Kaspersky EAP

Alexander.Matrosov

@angeldragon, спасибо за пояснение, сейчас заведу баг.

Alexander.Matrosov

@<a href="/user/angeldragon" target="_blank" rel="noopener" data-username="ANGElDRAGON" data-uid="116">ANGElDRAGON</a>, я правильно понял, что после первого сканирования и обновления - FastStone Image Viewer успешно обновился без уведомлений с ошибкой, но после повторного сканирования продукт снова предложил обновить FastStone Image Viewer и при нажатии "Обновить" в этот раз уже появилось уведомление с ошибкой? Или ошибка появилась еще в первый раз?

Alexander.Matrosov

When viewing the details from the "All Events" section, the icon on the left is needed to indicate the category of the event. But when viewing the details from a specific section - there is no need to indicate a category with an icon (icon of section = icon of event category).

Alexander.Matrosov

Bug accepted (<a href="https://bug.kaspersky.com/issues/7823" target="_blank" rel="noopener">https://bug.kaspersky.com/issues/7823</a>). Its' status on this forum will be changed later

Alexander.Matrosov

Thanks for the information provided, but a similar dump has already been sent (3981660). The problem is fixed in the dev-build. Duplicate

Alexander.Matrosov

<ol>
<li><a href="https://docs.microsoft.com/en-us/windows/client-management/generate-kernel-or-complete-crash-dump" target="_blank" rel="noopener">https://docs.microsoft.com/en-us/windows/client-management/generate-kernel-or-complete-crash-dump</a></li>
<li>да, всё правильно поняли (+ собрать логи)</li>
</ol>

Alexander.Matrosov

@r3L4x, уже исправлено в dev-версиях продукта

<img src="https://cloud.qainfo.ru/index.php/apps/files_sharing/ajax/publicpreview.php?x=1920&y=619&a=true&file=fixed.PNG&t=055eIG23RQ9lT6M&scalingup=0" alt="" width="420" height="116" />

Alexander.Matrosov

передаю слова разработчиков:
<blockquote>
Для дальнейшего анализа нужен кернел дамп в момент, когда стало ясно, что обработка угрозы зависла.
<div>Также, помимо этого, надо проверить будет ли воспроизводиться бага с отключенным hips'ом. (в независимости от результата прошу предоставить логи продукта для этого случая)</div>
</blockquote>

Alexander.Matrosov

разработчики попросили воспроизвести баг на свежей версии продукта (скорее всего был исправлен совместно с другим багом)

