleted.

When we applied this monitorset we started to get alot of tickets generated from clients telling us that threats was detected. But tickets are also created when items already has been deleted!?

The screen shot below shows the threats detected by the KAV engine on a machine.

This is the amount if tickets that were created. (3 missing?)

The tickets contained the below information.

Log: Application
Type: Warning
Event: 257
Alert Time: 2013-03-10 03:57:16Z
Event Time: 03:01:02 AM 10-Mar-2013 UTC
Source: KAVComponent
Category: None
Username: N/A
Computer: 115S
Description: KAV: An Anti-Virus threat was detected (Trojan-Downloader.Java.Agent.rg).

Application log generated Warning Event 257 on 115s.hq.whyred
For more information see http://www.eventid.net/display.asp?eventid=257&source=KAVComponent

Log: Application
Type: Warning
Event: 257
Alert Time: 2013-03-10 02:49:45Z
Event Time: 01:53:31 AM 10-Mar-2013 UTC
Source: KAVComponent
Category: None
Username: N/A
Computer: 115S
Description: KAV: An Anti-Virus threat was detected (HEUR:Backdoor.Win32.Generic).

What sort of events would one have to follow up on? And what kind of events are considered to be blocked by KAV?

Would appreciate if anyone else has any input on what to exclude/include from the KAV monitoring. And if anyone has any documentation on existing KAV eventlog messages today.

What we would like is a monitorset that only alerts us when the KAV client needs attention. Not reporting on things that already has been blocked.

KAV 1.4 blocking apps that worked on 1.3

Tim McKeehan — Mon, 04 Mar 2013 16:33:22 GMT

We upgraded to KAV 1.4 last week and have pushed it out the new version to about 400 workstations so far. We have been getting complaints of various software not working from a few customers. We have had to disable KAV for the computers with software issues. Is there a log somewhere that shows which file is getting blocked by Kaspersky? The Detections spot in Kaseya is pretty much worthless to me. We are using the same profile from 1.3 so we only enable File and Anti-Spyware detection. What new feature in 1.4 would be blocking programs so we can disable it in the profile.

KAV 1.4: Is there a way to disable the license expiring message endusers get?

Steven Carroll — Thu, 21 Feb 2013 22:24:58 GMT

With KAV 1.4, it seems more end users are getting pop-ups stating that their license is expiring. We would like to be able to disable this, and not bother the customer, as it is starting to get on the nerves of many clients. Since the license auto-extends, we don't really have a need for this.

Thanks,

Steven Carroll

KAV blocking KVNC access?

modctek — Tue, 19 Feb 2013 06:35:42 GMT

I have a relatively new install of KAV on a Win 7 Home Premium machine that got infected. When I tried to remote in to see what was going on, it looks like KAV activated it's self defense and locked me completely out of the KAV interface through VNC. I had to go into the KAV dashboard and disable protection on that machine in order to access the KAV gui on the remote machine. Does this sound right? I know this was an issue a couple years back, but shouldn't this be fixed now?

How do you add a URL to an exception list with KAV?

woleary — Wed, 13 Feb 2013 15:10:45 GMT

Kav is blocking several sites with the following:

While trying to retreive the URL:

The following error was encountered:

The requested object is INFECTED with the following viruses: HUER:Trojan.Script.Generic

These sites are NOT INFECTED, and it is a false postive. How do I add this site to a general exception list for all clients using the same profile?

KAV Blocking Internet

bremic9188 — Mon, 04 Feb 2013 21:30:52 GMT

Around 2PM Central today most of clients started reporting they couldn't access some websites. It seemed random at first, and still pretty much seems random, but I think we pretty much narrowed it down to Windows XP and Kaspersky.

We created a new profile in Kaseya that has WebAV protection disabled and assigned it to a small test group. We'll see if this works.

Do someone now a way to force reapply the profile on KAV 1.4 and script to detect Kav

Etienne Deneuve — Sat, 02 Feb 2013 12:29:29 GMT

Hi,

I've a lot of workstations who are out of compliance, I'm looking for a way to global reprocess the profile to the workstations...

