Can you not tell Kaspersky that RecorderApp.exe is okay to run ?

It seems that Kaspersky has marked as high-risk several instances of Recorder.exe and RecorderApp.exe historically, despite there only being two versions of each on our network (the old installation and the new one, the latter only went in yesterday). When we look in Kaspersky some of these are capitalised and some not. We can add exceptions to Kaspersky, in order to allow access, but only once for each filename, so the problem doesn't go away.

It seems the presence of records in Kaspersky's risk tables of old historic installations of the software can be distinguished from newer ones by some parts of the firewall system, but not by the exceptions part.

Now we just need to find out how to remove the older high risk references from Kaspersky. Looks like there is no way the user can do this, unless anyone knows otherwise.

Just a couple of things you've probably already tried in vain:
* tried "run as admin" on RecorderApp.exe?
* what about renaming RecorderApp.exe to something different (all in one case..) and telling Kaspersky to except that?

Still not getting much feedback on this one, but I am going to keep posting, partly in the hope that it will one day be of use to someone else, but I also have a specific question for Mike, John and Sally (of which more later).

So at present we still have two installations of R6, both on the latest version, running on separate fileservers, but which are becoming increasingly out of step as we are still entering data into the old one (I will backup and restore to the new one once we have got the new installation running as it should.

The old installation uses the older copy of the database under SQL Server 2000, this now works on only three of our workstations, two running Windows 7 and one XP. These are the machines I haven't touched yet and our "live" database.

The new installation has a copy of the same database under SQL Server 2012. On two XP workstations we have remapped the drive assignments so the Z: drive points to the new fileserver and uninstalled and reinstalled workstation software, using the copy of WorkstationSetup.exe also on the new fileserver. These did both function correctly for a while with the new db, but now neither work ('Error accessing the OLE registry').

Two further workstations running Windows 7 have been treated in exactly the same way. One will not run R6, crashing on start-up with the '%1 can't be found' error described above. If we turn off Kaspersky entirely it functions normally, but disabling all the individual components of Kaspersky, including the firewall does not work. The second used to behave the same way, but now has a different error instead (not being able to access the OLE Registry).

We also have R6 workstation installed on a remote access terminal running Windows Server 2008 R2. This was the first one we tried to fix and it worked almost straight away (or at least appeared to) without errors. However it transpires that it sees only the old copy of the database, despite being installed using the  WorkstationSetup.exe on the new fileserver.

If this was not confusing enough, I have now found that on the first Windows 7 machine described above, if I navigate to the new fileserver and double-click either Recorder.exe, or RecorderApp.exe (rather than using the desktop icon created on install), I get the %1 error, but if I navigate to the OLD fileserver and do the same R6 opens normally, but sees the NEW copy of the database.

Clearly we have a problem with something to do with the drive mapping, or the local registry entries. Whatever the problem is, it manifests in a way which is dependent on some basic part of the Kaspersky software, but Kaspersky are unable to find anything untoward on our system.

So my question to Mike, John and Sally is as follows: Can any of you explain to me what actually happens when we run WorkstationSetup.exe? How does the installer decide which SQLServer instance to use and where does it get the various path settings for the registry? Also how good is the uninstaller at removing old registry settings and how does it recreate the HKEY_LOCAL_USERS keys for each new user.

As an illustration of the problem, our ITC just uninstalled the workstation from the remote access terminal (Windows Server 2008 R2), then reinstalled it (as administrator), it performed exactly as you would wish and opened correctly with the new db. But when I try to open recorder on the same machine (not as admin) I get an error (Map Files Path setting incorrect or missing, we get this often with new installs). On checking the settings keys in HKEY_LOCAL_USERS (I am now the user), most of the path settings (which should begin Z:/, the path to the new fileserver R6 folder), actually begin with \\wwt-sql01\, which is the path to the OLD fileserver and clearly date from a previous install. So it seems to work for the person who installed it, but not for anyone else.

Still on the remote access machine we have now uninstalled the workstation software again and are attempting to run a registry cleaner to remove references to earlier installs. Next we will try to reinstall again. Will it work? I am not all that hopeful.

Rob
I just found the attachment Mike sent me with one of your LastError.txt files, so ignore my last request. I'll post back when I've checked it out...
John

Hi John

Thanks for getting back to me. Your reply is pretty much as we had surmised, as you will have seen from the email. From memory I think the copy of LastError.txt I sent you was created on workstation setup. I am not sure if the one generated when we actually try to run Recorder is the same or different. I will check whether we have one.