Alexander.Matrosov

Разработчики попросили воспроизвести проблему с xperf и прислать новые логи.
<blockquote>
Как собрать ETW-трассировки для исследования проблем с производительностью
</blockquote>
<ol>
<li>
<blockquote>В Windows 10 все необходимое для записи трассировок уже есть, а на Windows 7/8/8.1, Server 2008R2/2012(R2) нужно установить Windows Performance Toolkit.Варианты установки:- Как часть <a href="http://www.microsoft.com/en-us/download/details.aspx?id=39982" target="_blank" rel="nofollow noopener">ADK for Windows 8.1</a>, при установке выбрать только "Windows Performance Toolkit".- <a href="https://cloud.qainfo.ru/s/9aA6bWMF8xVXxXb" target="_blank" rel="noopener">Отдельные инсталляторы</a>: - WPTx86-x86_en-us.msi - 32-разрядные версии Windows - WindowsWPTx64-x86_en-us.msi - 64-разрядные версии Windows</blockquote>
</li>
<li>
<blockquote>
Windows 7 x64, Server 2008R2: выполнить с правами администратора следующую команду, после чего перезагрузить Windows:
<div data-hasbody="true" data-macro-name="code">
<div>
<div>
<div id="highlighter_251810">
<div>
<div><code>wpr </code><code>-disablepagingexecutive</code> <code>on</code></div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</li>
<li>
<blockquote>
Включить запись трассировки. Для этого выполнить с правами администратора одну из следующих команд в зависимости от того, насколько легко воспроизвести требуемую проблему:
Стабильное воспроизведение:
<div data-hasbody="true" data-macro-name="code">
<div>
<div>
<div id="highlighter_793157">
<div>
<div><code>wpr </code><code>-start</code> <code>GeneralProfile.Light </code><code>-filemode</code> <code>-start</code> <code>CPU </code><code>-filemode</code> <code>-start</code> <code>FileIO.Light </code><code>-filemode</code></div>
</div>
</div>
</div>
</div>
</div>
Нестабильное воспроизведение в произвольные моменты времени:
<div data-hasbody="true" data-macro-name="code">
<div>
<div>
<div id="highlighter_54149">
<div>
<div><code>wpr </code><code>-start</code> <code>GeneralProfile.Light </code><code>-start</code> <code>CPU </code><code>-start</code> <code>FileIO.Light</code></div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</li>
<li>
<blockquote>
Воспроизвести проблему.
</blockquote>
</li>
<li>
<blockquote>
Выключить запись трассировки и сохранить ее в файл:
<div data-hasbody="true" data-macro-name="code">
<div>
<div>
<div id="highlighter_47501">
<div>
<div><code>wpr </code><code>-stop</code> <code>trace.etl</code></div>
</div>
</div>
</div>
</div>
</div>
Вместо trace.etl можно указать требуемый путь к файлу.
</blockquote>
</li>
<li>
<blockquote>Дождаться записи трассировки и передать получившийся файл для анализа в Performance Team.</blockquote>
</li>
</ol>

Alexander.Matrosov

@<a href="/user/r3l4x" target="_blank" rel="noopener" data-username="r3L4x" data-uid="93">r3L4x</a>, разработчики все же запросили дамп avp.exe ("Приложенный дамп является дампом GUI-процесса продукта (avpui.exe, запущен от DESKTOP-PC\r3L4x).Для анализа необходим дамп процесса avp.exe (запущен от системы) после зависания"). Если через таск менеджер проблемы с доступом, попробуй утилиту "kavlog" или "Debugging Tools for Windows" (подробнее - <a href="/topic/62/beta-testing-guide/4" target="_blank" rel="noopener">https://eap.kaspersky.com/topic/62/beta-testing-guide/4</a> )

Alexander.Matrosov

@<a href="/user/r3l4x" target="_blank" rel="noopener" data-username="r3L4x" data-uid="93">r3L4x</a>, разработчики просят еще раз перевоспроизвести проблему и предоставить следующие артефакты:
<ul>
<li>логи утилиты Process Monitor (Procmon.exe из SysinternalsSuite) за все время перевоспроизведения проблемы</li>
<li>дамп продукта в момент, когда стало ясно, что обработка угрозы зависла</li>
<li>ну и новые логи продукта, соответствующие повторному воспроизведению</li>
</ul>

Alexander.Matrosov

Передаю слова разработчиков:
<blockquote>
Был найден БСОД, содержащий в стеке драйвер kltap. Возможно, пользователя смутило, что в папке с трейсами не было продуктовых дампов - и это действительно так. Был БСОД C:\Windows\MEMORY.DMP
</blockquote>
Исходя из этого, продукт вел себя нормально. As design

Alexander.Matrosov

@virus_900, доброго дня! Как выше Дмитрий и просил, приложите, пожалуйста, допольнительные логи :
<div>"Для более детального изучения необходимо снять xperf по инструкции: </div>
<div><a href="https://mega.nz/#!K3oS1YYR!K04T64hy9nvvfiooaNj_eOKCXOW3Wjx6gDF4TPmbZfI" target="_blank" rel="noopener">https://mega.nz/#!K3oS1YYR!K04T64hy9nvvfiooaNj_eOKCXOW3Wjx6gDF4TPmbZfI</a></div>
<div>+ Приложить SystemInfo"</div>

Alexander.Matrosov

@kilo2, ответ разработчиков: "На хосте клиента установлено ПО CheckPoint - Endpoint Connect. Скорее всего именно оно выполняет редирект соединений на локальные адреса."

