7 Replies Latest reply on Dec 18, 2008 3:30 AM by phoffmann

    Installing antivirus fails

    Apprentice

      Landesk AV will not install on some clients in our organisation

      using the command

      c:\program files\Landesk\ldclient\vulscan.exe /installav /showui

      The program fails when it trys to download klif.sys via http from the ldlogon/antivirus directory on the core

      This file does exist and it is readable via IE however it fails when the app trys to retrieve it

       

      Tim

        • 1. Re: Installing antivirus fails
          phoffmann SupportEmployee

          Hmm - check the IIS log on the Core ... check for entries for KLIF.SYS - see if there's a non-2xx code out there. If you're not sure how to read an IIS-log, paste any lines mentioning KLIF.SYS in here.

           

          Also, "just because" IIS can access a file doesn't mean the client will be able to (I've found out, with much frustration) ... so double-checking by running FILEMON against your Core's ANTIVIRUS directory may help you see clearly a "access denied" or somesuch, hinting to an NTFS or even a STREAMS problem.

           

          For STREAMS, please check this document (Alternate Data Streams are LOTS of fun...):

          http://community.landesk.com/support/docs/DOC-1002

           

          Hope this helps.

           

          Paul Hoffmann

          LANDesk EMEA Technical Lead

          • 2. Re: Installing antivirus fails
            Apprentice

            This is the line from the iis log

            2008-12-17 16:52:13 W3SVC1 192.168.4.62 HEAD /ldlogon/antivirus/klif.sys - 80 - 192.168.5.88 2576-LANDeskDownloader 200 0 0

            • 3. Re: Installing antivirus fails
              Apprentice

              Filemon shows

              17:10:52 w3wp.exe:868 OPEN D:\Program Files\LANDesk\ManagementSuite\ldlogon\antivirus\klif.sys SUCCESS Options: Open NoBuffer Access: Read
              17:10:52 w3wp.exe:868 QUERY INFORMATION D:\Program Files\LANDesk\ManagementSuite\ldlogon\antivirus\klif.sys BUFFER OVERFLOW FileFsVolumeInformation
              17:10:52 w3wp.exe:868 QUERY INFORMATION D:\Program Files\LANDesk\ManagementSuite\ldlogon\antivirus\klif.sys BUFFER OVERFLOW FileAllInformation
              17:10:52 w3wp.exe:868 CLOSE D:\Program Files\LANDesk\ManagementSuite\ldlogon\antivirus\klif.sys SUCCESS 

              • 4. Re: Installing antivirus fails
                Apprentice

                This appears to be a permissions related issue on the local drive as I am unable to delete klif.sys file from the c:\Program Files\Landesk\LDClient\Antivirus directory

                 

                Tim

                • 5. Re: Installing antivirus fails
                  phoffmann SupportEmployee

                  NOT necessarily permissions...

                   

                  Can also be a file-lock.

                   

                  Get Process Explorer from www.microsoft.com and get use the "find handle" for "klif.sys" -- that should help you find out what process(-es) you need to kill in order to delete the KLIF.SYS on the client, in order to be able to properly update it (were it a DLL, I'd say use "FIND DLL..." but since it isn't...).

                   

                  This is not something that should be a regular thing, but in some cases there's some obscure processes who lock down this or that DLL ... first time for me that I see it on the KLIF.SYS personally ... hope this helps .

                   

                  Paul Hoffmann

                  LANDesk EMEA Technical Lead

                  • 6. Re: Installing antivirus fails
                    Apprentice

                    I went to process explorer first. no handles for the file.

                    I renamed the antivirus folder and was able to install

                     

                    Tim

                    • 7. Re: Installing antivirus fails
                      phoffmann SupportEmployee

                      Huh - strange ... but ah well - at least the source of evil was found and worked around .

                       

                      Paul Hoffmann

                      LANDesk EMEA Technical Lead.