This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Kaspersky Updates blocked again

Hello,

A few weeks ago i had an issue with the updated being blocked, but it was a change at their end so i added a URL exception and it started working again. A few weeks go by and its blocked again. I dont see anything in web filter, and the firewall log viewer just has some unassociated packets. However, IPS log shows a block every few minutes:

2018-11-23 11:55:05

Signatures

Drop

10.10.10.XX

4.28.136.54

1245

SERVER-IIS ISAPI .idq access

Microsoft IIS web server

Windows

Server

07002

I'm not too eager to just not use IPS at all to test it even. Anyone come across this?

This thread was automatically locked due to age.

0 ADH over 6 years ago

Update: I figured out how to allow it in with a IPS bypass and the updates are working. I have asked Kaspersky to investigate but I'm can't see this being a bad implementation by them. Is there something wrong with the IPS signatures?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 6 years ago in reply to ADH

False Positive are something, which always can happen.

Ether can we update the signature of this IPS pattern, so it matches with the update traffic. Or Kaspersky changes something to match a existing pattern.

You should open a Support Case for this False Positive.
Cancel
Vote Up 0 Vote Down

Cancel
0 ADH over 6 years ago in reply to LuCar Toni

I've got two in one day i'm afraid. Now i have RDP one from 2009.... Will open a case but I think this will just be spinning my wheels and wasting time.
Cancel
Vote Up 0 Vote Down

Cancel