Windows Blue Screen (BSOD) crash during Kaspersky AV scan

  • 7020166
  • 03-Jun-2017
  • 17-Aug-2017

Environment

Micro Focus Filr 3.2 Desktop client
Novell Filr 2.0 Desktop client

Situation

On some Windows 7 systems, a Windows Blue Screen (BSOD) crash is seen when the Kaspersky Anti Virus file scan is in progress. The driver which causes the crash is 'fltmgr.sys'. The problem is seen even if the Filr folder is excluded from the file scan.

There are 2 scenarios under which the crash has been reported:

Scenario 1 - Kaspersky AV scan is run on entire system
In this scenario, the scan is run on the entire system including the drive where the Filr folder is located. When the scan reaches the Filr root folder, the crash is reported.

Scenario 2 - Kaspersky AV scan is run on a Filr sub-folder
In this scenario, a selective scan is run on one of the Filr sub-folders such as My Files, Net Folders, Shared with me, etc. During this selective scan, the crash is reported.

Resolution

A fix for the issue described in Scenario 1 is available in the Filr 3.2 Update.

A fix for the issue described in Scenario 2 is available in the Filr 3.2.1 Update but disabled by default. To enable this fix, please follow the following steps on the client system:
       Note: Enabling this fix will have some performance impact on the client system
  1. Open Windows Registry Editor: In the Windows Search box or Run window, type regedit and press Enter
  2. Open HKEY_LOCAL_MACHINE\SOFTWARE\Novell\Filr
  3. Add a DWORD value with name "ListSubRootLevel" (if not already defined)
  4. Edit the value for "ListSubRootLevel" and set it to 1
  5. Restart Desktop client


Additional Information

Note that the Kaspersky AV process (avp.exe) must be in the list of Blacklisted processes (see Filr Administration Guide for more details).
The fix for this issue also helps in lowering the CPU utilization on the Filr Search appliance(s) caused due to the AV scan.