Alexander.Matrosov

@stanisluv, разработчики попросили при следующем подобном инциденте дополнительно снять логи <a href="https://support.kaspersky.ru/common/diagnostics/10935" target="_blank" rel="noopener">прокмона</a>.

Alexander.Matrosov

Section 7 - QA Info (external bug tracker)

<a href="http://bug.qainfo.ru/" target="_blank" rel="external nofollow noopener" data-cke-saved-href="http://qainfo.ru/redmine/">QA Info</a> is used for tracking the issues reported during beta-testing. It is based on the open bug tracking software Redmine and replaces the Google Docs used previously. The launch of the project was discussed in <a href="https://forum.kaspersky.com/index.php?showtopic=305041" target="_blank" rel="noopener" data-cke-saved-href="https://forum.kaspersky.com/index.php?showtopic=305041">this topic</a>.

1. Register and configure your account
Users who do not have an account at QA Info can only view issues which were already submitted to the tracker. If you want to make use of the features of the tracker you need to register an account:
Standard rights:
<ul>
<li>get notifications via email about news and changes to watched issues</li>
<li>confirm that a bug fix was fixed (by changing the status of an issue from fixed to closed)</li>
<li>discuss the problem with KL employees in the comments of an issue</li>
</ul>
Moderators, additionally:
<ul>
<li>submit new issues to the tracker</li>
<li>manage the news: add, edit and delete</li>
</ul>
KL employees, additionally:
<ul>
<li>edit all fields of an issue</li>
<li>manage projects</li>
</ul>

1.1. Register an account
You can register an account here: <a href="http://bug.qainfo.ru/account/register" target="_blank" rel="external nofollow noopener" data-cke-saved-href="http://qainfo.ru/redmine/account/register">http://bug.qainfo.ru/account/register</a>. The page should be displayed in your language automatically (based on browser settings).

Explanation of the fields:
<ul>
<li>Login: may contain Latin characters, numbers and some other characters</li>
<li>Nickname (KL Forum): in parenthesis enter your nick name used in the forum, for example: (JanRei)</li>
<li>Language: you can choose the language you want to use for the tracker, or select (auto) for letting Redmine choose the language automatically</li>
<li>User ID (KL Forum): enter your user ID in the forum. Specifying this information allows to quickly contact you in case more information is required about some issue. The ID is part of the URL to your profile, for example: <a href="https://forum.kaspersky.com/index.php?showuser=7141" target="_blank" rel="noopener" data-cke-saved-href="https://forum.kaspersky.com/index.php?showuser=7141">https://forum.kaspersky.com/index.php?showuser=7141</a> -> enter 7141</li>
</ul>

An example for filling the registration form:
<img src="http://img.qainfo.ru/img/2207.png" alt="" width="376" height="245" />
A few minutes after you have registered you should get an email from qa.info@bk.ru with instructions how to activate your account. In case there should be problems using the tracker please write a private message to <a href="https://forum.kaspersky.com/index.php?/profile/525625-ilya-zadonsky/" target="_blank" rel="noopener" data-cke-saved-href="https://forum.kaspersky.com/index.php?act=Msg&CODE=4&MID=525625">Ilya Zadonsky</a> (please use "QA Info" as subject).

1.2. Recommended settings
After you have activated your account it is recommended to change some settings on the page <a href="http://bug.qainfo.ru/my/account" target="_blank" rel="external nofollow noopener" data-cke-saved-href="http://qainfo.ru/redmine/my/account">My Account</a>:
<ul>
<li>check the option "Hide my email address"</li>
<li>specify your time zone</li>
<li>select your preferred method of notification by email</li>
</ul>

1.3. Personalization
Registered users can personalize <a href="http://bug.qainfo.ru/my/page" target="_blank" rel="external nofollow noopener" data-cke-saved-href="http://qainfo.ru/redmine/my/page">My Page</a>, and add the blocks of information: "Watched issues", "Latest news", "Calendar", "Documents" and "Spent time". Modules "Documents" and "Spent time" are not used, so do not add them to the page.
To configure your personal page select "My Page" in menu at the top of the page and then follow the link "Personalize this page". You can add a block by selecting it from the drop down menu and clicking on the "Add" button. Using the mouse you can then move the block at the position you like. By clicking on the X you can remove a block from the page. To complete the personalization click on "Back".