I've updated a script wich I found here on the community to check if the installation is from the #vagentconfiguration.agenttempdir#\kav ... then if the script detect it, it'll set the custom field to Kaseya Antivirus, the other version was looking for a Kavlib.dll which i don't find on my machines...

KAV / roll-out of Kaspersky patch 'E'

Combo — Mon, 28 Jan 2013 23:30:06 GMT

Hi, does anyone know if Kaseya is rolling out Kaspersky patch 'E' (http://support.kaspersky.com/9216) as part of KAV, or should this happen automatically?

The reason I ask is that one of our customers has reported seeing a dialogue box from KAV: 'your PC is missing updates that can help it improve it's stability' which provides a link that when clicked indicates 'you don't have the latest version of Kaspersky'.

Thanks, David.

Month by month report on licence expirary

Craig Scott — Thu, 24 Jan 2013 16:16:34 GMT

Is there away to produce a report of KAV licence expiries on a month by month basis?

KAV Licenses Silently Disappearing

Shickey — Wed, 23 Jan 2013 04:14:57 GMT

We install KAV & KAM on all workstations at the same time now. Recently, we have noticed that there are roughly 50% more KAV licenses consumed than KAM licenses. They should be equal counts. It's as if if there is an install problem of KAV, the license is pulled from the license pool on an install attempt, but never returned to the pool. Each install attempt consumes another license.

Having tons of KAV install problems at a new client site, the license pool seems to have become a black hole, swallowing up licenses and requiring more to be purchased. I have not seen the pool count increase by a license being returned to it, only a decreasing license count in the pool. It seems something in this pool method is not working right.

Has anyone noticed licenses being returned to the license pool on KAM or KAV, or are the licenses silently disappearing, or have you even noticed anything like that?

Kaseya needs to get on their support or risk loosing me as a client

Josh — Mon, 21 Jan 2013 16:47:08 GMT

I have a big issue with Kaseya right now. I was a Test Pilot for 6.3. After the upgrade i have not been able to Install or Update any of my KAV clients. Over 500+ endpoints. I had a client get infected with a worm because KAV was not updated. I have had in a ticket in for almost a month and all they can ask for is a fipping GSI report. How does a single GSI report tell you what the issue is across all my endpoints? Come on Kaseya!

KAV Issues

jhadik — Sun, 13 Jan 2013 15:05:25 GMT

Has anyone been having issues with KAV lately, we have been having the following issues;

Client upgrades to 1611 are failing 4 out of 5 times. We are forced to uninstall using the Kaspersky uninstall tool and then do a fresh install.

Client software has been failing causing USB drivers (and other drivers) to fail making the computer totally unusable, keyboard and mouse become inoperable. Happening on both Windows XP and 7 machines.

Clients are getting a license expired error which Kaseya support Kalua script errors, they say it's a known issue but don't any idea of a resolution.

Some of our clients are starting to question our use of the product and the amount of down time they are seeing. We are trying to decide whether we should stay with the product or move on to something else. Looking to see what other people are dealing with.

KAV 1.4 install enables Windows Firewall. Any way to stop that?

Justworks-NG — Thu, 20 Dec 2012 23:12:01 GMT

Currently running older KES and evaluating KAV 1.4 and KES 2.3. One of the problems I have come across immediately is that installing KAV enables Windows Firewall on both servers and workstations and there does not appear to be able way to prevent that. Am I missing something?

Kaspersky suddenly causing some PC's to lock up

Paul Blough — Mon, 17 Dec 2012 22:44:51 GMT

We are experiencing a strange problem that started today. Random PC's that have Kaspersky and locking up and displaying an alert box that says "Previous application launch failed." Other messages reference a failed update. The PC's are completely useless until we go in using Safemode and uninstall Kaspersky, after that they run fine again. We have had 20+ PC's so far with this issue out of over 500 PC's that we have deployed Kaspersky to. We are obviously concerned that this could happen to more PC's and are wanting to make the best decision on how to proceed. I'm interested in if anyone else is experiencing this problem and if anyone has any suggestions.

