Kaseya AntiMalware (KAM) - Recent Threads

Requested KAM Licenses, need to buy Core Licenses also as not on support ?

commander — Tue, 30 Apr 2013 03:57:38 GMT

Hi all, Sent through a request for a quote on some KAM Licenses on the 19th of this month. Received a reply the same day, was told that as we are not on support, then they would need to get back to us. Received an update today, the 30th, that they were unable to quote on KAM Licenses as we were not on support, but would need to quote on Kaseya CORE licenses along with the same number of KAM. This is on top of the licenses that we already own, which we have plenty of. Im not asking for support, I want an additional product for the licenses that we already have, that are sufficient for our needs at this time. It it just me, or is this a good way of forcing your customers to look elsewhere ?

KAM - Cannot update or scan

Elliot Tabush — Tue, 16 Apr 2013 19:52:22 GMT

I just installed KAM on about 20 computers yesterday. I'm trying to update then scan all of the but it just shows "error" when i try to do either.

About half the computers have been restarted since the install so i dont think that's. Anyone have any tips i can try?

MalwareBytes definition issue - 2013-04-15

Brendan Cosgrove — Tue, 16 Apr 2013 17:07:01 GMT

The database v2013.04.15.12 has an error which causes the protection module to quarantine windows processes and files. This is the fix to get the files back from quarantine.

Please download this tool from the following link:

http://downloads.malwarebytes.org/file/mbam_fp_repair

Extract the folder
Right-click "RunThis.bat" and Run as administrator.
If you cannot access normal mode, run this in safe mode.
If you cannot access safe mode then please run a recovery to make the Windows machine bootable.

To read more from MB see their forum on this issue: http://forums.malwarebytes.org/index.php?showtopic=125138

Silent removal of infections not happening

pjones — Tue, 19 Feb 2013 21:42:07 GMT

I have a site that should be removing the infections that it finds with KAM and rebooting the machine. That isn't the case. My end users are seeing the results and are required to take action to clean up the infections found. I double checked my Profile that is assigned and made sure that it is set to reboot to remove the infections and to remove the issues automatically. The only thing I don't have set is to have the KAM to start with Windows.

Anyone else having this type of problem?

Thanks,

Peter

Error on install "Unable to activate license"

modctek — Tue, 08 Jan 2013 02:14:56 GMT

I'm getting an error in the KAM dashboard that looks like Malwarebytes isn't installed properly on a client machine:

InstallCompleted: Unable to activate license, returning it to pool.

However, when I remote into the machine, it looks like KAM is working just fine, and the log says "Installation process succeeded".

How do I rectify this?

Last Scan Date

SteveMorris — Thu, 15 Nov 2012 23:49:04 GMT

After logging a ticket , support has now confirmed there is now way to monitor for a KAM scan nor is there anywhere that the last scan date is kept in the database.

Soluion given being to open every log and check .. wow thats a time saver.

We were able to capture it when using MBAM

Has anyone come up with a workaround? You would think being able to easily ensure the scans a running as expected would be a priority issues .

Renewing expired licenses

Valerie B — Thu, 20 Sep 2012 21:05:53 GMT

I'm dealing with a large number of expired licenses.. in some cases going back more than a month since they expired.

There were none in the pool for auto-renewal so they just expired. Now after adding 250 more licenses, they remain expired even with auto-extend turned on. Other than reinstalling, how can I get them to renew?

Security Alerts - Your Opinion is Important to Us

Meghana Subramanian — Tue, 18 Sep 2012 18:53:11 GMT

We are interested in Alerts you would like to have included in Kaseya Security Products as well as those that are of no value. Please indicate the usefulness of the current Alerts[in KAV or KES] and any others you would like to have added by filling out this quick survey https://www.surveymonkey.com/s/VC5DRCS. Thank you for your time.

Update to the new version of MBAM?

Jonathan — Thu, 02 Aug 2012 19:46:41 GMT

Anyone from Kaseya want to comment on if there is a plan to update to the new version of MalwareBytes any time soon?

Just curious on that. There are a few features that my techs have been using of the new version that right now they are having to download the "trial" for in order to utilize on some machines that have been infected. (most specifically the new "chameleon" tool.)