<img src="http://img.qainfo.ru/img/476.png" alt="" width="741" height="342" />
<img src="http://img.qainfo.ru/img/66e8.png" alt="" width="741" height="341" />

2. Working with external tracker
The home page of QA Info shows the latest news and a list of bug lists (projects) with recent changes.
Issues reported in the forum are transferred by moderators to the external bug tracker. In the forum post a link to the issue is added to the field "Reason for edit". Following the link you can view the current status of the issue and its history.

2.1. Description of the fields
When working with issues the following fields are used:
<ul>
<li>Tracker - indicates in which forum the issue was reported: Russian forum (RUS frm) or English forum (ENG frm)</li>
</ul>
<ul>
<li>Post - ID used in the link to the bug report in forum (value will be transformed into a link leading to the bug report), for example:
<ul>
<li><a href="https://forum.kaspersky.com/index.php?s=&showtopic=297701&view=findpost&p=2277595" target="_blank" rel="noopener" data-cke-saved-href="https://forum.kaspersky.com/index.php?s=&showtopic=297701&view=findpost&p=2277595">https://forum.kaspersky.com/index.php?s=&showtopic=297701&view=findpost&p=2277595</a> -> the ID is 2277595</li>
</ul>
</li>
</ul>
<ul>
<li>ID - number that identifies the issue in internal bug tracker of KL (value is a link which can only be used by employees)</li>
<li>Pri - indicates the priority of the issue:
<ul>
<li>4 (Low) - would like to fix but the product can be released as it is</li>
<li>3 (Medium) - should be fixed if time permits</li>
<li>2 (High) - must be fixed before release of the product</li>
<li>1 (Stop Bug) - must be fixed immediately, blocks further testing, very visible</li>
</ul>
</li>
<li>Status - shows the current status of the issue, possible values are:</li>
<li>.. - issue was added to the tracker, but was not yet processed by an employee</li>
<li>need more info - employees were unable to reproduce the issue, more information from the beta-tester are required for processing the bug report</li>
<li>rejected - the described behavior is not a bug (reason is specified by employee in comment) or required information were not provided</li>
<li>accepted - issue was reproduced by employee and was accepted</li>
<li>will be reviewed - issue or suggestion will be considered in future versions of the product</li>
<li>fixed - developers reported that the issue was fixed or the suggestion was implemented</li>
<li>reopened - according to beta-tester the issue was not fixed properly</li>
<li>closed - beta-tester or employee confirmed that the issue was fixed</li>
<li>Subject - brief description of the issue</li>
<li>Category - distinguishes between bug and suggestion</li>
<li>β-tester - the beta-tester who reported the issue</li>
<li>Soft - name of the affected product</li>
<li>Version - product version where the issue was reproduced</li>
<li>Lng - used localization (only applies to GUI/Help)</li>
<li>OS - name of the used operating system</li>
<li>VfT - status of Application Verifier and Driver Verifier (only applies to Crashes/Dumps/BSOD)</li>
<li>Description - detailed description of the issue</li>
<li>Watchers - list of users who will get notified about changes of the issue</li>
</ul>

2.2. Watching issues
You can receive notifications by email about issues depending on the account settings. The notifications will come from qa.info@bk.ru. In case you do not get the notifications please also check the spam folder. With default settings you will get notifications in the following situations:
<ul>
<li>news was published for the top-level project</li>
<li>you created an issue or issue was created in a watched project</li>
<li>watched issue or news was updated</li>
<li>issue or news was updated, where you have took part in the discussion</li>
</ul>