KAV - How to Remove 'Detected' threats?

thite — Tue, 20 Nov 2012 18:03:53 GMT

We have recently upgraded from KES to KAV and have rolled it out to about 200 endpoints. This last Sunday was the first full scheduled scan and today when I looked at the 'Detections' page in Kaseya I noticed it caught quite a bit of stuff. My only problem is I cannot delete or remove any of these 'detected' threats. I can only add an exclusion? How do we remove these 'detected' threats?! I've been browsing through the forums & documents and can't find anything regarding this.

Screenshot below is only a small chunk of the detected items. Any help or guidance would be greatly appreciated.

User Interaction popups

info101 — Mon, 19 Nov 2012 23:19:40 GMT

Does anyone know if the user interaction popups (Allow/Deny popups) on the Kaspersky application are logged somewhere?

It would be great to see what is popping up on users systems so that I can explicitly exclude any necessary applications to prevent these pop-ups from annoying users.

KAV compliance bug?

info101 — Mon, 19 Nov 2012 23:05:40 GMT

Has anyone else come across this?

I have found the compliance in KAV 1.4 to be frustrating in general however I found that through a few steps its possible to actually get a false positive where KAV does not find a compliance issue when there is one.

Can anyone else reproduce this issue:

Step 1 –

Current State: in compliance

Manually set Access Control on Tape Drive Devices to true on client machine (open kaspersky on client à goto settings à goto access control à click settings button à tick tape drive à click OK)
Entered password on client to allow changes
Waited 3 mins (status.xml updated with new changes)
Received compliance issue in KAV module in kaseya
diff.txt stated that the files were different and showed the values that were different (only the values not the lines… This is quite useless if trying to parse this file to quickly report on what is different)

Step 2 –

Current State: Out of compliance

In KAV 1.4 module - Selected the machine stated as out of compliance, clicked Assign, set to same profile.
Files updated immediately: AVPsettings.xml, AVPsettings-last, profilesettings.state, globalTrustedApps.xml, kesprofile1570.kav, kesprofile1570exclusions.xml, kav_command_loadconfig.lua, threats.txt
Files updated at next 3min interval: diff.txt, getstatus_basesdate.txt, getstatus_component.txt, getstatus_scan_qscan.state, getstatus_scan_vulnerabilities.state, status.xml
Kaseya will now say that the machine is in compliance.
Manually check Kaspersky to find that the tape drive is still ticked in access control meaning it is not in compliance.
Diff.txt says the two files are the same.
Manually checked files and both files are the same. However, the reason they are both the same is because both state that the tape drive should be ticked (This is shown by the following value being 0 instead of 1 in line <val name=”Enabled” value=”0” type=”6”/>:

<node name="Devices">

… (other device lines)

<node name="0012">

<val name="ID" value="00000018" type="4"/>

<val name="TypeName" value="OtherTypes" type="10"/>

<val name="Enabled" value="0" type="6"/>

<node name="ClassGUIDs">

<val name="0000" value="{6d807884-7d21-11cf-801c-08002be10318}" type="10"/>

</node>

Previous application launch failed

edave — Fri, 16 Nov 2012 16:33:27 GMT

http://i.imgur.com/v0xg5.jpg

I have a user who boots up his machine every morning and receives this message. Does anyone have a solution to get rid of this?

KAV on servers - our experience

mark — Tue, 13 Nov 2012 09:36:54 GMT

We rolled KAV out to approx 200 servers and 80 workstations. At first it seemed great having A/V all integrated into Kaseya, but we found just way too many issues with KAV. The install/uninstall process is lumpy to say the least, we had a number of servers with random bluescreens which were confirmed by MS as being caused by Kaspersky driver, and the profile management seemed a bit week.

On workstations we ended up having to disable so many functions to get it stable and not affecting other aspects of the computer that it wasnt doing a lot.

The .1611 update didn't seem to help much at all

We had a few tickets open with Kaseya, but the complex ones were referred to Kaspersky who were in no hurry to assist

After a lot of thought we pullled it off every machine, and have since rolled back to our original A/V (Nod), so far no issues and servers+worstations have stabilized bigtime

What a mission!