FAO Kaspersky AV users

[gshaw]

Just wondering if anyone using Kaspersky has performance issues with "Applying Computer Settings" on startup? Apart from that it seems to run really well but not sure what it's trying to do scanning the GPOs... Sophos did exactly the same thing and it really bogs down the startup... any solutions out there?

[Norphy]

Interesting...

 

We've just rebuilt the PCs in our college and part of the rollout this year was KAV. We're now seeing issues and that is one of them.

 

Are you seeing instances where certain services aren't starting too? Usually they're network related such as the DHCP client, NLA and the Workstation/server processes?

 

/edit May be worth putting a scanning exception in for the netlogon area?

[maniac]

Ahhhh, interesting.

 

We've just brought into KAV as well this year, and we are also seeing a slowdown on Applying Computer Settings, although I put it down to there being a glitch on our new network as everything is totally new, but maybe I was chasing the wrong thing.

 

If anyone can shed more light on this I'd be very interested.

 

Mike.

[Soulfish]

Just moving to KAV here so would be interested in any fixes/workarounds for this issue

[gshaw]

Haven't had any service issues as yet but it seems this Computer Settings issue looks quite common... keep posting on here as evidence that Kaspersky support need to fix it up sharpish

 

Interesting...

/edit May be worth putting a scanning exception in for the netlogon area?

 

That could be worth a punt, KAV support gave me some policy settings to try that involved putting exceptions in DNS and DHCP folders but maybe that's worth a go... would I be right in thinking at logon the workstation would be querying \\domain.local\SYSVOL and \\domain.local\NETLOGON as I'm guessing KAV must be scanning the GPO objects before applying them?

Edited September 2, 2009 by gshaw

[Norphy]

Any chance you could post those exceptions for DHCP and DNS here?

 

I've put in exceptions for %domain%\sysvol and one for each of the DCs to cover all bases. I think netlogon is under sysvol so hopefully that should cover netlogon too!

[gshaw]

Just done a bit more investigation and tbh the exceptions won't make any difference if what I'm thinking is correct...

 

- machine with no AV installed... lightning quick login

- machine with AV and full policy... slow on Computer Settings

- machine with test policy and protection components disabled... slow on Computer Settings

- machine with test policy and Kaspersky startup disable... a bit quicker

 

When manually starting AVP.exe (the main AV prog) you see frenzied HDD activity as it loads up, which then settles down after about 15-20 seconds (on a Core2Duo E8400)

 

So my logic is that KAV seems to be loading just after Computer Settings starts, the frenzied HD activity is actually the AVP.exe starting and not caused by it scanning anything out the ordinary. Once it's started up the GPO then resumes and goes in as normal.

 

For reference here's the exclusions I got from KAV support...

 

Could you please edit your server policy, click on the Settings tab, then click Configure under Trusted Zone and do the following:

1) Click on the Exclusion Masks tab

2) Click Add

3) Click Specify

4) Enter %systemroot%\system32\dhcp and click OK (see below)

 

5) Click OK

6) Click Add

7) Click Specify

8) Enter %systemroot%\system32\dns and click OK

9) Click OK and OK again

10) Click Apply

11) Click on the Enforcement tab

12) Click Advanced

13) Select ‘Modify all policy settings…’

14) Click OK and OK again

 

Now please open your workstation policy, click on the Settings tab and do the following:

1) Click the drop down menu and select File Anti-Virus

2) Click Customise

3) Click on the Protection Scope tab

4) Un-tick ‘All network drives’

5) Click OK

6) Click Apply

7) Click on the Enforcement tab

8) Click Advanced

9) Select ‘Modify all policy settings…’

10) Click OK and OK again

[Norphy]

OK, thanks!

 

Out of curiosity, are you using an RM system?

[gshaw]

OK, thanks!

 

Out of curiosity, are you using an RM system?

 

Hell no

 

Plain vanilla for us

[Norphy]

Lucky you

[gshaw]

A few more things to try, might be worth you guys doing this as well and see if it helps...

 

Could you please try the following:

1) Open your Workstation policy in the Admin Kit

2) Click on the Settings tab

3) Click the drop down menu and click Additional

4) Tick the options ‘Virus scan system scan’ & ‘Update systems tasks’ and click OK

 

5) Now please test

 

If this doesn’t help we to test to see if the issue is being caused by a specific component. If it is a specific component causing the issue we can create some trace logs with KAV running and the component disabled and another set of logs with KAV running and the component enabled and then pass this to our developers for analysis.