To subscribe to news or issues click on the link "Watch":
<img src="http://img.qainfo.ru/img/6ca.png" alt="" width="488" height="209" />

2.3. Participating in the discussion and changing of the status of an issue
By opening and editing an issue you can take part in the discussion. Fill in the field "Note" to add a comment. You can also change the value of some fields (for example, set the task status, version, product name, OS, ...). It depends on your rights which fields you are allowed to change.
<img src="http://img.qainfo.ru/img/78b.png" alt="" width="494" height="111" />
If an issue has the status fixed, users with standard rights can confirm the fix by changing the status to closed. Moderators can also re-open it and change the status to reopened.

2.4. Using filters
The tracker allows to show the submitted issues using predefined filters. They are listed in the sidebar. Some filters are only available for certain sub-projects:
<ul>
<li>Project groupe (all issues in "QA Info"): available for all projects, lists all open issues based on their project they belong to. If you want to use this filter go to "Projects" and then click on "View all issues" (<a href="../../redmine/issues" target="_blank" rel="external nofollow noopener" data-cke-saved-href="http://qainfo.ru/redmine/issues">http://qainfo.ru/redmine/issues</a>)</li>
<li>Status groupe (for all projects): available for all projects, issues are grouped by their status</li>
<li>Default View (dmp): used for sub-project "Crashes/Dumps/BSOD", additionally shows the columns "OS" (operating system) and "VfT" (Verifier status)</li>
<li>Default View (GUI): used for sub-project "GUI/Help", additionally shows the column "Lng" (localization)</li>
<li>Default View (W&D): used for sub-project "Wishes and deals" (suggestions for the bug tracker)</li>
</ul>

Alexander.Matrosov

Section 6 - Glossary and abbreviation expansion

Components of the product
<ul>
<li>Anti-Banner = component that blocks advertising information located on banners built into interfaces of various programs installed on your computer or displayed online.</li>
<li>Anti-Phishing = component that tracks attempts to open phishing websites and blocks them</li>
<li>Anti-Spam = component that allows detection of unwanted messages (spam)</li>
<li>AVZ = scripts to solve problems in the system</li>
<li>Exclusions & Trusted Zone = Exclusion is an object excluded from scanning by the product. Trusted zone is the user-created list of objects which should not be controlled by the product.</li>
<li>GUI = Graphical user interface</li>
<li>HIPS, Application Control = component that logs the actions performed by applications in the system, and manages the applications' activities, based on which group they belong to. A set of rules is defined for each group of applications.</li>
<li>IDS = Network Attack Blocker</li>
<li>IM AV = component that scans traffic of instant messengers (such as ICQ, AIM etc.)</li>
<li>Installer = the program installing the product or an application</li>
<li>Mail AV = Mail Anti-Virus scans incoming and outgoing messages for the presence of malicious objects</li>
<li>OAS = File Anti-Virus (On Access Scan)</li>
<li>ODS = On Demand Scan</li>
<li>PC, Parental Control = component that monitors the users' access to the Internet, in order to restrict access to some kind of resources or certain URLs.</li>
<li>PDM = Proactive defense</li>
<li>Qscan, Rootkit scan = technology of scanning hard-to-detect threats which hide the traces of their activity</li>
<li>Quarantine = folder where objects are saved in encrypted form, which rules out the threat of infection. It also stores backup copies of objects created before disinfection or deletion.</li>
<li>RD, Rescue Disk = component that creates a bootable disk to be able to boot a computer that is extremely infected and cannot be disinfected by anti-virus program.</li>
<li>Self-Defense = module that blocks closing the product or changing its settings independently from user's wish</li>
<li>SK, Safe Keyboard = technology allowing you to type personal data (such as passwords or credit card numbers) using your hardware keyboard while avoiding its interception by keyloggers, which are programs that register keystrokes.</li>
<li>SM, Safe Money = starts the browser in an isolated environment for safe online banking.</li>
<li>SW, System Watcher = system events monitor. It collects and saves different events logs and provides it to the product's components in order to detect events sequences that are characteristic to malware.</li>
<li>Updater = module for updating databases or the product's modules</li>
<li>VK, Virtual Keyboard = special tool for typing personal data (such as passwords or credit card numbers) to avoid its interception by keyloggers, which are programs that register keystrokes.</li>
<li>Vulnerability scan = scanning of vulnerabilities in the installed programs</li>
<li>Web AV, Web Anti-Virus = component that scans internet traffic.</li>
<li>WMUF = database of dangerous URLs</li>
</ul>