Ah, interesting. I just went to run Recorder for the first time today, in the hope of creating a new Lasterror.txt to send you. What do you know? It opened without incident. No error.

This is not the first time this has happened, but so far it has never proved stable over more than an hour or two. Should be interesting, because we have a service call with Kaspersky scheduled in about 20 minutes & if we have no error, we won't be able to get very far.

Anyway I have located a copy of Lasterror.txt created yesterday afternoon, which I assume is the one from running recorder, because I had stopped reinstalling by then. I will paste it below. If it is not identical to the previous one I sent, then it will definitely be the one triggered by Recorder.exe.

After we have spoken with Kaspersky I will get back to you.

date/time         : 2013-10-10, 16:11:39, 389ms
computer name     : WWT-0001
user name         : ict <admin>
registered owner  : user
operating system  : Windows 7 Tablet PC x64 Service Pack 1 build 7601
system language   : English
system up time    : 1 day 7 hours
program up time   : 333 milliseconds
processors        : 8x Intel(R) Xeon(R) CPU W3520 @ 2.67GHz
physical memory   : 14512/18423 MB (free/total)
free disk space   : (C:) 306.93 GB (Y:) 85.88 GB
display mode      : 1920x1080, 32 bit
process id        : $1778
allocated memory  : 30.99 MB
command line      : RecorderApp.exe /3804228
executable        : RecorderApp.exe
exec. date/time   : 2013-07-11 16:25
compiled with     : Delphi 7
madExcept version : 3.0n
callstack crc     : $4e188f1d, $5f148b1b, $5f148b1b
exception number  : 1
exception class   : EOleSysError
exception message : %1 could not be found.

main thread ($d20):
005265ac RecorderApp.exe ComObj             OleError
005265c4 RecorderApp.exe ComObj             OleCheck
005aafcd RecorderApp.exe ComServ            LoadTypeLibrary
005ab684 RecorderApp.exe ComServ            TComServer.LoadTypeLib
005ab554 RecorderApp.exe ComServ            TComServer.GetTypeLib
00525d8f RecorderApp.exe ComObj             TTypedComObjectFactory.Create
0052624e RecorderApp.exe ComObj             TAutoObjectFactory.Create
00a5f148 RecorderApp.exe MapClasses  340 +1 initialization
00405120 RecorderApp.exe System             InitUnits
00405186 RecorderApp.exe System             @StartExe
00407f5e RecorderApp.exe SysInit            @InitExe
00a91a68 RecorderApp.exe RecorderApp 335 +0 initialization
76b03368 kernel32.dll                       BaseThreadInitThunk