Feature Request - Prevent KAM from being deployed to servers (since it's not supported)

seftink — Thu, 12 Jul 2012 19:48:41 GMT

Since KAM is not supported on Servers, it would be nice if the system could automatically detect when someone is trying to deploy KAM to a server and not allow the install. I had an instance where an engineer was deploying KAV/KAM and accidentally deployed KAM to a number of servers. We got it all cleaned up, which included having to KLC to each server and stop the MBAM service to allow the uninstall to finish, but it would have been better to just avoid it.

mbam process running way too high on many machines

ezadok — Tue, 24 Apr 2012 16:35:59 GMT

After installing KAM, we noticed the mbam on quite a few machines at our clients location is running very high (CPU) and we've been forced to disable it. Is there any reason why this would happen?

We are currently using Trend WFBS as their AV, and I thought maybe disabling the 'Enable Protection When Windows' starts option may help but I just made the change so I haven't seen much of a difference just yet. We have the scheduled scans to run on Thursdays, Quick, at 1130pm - then updates are on a schedule as well. I'm trying to avoid letting KAM do anything outside of the designated times I've specified which is part of why it's so frustrating

I'm really hoping someone can help me get to the bottom of this. I really like the idea of having KAM running on schedule as I know it has lots of benefits, but slowing down machines like this is definitely not good.

Remove Malwarebytes from Start Menu .. script?

ezadok — Thu, 12 Apr 2012 17:23:23 GMT

I am hoping that someone can help me out .. I'm looking to hide Malwarebytes from our clients workstations .. We want to install it and basically have it run in the background without the clients knowing it's there (for the most part). I don't know if there's any other way to do this than to use a Procedure/script. I tried to create a script on my own, but it's just not working - if anyone can help me out I'd really, really appreciate it.

Cancel Pending Actions not working with KAM

daGGoth — Tue, 10 Apr 2012 15:21:21 GMT

I'm having trouble "Cancelling Pending Actions" on like a Pending Install, Scan, or even an Update.

Any idea on how to troubleshoot this?

Scripting KAM through Agent Procedure

Kerry D — Fri, 16 Mar 2012 17:02:10 GMT

I'm trying to write a comprehensive malware removal script using a set of agent procedures.

The big hole in my plan right now is the ability to script the installation of KAM on to a remote machine and then run a scan.

We have the KAM module, we use it on many machines by deploying through the VSA GUI, but I would really like to be able to do it all with a procedure, and keep the VSA integration.

Any thoughts or recommendations? I think I've looked at every post in here....

UPDATE: 12 days and nothing... either that 's a really bad question or it can't be done! :) To be clear: we have a pool of KAM licenses that we deploy (and keep resident) on problem machines. I want to script the KAM actions. I can easily do it with the non-integrated MBAM...

KAM/KAV IT ALL

Shickey — Tue, 21 Feb 2012 02:18:17 GMT

We have been fighting this KAM KAV rollout since day one. It works, then it don't work. Lack of controls, the list goes on.

We run regular MalwareBytes with ZERO problems. Love it. New to Kaspersky coming from Symantec. Its seems ok, but I hear nothing but problems with KES, so I lean with KAV. But, the Kaseya versions just seen to be a Rube Golderg approach in its design. Lots of overhead (slowest modules of all to load), and the contraptions just don't play together.

Its been out there long enough to have the bug fixed, unless they only work on it during holidays when the trolls wake up.

Maybe its me.

I was wondering if ANYONE actually has KAM or KAV running RELIABLY on machines on a consistent basis and is not chewing up labor time troubleshooting a product that is suppose to reduce labor.

KAM version no longer supported by definitions?

emendes — Fri, 03 Feb 2012 17:40:37 GMT

Hello all,

I'm getting the following message when attempting to open Malwarebytes / KAM. I deleted the "%allusersprofile%\Malwarebytes\rules.ref" definition file and re-opened, which forced another definition download and ended up with this same message. Since Kaseya's implementation of Malwarebytes is 3-4 versions old now, have we reached the end of definition database support for our version? Anyone else seeing this?

Consolidated List of KAM Issues

Mark.Hodges — Sat, 14 Jan 2012 18:47:03 GMT

So..I love KAM to clean machines, however within the Kaseya framework its tough to manage. Lets be honest and state that the problems with the integration are not entirely Kaseya's fault. MBM is not a mature corporate product, but we are trying to use it in that way (or MBM would have released a console for it for corporate customers).