Version designations
<ul>
<li>Build = assembly, also last number of the product's version</li>
<li>Alpha-version = the beginning state of product's development, a version that may miss most of new functionality</li>
<li>Beta-version = a version that has the complete functionality and is ready to be tested by components</li>
<li>RC, Release Candidate = a build that can become the release</li>
<li>TR, Technical Release = a build technically ready to go in production (pending printing boxes, writing knowledge base or help content etc.)</li>
<li>CR, Commercial Release = the product on sale, the moment Technical support is responsible for the product</li>
<li>CF, Critical Fix = build fixing critical bugs in the product and possibly some new functionality</li>
<li>MP, Maintenance Pack / MR, Maintenance Release = package of updates. Found bugs are fixed as well as new functionality can be added there. This is analogous to Service Packs of Microsoft products.</li>
<li>Hotfix, Patch = urgent update fixing critical bugs</li>
</ul>

Other common terms
<ul>
<li>Alert = informational pop-up of the product that allows to choose an action</li>
<li>Balloon = informational window of the product</li>
<li>BSOD, Blue Screen of Death = window of blue colour that is shown on crash of the operating system</li>
<li>Bug = error in function of program or its interface</li>
<li>Case = scenario of testing or steps to reproduce a bug</li>
<li>Change log = list of changes of a certain build</li>
<li>Crash = abnormal closing of an application or operating system</li>
<li>GBT, Gold Beta Tester = the title the most active beta-testers are awarded with in the end of the product's development cycle</li>
<li>KL = Kaspersky Lab</li>
<li>Memory dump = file containing the complete data about system memory state at the moment of crash</li>
<li>Screenshot = image file taken by the computer to record the visible items displayed on the monitor</li>
<li>Traces = log files with all the actions performed by the product which help developers to localize and solve an issue</li>
<li>Tray = the area of taskbar (next to the system time) with icons of running applications</li>
<li>VirLab = Virus laboratory of KL</li>
</ul>

Alexander.Matrosov

Section 5 - Removing leftovers of the product after incorrect removal

A special utility can be used if leftovers remain after removal of the product, the regular removal does not work or it is rolled back automatically. You can find instructions regarding its use in this Knowledge Base article: <a href="http://support.kaspersky.com/common/service.aspx?el=1464" target="_blank" rel="external nofollow noopener" data-cke-saved-href="http://support.kaspersky.com/common/service.aspx?el=1464">http://support.kaspersky.com/common/service.aspx?el=1464</a>.

i | During beta-testing the utility might be not compatible yet with new products.

The following instruction describe how you can remove the product manually after booting Windows into safe mode. Not all leftovers are removed this way, but you should be able to reinstall it after that. Please reboot the system after you are done.

1) Remove the Kaspersky folders from:
<ul>
<li>32 bit: C:\Program Files</li>
<li>64 bit: C:\Program Files (x86)</li>
</ul>
 
<ul>
<li>Windows XP: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab</li>
<li>Windows Vista/7/8/10: C:\ProgramData\Kaspersky Lab</li>
</ul>
2) Remove all drivers kl* from C:\Windows\System32\drivers
3) Remove the following keys from registry:
<ul>
<li>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\kl*</li>
<li>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KL* (change the owner to Everyone before that)</li>
<li>HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab and HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab</li>
<li>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ (search for "Kaspersky" and remove both keys from Installer and Uninstall)</li>
</ul>
4) Remove the entries klmouflt and klkbdflt (only these entries) from followings keys:
<ul>
<li>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E96F-E325-11CE-BFC1-08002BE10318}\UpperFilters</li>
<li>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters</li>
</ul>
5) Remove the MSI file belonging to the product from C:\Windows\installer\ (can by identified by digital signature).