modules:
00230000 C4DLL.DLL       1.0.0.1            Y:
002a0000 MS5User.Dll     5.0.0.4            Y:
00400000 RecorderApp.exe                    Y:
00d80000 ms5cnv.dll      5.0.0.10           Y:
10000000 MS5.Dll         5.0.0.12           Y:
531f0000 HHCtrl.ocx      6.1.7600.16385     C:\Windows\system32
53280000 odbc32.dll      6.1.7601.17514     C:\Windows\system32
584c0000 odbcint.dll     6.1.7600.16385     C:\Windows\system32
59360000 olepro32.dll    6.1.7601.17514     C:\Windows\system32
60480000 SHFolder.dll    6.1.7600.16385     C:\Windows\system32
6b8b0000 uxtheme.dll     6.1.7600.16385     C:\Windows\system32
6cdc0000 tiptsf.dll      6.1.7600.16385     C:\Program Files (x86)\Common Files\microsoft shared\ink
6cec0000 dwmapi.dll      6.1.7600.16385     C:\Windows\system32
6e6f0000 winmm.dll       6.1.7601.17514     C:\Windows\system32
72d20000 winspool.drv    6.1.7601.17514     C:\Windows\system32
72d80000 mpr.dll         6.1.7600.16385     C:\Windows\system32
73dc0000 comctl32.dll    5.82.7601.17514    C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af
744b0000 oleacc.dll      7.0.0.0            C:\Windows\system32
74600000 wsock32.dll     6.1.7600.16385     C:\Windows\system32
746f0000 gdiplus.dll     6.1.7601.18120     C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36
74920000 version.dll     6.1.7600.16385     C:\Windows\system32
74d40000 CRYPTBASE.dll   6.1.7600.16385     C:\Windows\syswow64
74d50000 SspiCli.dll     6.1.7601.17856     C:\Windows\syswow64
74fc0000 NSI.dll         6.1.7600.16385     C:\Windows\syswow64
74fd0000 IMM32.DLL       6.1.7601.17514     C:\Windows\system32
75030000 KERNELBASE.dll  6.1.7601.18229     C:\Windows\syswow64
75080000 ADVAPI32.dll    6.1.7601.17514     C:\Windows\syswow64
752c0000 oleaut32.dll    6.1.7601.17676     C:\Windows\syswow64
75350000 GDI32.dll       6.1.7601.17514     C:\Windows\syswow64
755e0000 user32.dll      6.1.7601.17514     C:\Windows\syswow64
75720000 shell32.dll     6.1.7601.18222     C:\Windows\syswow64
76380000 ole32.dll       6.1.7601.17514     C:\Windows\syswow64
766b0000 LPK.dll         6.1.7600.16385     C:\Windows\syswow64
76750000 USP10.dll       1.626.7601.18009   C:\Windows\syswow64
767f0000 WS2_32.dll      6.1.7601.17514     C:\Windows\syswow64
76830000 msvcrt.dll      7.0.7601.17744     C:\Windows\syswow64
768f0000 comdlg32.dll    6.1.7601.17514     C:\Windows\syswow64
76970000 SHLWAPI.dll     6.1.7601.17514     C:\Windows\syswow64
76af0000 kernel32.dll    6.1.7601.18229     C:\Windows\syswow64
76c10000 CLBCatQ.DLL     2001.12.8530.16385 C:\Windows\syswow64
76ca0000 MSCTF.dll       6.1.7600.16385     C:\Windows\syswow64
76d70000 RPCRT4.dll      6.1.7601.18205     C:\Windows\syswow64
76e60000 sechost.dll     6.1.7600.16385     C:\Windows\SysWOW64
77300000 ntdll.dll       6.1.7601.18229     C:\Windows\SysWOW64

processes:
0000 Idle                        0 0    0
0004 System                      0 0    0
01a0 smss.exe                    0 0    0
0200 csrss.exe                   0 0    0
0248 wininit.exe                 0 0    0
025c csrss.exe                   1 0    0
0280 services.exe                0 0    0
029c lsass.exe                   0 0    0
02a4 lsm.exe                     0 0    0
0304 svchost.exe                 0 0    0