To do this please disable the following components on a machine or via the policy and test the logon speed, if the logon issue is resolved turn the components on one by one until the problem component is located.

 

Please disable:

Mail Anti-Virus

Web Anti-Virus

Proactive Defence

Anti-Hacker

Anti-Spy

Anti-Spam

 

Please ensure you leave File Anti-Virus enabled

 

If it is a specific component please do the following to create trace logs.

 

1) Download KAVLOG7.EXE:

http://www.kasperskylab.co.uk/kavfiles/utils/Trace_utils/kavlog7.zip

 

Username - kavuser

Password - Dfpt43

 

2) Create logs with just File Anti-Virus enabled

a. Logon to the workstation

b. Run KAVLOG7.EXE

c. Set the trace level to Notify 500

d. Click Turn Trace ON

e. Reboot the machine and logon

f. Once logon has completed run KAVLOG7.EXE and click Turn Trace OFF

g. The trace file will have now been created in:

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab

Please zip and send me the files starting AVP... with the same date and time stamp and then delete the files on the workstation

 

3) Create logs with just File Anti-Virus and the problem component enabled

a. Logon to the workstation

b. Run KAVLOG7.EXE

c. Set the trace level to Notify 500

d. Click Turn Trace ON

e. Reboot the machine and logon

f. Once logon has completed run KAVLOG7.EXE and click Turn Trace OFF

g. The trace file will have now been created in:

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab

Please zip and send me the files starting AVP... with the same date and time stamp and then delete the files on the workstation

[Norphy]

We're beginning to think it's the network agent and/or our configuration of the admin kit. Kaspersky support had me try the release candidate of KAV 6.0 MP4 and that worked without any issues. However, that necessitated uninstalling v6 of the network agent and installing v8 instead.

 

As an experiment, we uninstalled the agent and KAV MP3 from a sacrificial lamb and reinstalled KAV without the network agent, it's been behaving itself properly since then. I've asked Kaspersky support to look into this, will let you know the outcome!

[gshaw]

Interesting stuff, might try whipping the agent off of my test machine to see if it speeds up... hope whatever update comes out soon as my machines would boot to desktop in under a minute if it wasn't for a 30 second lag on Computer Settings

[Norphy]

According to my support bod, v8 of the Admin kit and network agent and KAV v6 MP4 are all due out at the beginning of October.

[gshaw]

Confirmed: removal of network agent on my test PC removed the logon lag!

 

Question is do we have to wait for the new release or can they fix the current agent I wonder... would love to have it working right before the start of term

[Norphy]

Do you by any chance have Adobe CS3/CS4 suite installed on your PCs? We're wondering here if the Bonjour service that Adobe so kindly install is ballsing things up for us. I'm disabling that and giving it a crack!

[Norphy]

Got a response from Kaspersky after I went home today, they think it may have something to do with it being a cloned image. They linked this page:

 

Troubleshooting

 

Worth a crack!

[gshaw]

Reading the artcile I don't think it affects us as I never install AV on the image for that reason... always goes on afterwards once the machine joins the domain.

 

Looks like waiting for the new version... gonna try out the beta on the spare machine today once I've re-imaged it again to clear out the previous mods

[gshaw]

Quick update for KAV users: the new MP4 AV version is now available with the revised admin kit and network agent

 

From initial testing it does seem to be considerably better than before, just need to reimage my test machine for a proper comparison but the signs are looking positive, much quicker boot and logon times so far.

 

Admin kit also seems to have included the long overdue removal of old AV software before KAV gets installed as a single deployment task

[DMcCoy]

MP4 is bloody awful DO NOT USE IT.

 

It slows everything down, there is a huge performance hit from the KLIF filter driver that kills things like Flash Professional. A simple animation without Kaspersky takes 20 seconds or less, with MP3 less than a minute, with MP4 it takes 6 or more minutes!

 

Outlook is slow, word is slow, IE is slow. Disabling and excluding processes does not work as the filter driver intercepts everything that windows accesses, uninstall is the only option.

 

If this was fixed then MP4 is actually much better in all other respects than MP3.

[gshaw]

Haven't had anything like that on the test machine so far... will have to delve a bit deeper and see if I can replicate any of those issues

[DMcCoy]

Technical support now report that this has been registered with the developers as an internal fault, only fixed by currently sticking with MP3.

 

As an example of what it can do they asked for a video of the application, I did just that. Without the filter driver loaded Flash professional took 22 seconds, with it took 755 seconds.