That said, the way that Kaseya modules work, its also not really plugin friendly and that has caused more one one problem in the past (KAV).

Lets list out the things that cause us problems and then we can see if they can be fixed or worked around or do we just accept that in my case I blew $1600 on nothing.

#1 - No global allow list management - probably one of the major issues effecting everyone

#2 - Unability to actually disable the protection when windows starts without me hacking the scripts to disable the service (important for older machines where AV+MBM kills the machines

#3 -unable to update while services are stopped(it gives errors and a popup on screen about method 2) - if service culd be left running without it seeming to be actively running in background then that might solve #2

#4 - I THINK applying schema is resetting my profiles...I keep finding my profiles set to file execution blocking and/or hourly updates,etc. Disable them and voila at some point I find them on (maybe its just me)

#5 - Profiles not applying consistently and the one that drives me crazy - inability to select all the machines easily like every other module. Why is that so hard to be consistent with? Everywhere else there are checkboxes except KAM...

Detections found, not action Taken - how do I remove the detections?

KeithG — Wed, 14 Dec 2011 21:06:53 GMT

I tried to track down the manual but all I could find was the ReleaseNotes for KAM which had this to say about items found under [Detections], No Action (taken).

"Scanning on Demand
Endpoints scanning for malware can be scheduled or run immediately, by profile or by individual machine. Almost all threats are resolved automatically. Outstanding threats are listed on the Detections page and may require manual intervention."

Scanning on Demand

Endpoints scanning for malware can be scheduled or run immediately, by profile or by individual machine. Almost all threats are resolved automatically. Outstanding threats are listed on the Detections page and may require manual intervention.

How do I take action? Do I have to use Remote Control and run another scan to remove the items? Or is there an option in KAM i'm missing? Thanks!

High CPU use when viewing machines?

Jeffro — Mon, 05 Dec 2011 23:50:51 GMT

I noticed that the Kaseya server experiences high CPU use when viewing machines. We had tried a reapply DB Schema because I also noticed some icons don't appear (under column sets), but I guess that's maybe because it is unfinished still?

The high CPU use doesn't happen with Kaseya core modules. It's just when I use the KAM. If I select to only view 10 machines it seems to be better, until I switch to the next page which causes a CPU spike.

Anyone else noticed the high CPU use issues?

KAM Updates

Johan Zeelie — Fri, 21 Oct 2011 07:07:06 GMT

Where does KAm get its updes from when an update command is issued to the agent's workstation? Does the agent get it from the Kaseya server or from the internet?

Unable to access Machines under KAM.

msanchez — Thu, 20 Oct 2011 16:22:27 GMT

I can view Dashboards, Detections and Profiles, but when I select Machines I receive an error in Server Response. Have attempted from multiple browsers (ie, firefox, chrome) and different workstations, error is attached.

KAM Version Update

Shickey — Mon, 19 Sep 2011 10:52:05 GMT

Any news on the next release of KAM?

KAM!!!!!!!!!!

Yogesh — Tue, 13 Sep 2011 14:43:33 GMT

Any updates On KAM??

any new release of this product??

KAM update randomization

emendes — Fri, 12 Aug 2011 21:58:21 GMT

The newer Malwarebytes builds allow for some form of update randomization, albeit from the command line... i.e. "mbam-msp.exe /schedule /update /starting 03/28/2011 07:00:00 /hourly /every 4 /random /silent"

Why has this functionality not been built into the KAM profile create/edit page? It you pick an update time and frequency, i.e. 7:00 AM every 4 hrs, you will have every machine at an office run the update to download a 5+ mb update file at the exact same time every time it goes out, which is a problem for larger organizations.

Also, why is the desktop icon hidden? Is there an option to unhide it?

/rant

KAM leaves popups on clients screen

roba0665 — Thu, 14 Jul 2011 00:32:44 GMT

KAM leaves popups on the screen after running a scan instead of reporting it to kserver, this annoys the user somewhat who doesnt want to know about these things (its what they pay us for).

Is there a way of stopping these pops?