0368 winlogon.exe                1 0    0
0384 svchost.exe                 0 0    0
03c8 RapportMgmtService.exe      0 0    0
0204 atiesrxx.exe                0 0    0
02d8 svchost.exe                 0 0    0
0394 svchost.exe                 0 0    0
0420 svchost.exe                 0 0    0
0440 svchost.exe                 0 0    0
0528 svchost.exe                 0 0    0
055c atieclxx.exe                1 0    0
05cc wisptis.exe                 1 0    0
0634 spoolsv.exe                 0 0    0
0650 svchost.exe                 0 0    0
06c8 armsvc.exe                  0 0    0
06e8 BingDesktopUpdater.exe      0 0    0
0734 mDNSResponder.exe           0 0    0
0760 svchost.exe                 0 0    0
079c klnagent.exe                0 0    0
07cc LSSrvc.exe                  0 0    0
07e0 nassvc.exe                  0 0    0
0b3c svchost.exe                 0 0    0
0b5c svchost.exe                 0 0    0
0870 WUDFHost.exe                0 0    0
0c74 NASvc.exe                   0 0    0
04fc SearchIndexer.exe           0 0    0
0b28 taskhost.exe                1 26   21  normal
0e90 wisptis.exe                 1 436  166 high
0e88 TabTip.exe                  1 265  67  high
0df8 TabTip32.exe                1 4    6   normal       C:\Program Files (x86)\Common Files\Microsoft Shared\Ink
0d6c dwm.exe                     1 17   2   normal
0c98 explorer.exe                1 486  273 normal
0310 LightScribeControlPanel.exe 1 52   22  normal       C:\Program Files (x86)\Common Files\LightScribe
0e7c VMonitor.exe                1 16   11  normal       C:\Program Files (x86)\Vimicro Corporation\VMUVC
12cc InputPersonalization.exe    1 9    5   below normal
05a8 OUTLOOK.EXE                 1 1030 533 normal       C:\Program Files (x86)\Microsoft Office\Office15
1434 mstsc.exe                   1 140  81  normal
11e8 mstsc.exe                   1 90   69  normal
16ac mstsc.exe                   1 110  71  normal
1328 chrome.exe                  1 134  64  normal       C:\Program Files (x86)\Google\Chrome\Application
13c4 chrome.exe                  1 13   3   normal       C:\Program Files (x86)\Google\Chrome\Application
0294 chrome.exe                  1 16   1   below normal C:\Program Files (x86)\Google\Chrome\Application
1b00 chrome.exe                  1 1184 1   below normal C:\Program Files (x86)\Google\Chrome\Application
1050 chrome.exe                  1 10   1   normal       C:\Program Files (x86)\Google\Chrome\Application
0d70 chrome.exe                  1 9    1   normal       C:\Program Files (x86)\Google\Chrome\Application
1bb8 chrome.exe                  1 10   1   normal       C:\Program Files (x86)\Google\Chrome\Application
11f0 chrome.exe                  1 371  1   below normal C:\Program Files (x86)\Google\Chrome\Application
1bf8 audiodg.exe                 0 0    0
1360 avp.exe                     1 24   15  normal       C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows
1820 avp.exe                     0 0    0
1988 WmiPrvSE.exe                0 0    0
0748 wmi64.exe                   0 0    0
1180 SearchProtocolHost.exe      0 0    0
1700 SearchFilterHost.exe        0 0    0   idle
1b9c Recorder.exe                1 41   25  normal       Y:
1778 RecorderApp.exe             1 71   44  normal       Y:

