topic Re: Problems after Update to DHS Compliant Version in Endpoint

Problems after Update to DHS Compliant Version

mbaerwolff — Tue, 27 Aug 2024 08:35:43 GMT

Since the update of the Anti-Malware Engine, we have had massive problems with various programs. In some cases, .exe files that previously worked without any problems are moved to quarantine. However, this does not affect all clients. The exceptions that we define do not have the desired effect.
Do any of you have the same effects or possible recommended settings?

Re: Problems after Update to DHS Compliant Version

G_W_Albrecht — Tue, 27 Aug 2024 09:09:45 GMT

Have you opened an SR# with CP TAC already ? If exceptions do not work this should be the first step.

Re: Problems after Update to DHS Compliant Version

the_rock — Tue, 27 Aug 2024 12:27:44 GMT

I saw someone mention they had issue with forensic service confuming high CPU, but yes, I would definitely contact TAC about the issue.

Re: Problems after Update to DHS Compliant Version

G_W_Albrecht — Tue, 27 Aug 2024 12:29:24 GMT

Sorry, but this is off topic - the issue is with non-Kaspersky AV/AM engine, not forensics....

Re: Problems after Update to DHS Compliant Version

the_rock — Tue, 27 Aug 2024 12:41:29 GMT

Not really off topic, as issue happened AFTER update to DHS compliant version...

Re: Problems after Update to DHS Compliant Version

JonnyRabinowitz — Tue, 27 Aug 2024 21:06:54 GMT

If you look at under "Logs" tab for the forensic log entries for these detections, what is in the "Protection Type" field?

Want to confirm specifically what is making the detections

Re: Problems after Update to DHS Compliant Version

G_W_Albrecht — Wed, 28 Aug 2024 07:15:06 GMT

You did not write that...

Re: Problems after Update to DHS Compliant Version

mbaerwolff — Wed, 28 Aug 2024 09:41:45 GMT

Yes, I have opened a case, but the first recommandation was to deactivate the security settings at the policy.

Re: Problems after Update to DHS Compliant Version

mbaerwolff — Wed, 28 Aug 2024 09:48:15 GMT

For one application I see URL Reputation - Forensics. However, the log message goes on to say which applications have been moved to quarantine.
No log entries are created for other applications although the program freezes and crashes.

Re: Problems after Update to DHS Compliant Version

the_rock — Wed, 28 Aug 2024 12:01:30 GMT

Haha...never mind mate, I was more referring to an issue with DHS compliant version.

Cheers,

Andy

Re: Problems after Update to DHS Compliant Version

G_W_Albrecht — Fri, 30 Aug 2024 07:54:31 GMT

Forensics is the reason for 80% of our customers EPS tickets with CP...

Re: Problems after Update to DHS Compliant Version

G_W_Albrecht — Thu, 05 Sep 2024 07:20:45 GMT

One of our partners customer also is experiencing this issue - RDS server after upgrade to DoC compliant version E88.32 has EPS client crashing 32 times in 2 days !SR# is open with TAC now.

Re: Problems after Update to DHS Compliant Version

the_rock — Fri, 30 Aug 2024 11:59:01 GMT

My colleague was telling me it happened with only 3 users so far out of 300+, so its not that bad at all, thats 1%.

Re: Problems after Update to DHS Compliant Version

the_rock — Fri, 30 Aug 2024 11:59:57 GMT

Ouch...mind sharing exact reason for the crash? MY colleague told me one of our customers also has same problem on few machines, but I did not inquire further.

Andy

Re: Problems after Update to DHS Compliant Version

G_W_Albrecht — Fri, 30 Aug 2024 13:08:23 GMT

The update did it - worked OK before. First solution attempt from TAC is to completely uninstall and re-install the client...

Re: Problems after Update to DHS Compliant Version

the_rock — Fri, 30 Aug 2024 13:26:43 GMT

Thats usually first step, sometimes it does work...

Re: Problems after Update to DHS Compliant Version

Wolfgang — Wed, 04 Sep 2024 12:40:59 GMT

@G_W_Albrecht does uninstall and reinstall solved the problems ? We are facing more and more problems with other customers after changing to DoC compliant version.

Re: Problems after Update to DHS Compliant Version

the_rock — Wed, 04 Sep 2024 13:10:13 GMT

I will ask one of my colleagues about it as well.

Andy

Re: Problems after Update to DHS Compliant Version

G_W_Albrecht — Thu, 05 Sep 2024 07:15:48 GMT

I would appreciate if someone tries that ! The RDS with the issue is in production and has over 60 users, so any change is only hard to do and has to be allowed by the customer. I would appreciate if this could be replicated by CP in Lab ! Last solution attempt was to update BIOS and all driver on the server, which is hard to do in a Hyper-V VM 8) So i have now escalated the case.

Re: Problems after Update to DHS Compliant Version

G_W_Albrecht — Mon, 09 Sep 2024 09:40:08 GMT

Did TAC come up with something usefull ? Our TAC case seems to run silently nowhere - also, they did not confirm that it is a known issue...