KAM Hotfixes

Robert Thaller — Wed, 13 Jul 2011 23:57:30 GMT

My KAM installation has not received any hotfixes since May 5th, 2011 which is now over 2 months. I know that they changed the procedure on releasing hotfixes, but this seems to be a long time to not get any fixes considering there are still issues with the product and that a newer version of MalwareBytes has been released from the developer?

Any idea when we can expect to see hotfixes again or the next version for KAM?

Malwarebytes Tray Icon

TLC Tech — Wed, 13 Jul 2011 23:30:17 GMT

Is there a way yo make this available in the system tray?

Also, is there a way to add an exception for a website?

Does KAM work on Windows Terminal Server

Matt — Fri, 24 Jun 2011 01:46:44 GMT

Does it work? Any known issues you have to workaround or put up with? Is it effective or because its a terminal server enviroment it has holes in its protection compared to a normal windows 7 desktop? thanks Matt

IE9 Performance Issues

PDS Consulting — Tue, 14 Jun 2011 19:50:09 GMT

Has anyone else noticed some terrible performance issues on groups with 100+ agents in the KAM module lately?

Today we found that it's almost totally unusable in IE9 in this situation...and support's reccomendation was to downgrade to IE8...which i find unacceptable at best.

it appears we will have to use FF or Chrome to access the KAM module for somewhat large machine groups.

KAM Install issues

Ken Curtis — Thu, 12 May 2011 01:22:14 GMT

In the past few days we've had a slew of failed installs, and when you click on the "view log" for the installation it ends up with "File not found".

The status for some stays at "script scheduled" even when I do "Cancel pending action" from Actions.

Has anyone else seen this before I open a ticket?

KAM blocking KAV updates?

JosephM — Tue, 10 May 2011 16:17:07 GMT

We've recently started installing KAM & KAV on a number of our test machines. KAM is blocking what I believe is the KAV update process, but it is some part of KAV being blocked.

A number of these machines log the following repeatedly:

machinename Blocked URL 90.156.178.31 (Type: outgoing, Port 51725, Process: avp.exe)

The IP changes slightly, 90.156.178.31-34, ports also change, some detected ports...51725,51727,51733, usually in the 517xx range.

It's also blocked AVP.exe from connecting to 94.100.30.164-167

Is there anything we can do aside from manually excluding that exe on the workstation?

Silent scans/removal aren't happening, why?

aabbasi — Fri, 15 Apr 2011 04:45:35 GMT

Hey guys,

Nothing is silent with the KAM, even though it's configured to do so in the profile. When people log in to their computers in the morning they see MalWareBytes open asking if they want to remove the viruses.

What affects the Anti-Malware Score on Reports? How to improve?

wega1985 — Fri, 08 Apr 2011 14:39:45 GMT

We send out a "Monthly Executive Summary" report to our customers and as we've been implementing KAM, the scores have been going down. We can't seem to get the Anti-Malware score above 50%. Anyone have any ideas on what affects these scores? I looked in the report parameters and can't see any info for the Anti-Malware sections, just the checkbox to show the statistics.

Experience with KAM

Mark.Hodges — Sun, 03 Apr 2011 05:58:10 GMT

I've been testing the KAM options as we have been getting hige complaints of performance issues that started after rolling out KAM.

We do not have file or website scanning enabled but when opening applications I do see the MBAM process doing something and taking up resources so it appears that file scanning is still happening.

I have also tried unchecking the load protection at startup and rebooting the test system and it does still load the service and take up resources.

I forced the registry to set service to manual and I can still perform a manual scan of the systems so I am considering just mass change the service state and then set scans to nightly and skip if offline.

Anyone else tested to see if the mbam process really doesn't load on startup if you set that option in a profile? Maybe our system is just ignoring the options we set altogether?

Agent failed executing agent procedure "KAM: Get Scheduled Scan Results"

PDS Consulting — Thu, 31 Mar 2011 14:00:56 GMT

We have run into a problem with KAM getting scheduled scan results.

we get the following procedure failure notification 50 -200 times when scheduled scans happen:

<agent> failed executing agent procedure "KAM: Get Scheduled Scan Results" on 2011-03-31 09:38:28Z Script Summary: Failed THEN in step 2 Check the machine's Agent Procedure log for additional details.

Have any of you seen this issue before and can provide some insight on how to best resolve it?