If the removal of the keys does not work try to change the permissions as described below. The general procedure should be the same in all Windows versions. However, the exact names of the options could be different.
1) Right click on the key and choose "Permissions".
2) Click on "Advanced" and select the tab "Owner".
3) Select "Everyone". If "Everyone" is not listed insert it manually via "Other users or groups" (simply write it into the text field).
4) Enable "Replace owner on subcontainers and objects".
5) Click on "Apply".
6) Select the tab "Permissions" and enable "Replace all child object permissions with inheritable permissions of this object".
7) Choose "Everyone" and click on "Edit".
8) Grant "Full Control" by ticking the corresponding checkbox.
9) Confirm all dialogs with "OK"/"Yes".

Alexander.Matrosov

Section 4 - Changing update servers and creating a Virtual Machine

Changing update servers
Sometimes Kaspersky Lab representatives may ask you to switch to another update server. In order to change the update source, go to: Settings > Additional > Update > Select update source > Add.

There, enter the address you got from the representative. Also disable "Kaspersky Lab update servers" and save changes if necessary. Start update after these steps. In some cases you may need to restart the computer after the update. Then try to reproduce the issue and let Kaspersky Lab representatives know of the results. Then follow their further instructions.

i | The databases on test update servers are updated less often than on the public ones. Please do not inform about this.
i | While testing a new patch you should stay on the test update server until it is officially available for all users. Otherwise there can be conflicts with patches released previously. If you want to switch back to official servers before the patch is released, it is recommended to reinstall the product.
! | In most cases, disabling the test update server does not result in updating from the public servers. Then you need to make additional steps to return to the default update servers: manually update the product from any of usual servers for example <a href="http://dnl-01.geo.kaspersky.com/" target="_blank" rel="external nofollow noopener" data-cke-saved-href="http://dnl-01.geo.kaspersky.com/">http://dnl-01.geo.kaspersky.com/</a> once. Afterwards you can disable all update sources except "Kaspersky Lab update servers".

Creating a Virtual Machine
1) Create a New Virtual Machine.
<a href="https://forum.kaspersky.com/uploads/monthly_12_2014/post-7141-1418658938.png" target="_blank" rel="noopener" data-cke-saved-href="https://forum.kaspersky.com/uploads/monthly_12_2014/post-7141-1418658938.png" data-fileid="303673"><img src="http://img.qainfo.ru/img/d06.png" alt="" width="329" height="281" /></a>
2) Select that the operating system will be installed later.
<img src="http://img.qainfo.ru/img/518.png" alt="" width="326" height="297" />
3) Choose the operating system that will be installed.
<img src="http://img.qainfo.ru/img/884.png" alt="" width="327" height="296" />
4) Provide a name for the virtual machine, so it can be distinguished from others. It is recommended to specify a convenient location of the machine. By default, it is quite deep in the user profile.
<img src="http://img.qainfo.ru/img/a7d.png" alt="" width="325" height="296" />
5) Specify the maximum size of the disk. Windows 7 needs 20 GB, for Windows XP only 10 GB are enough. Most importantly, choose the type of disk: it should be Split!
<img src="http://img.qainfo.ru/img/8e3.png" alt="" width="326" height="296" />
6) Everything is ready. If you want to change some settings of the virtual hardware, you can do this by clicking on the button "Customize Hardware". This is usually not required.
<img src="http://img.qainfo.ru/img/bb8.png" alt="" width="326" height="295" />
7) After creating the machine, simply run it and install the system. Then reproduce the problem, shut down the system and send the machine to us.
<img src="http://img.qainfo.ru/img/c46.png" alt="" width="330" height="261" />

Kaspersky EAP

Alexander.Matrosov

Posts