hardware:
+ Computer
  - ACPI x64-based PC
+ Disk drives
  - Generic- Compact Flash USB Device
  - Generic- MS/MS-Pro USB Device
  - Generic- SD/MMC USB Device
  - Generic- SM/xD-Picture USB Device
  - ST31000524AS ATA Device
  - ST3500418AS ATA Device
+ Display adapters
  - ATI FirePro V3700 (FireGL) (driver 8.911.3.1000)
+ DVD/CD-ROM drives
  - HL-DT-ST BD-RE  BH08LS20 ATA Device
  - Optiarc DVD RW AD-7230S ATA Device
+ Floppy drive controllers
  - Standard floppy disk controller
+ Human Interface Devices
  - HID-compliant consumer control device
  - HID-compliant device
  - HID-compliant device
  - HID-compliant device
  - HID-compliant device
  - HID-compliant device
  - HID-compliant device
  - HID-compliant device
  - Microsoft Input Configuration Device
  - Microsoft Input Configuration Device
  - USB Input Device
  - USB Input Device
  - USB Input Device
  - USB Input Device
  - USB Input Device
  - USB Input Device (Logitech Download Assistant) (driver 1.10.77.0)
+ IDE ATA/ATAPI controllers
  - ATA Channel 0
  - ATA Channel 1
  - ATA Channel 3
  - ATA Channel 4
  - ATA Channel 5
  - Standard AHCI 1.0 Serial ATA Controller
+ Keyboards
  - HID Keyboard Device
  - HID Keyboard Device
+ Mice and other pointing devices
  - HID-compliant mouse
  - HID-compliant mouse
  - HID-compliant mouse
+ Monitors
  - Generic PnP Monitor
  - Generic PnP Monitor
+ Network adapters
  - Broadcom NetXtreme Gigabit Ethernet (driver 10.100.4.0)
+ Portable Devices
  - I:\
  - K:\
  - L:\
  - O:\
+ Processors
  - Intel(R) Xeon(R) CPU           W3520  @ 2.67GHz
  - Intel(R) Xeon(R) CPU           W3520  @ 2.67GHz
  - Intel(R) Xeon(R) CPU           W3520  @ 2.67GHz
  - Intel(R) Xeon(R) CPU           W3520  @ 2.67GHz
  - Intel(R) Xeon(R) CPU           W3520  @ 2.67GHz
  - Intel(R) Xeon(R) CPU           W3520  @ 2.67GHz
  - Intel(R) Xeon(R) CPU           W3520  @ 2.67GHz
  - Intel(R) Xeon(R) CPU           W3520  @ 2.67GHz
+ Security Devices
  - Broadcom Trusted Platform Module (A2), v1.2
+ Sound, video and game controllers
  - High Definition Audio Device
+ Storage volume shadow copies
  - Generic volume shadow copy
  - Generic volume shadow copy
+ System devices
  - ACPI Fixed Feature Button
  - ACPI Power Button
  - Composite Bus Enumerator
  - Direct memory access controller
  - File as Volume Driver
  - Generic Bus
  - High Definition Audio Controller
  - High precision event timer
  - Intel(R) 5520/5500/X58 I/O Hub Control Status and RAS Registers - 3423
  - Intel(R) 5520/5500/X58 I/O Hub GPIO and Scratch Pad Registers - 3422
  - Intel(R) 5520/5500/X58 I/O Hub PCI Express Root Port 1 - 3408
  - Intel(R) 5520/5500/X58 I/O Hub PCI Express Root Port 3 - 340A
  - Intel(R) 5520/5500/X58 I/O Hub PCI Express Root Port 7 - 340E
  - Intel(R) 5520/5500/X58 I/O Hub System Management Registers - 342E
  - Intel(R) 5520/5500/X58 I/O Hub to ESI Port - 3405
  - Intel(R) 82801 PCI Bridge - 244E
  - Intel(R) Chipset QuickData Technology device - 3429
  - Intel(R) Chipset QuickData Technology device - 342A
  - Intel(R) Chipset QuickData Technology device - 342B
  - Intel(R) Chipset QuickData Technology device - 342C
  - Intel(R) Chipset QuickData Technology device - 3430
  - Intel(R) Chipset QuickData Technology device - 3431
  - Intel(R) Chipset QuickData Technology device - 3432
  - Intel(R) Chipset QuickData Technology device - 3433
  - Intel(R) ICH10 Family PCI Express Root Port 1 - 3A40
  - Intel(R) ICH10 Family PCI Express Root Port 5 - 3A48
  - Intel(R) ICH10 Family SMBus Controller - 3A30
  - Intel(R) ICH10R LPC Interface Controller - 3A16
  - Microsoft ACPI-Compliant System
  - Microsoft System Management BIOS Driver
  - Microsoft Virtual Drive Enumerator Driver
  - Motherboard resources
  - Numeric data processor
  - PCI bus
  - Plug and Play Software Device Enumerator
  - Programmable interrupt controller
  - Remote Desktop Device Redirector Bus
  - System CMOS/real time clock
  - System speaker
  - System timer
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - UMBus Enumerator
  - UMBus Enumerator
  - UMBus Root Bus Enumerator
  - Volume Manager
+ Universal Serial Bus controllers
  - Intel(R) ICH10 Family USB Enhanced Host Controller - 3A3A
  - Intel(R) ICH10 Family USB Enhanced Host Controller - 3A3C
  - Intel(R) ICH10 Family USB Universal Host Controller - 3A34
  - Intel(R) ICH10 Family USB Universal Host Controller - 3A35
  - Intel(R) ICH10 Family USB Universal Host Controller - 3A36
  - Intel(R) ICH10 Family USB Universal Host Controller - 3A37
  - Intel(R) ICH10 Family USB Universal Host Controller - 3A38
  - Intel(R) ICH10 Family USB Universal Host Controller - 3A39
  - USB Composite Device
  - USB Mass Storage Device
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub

Just noticed your last reply John.

Can you let me know if either of the two error reports posted above relate also to loading the Recorder type library? That would at least narrow things down a bit.

Do you have any comments as to why this particular error should occur on the machines where we have installed the new copy of the db, under SQL Server 2012, but does not happen on identical W7 machines still accessing the old SQL Server 2000 db?

No, that didn't work, back to the drawing board.

Was there ever a resolution to this "%1 could not be found"? I'm unable to install any workstations at all no matter how I try having migrated my server. I can still install workstations from the old server quite happily.

Many thanks Rob. I've disabled ESET Endpoint Security and it still fails. Our IT have checked sharing and security (I have Full Control) and they can't see anything wrong either. It even crashed with the same failure uninstalling. Bit of a showstopper for my Recorder 6 users who can't migrate to the new server until this is sorted. I'm ok as I run workstation on the server accessed via remote terminal services.

OK we now have something approaching closure on this one, so I will try and summarise for the benefit of future sufferers.

Firstly despite the best efforts of all concerned (mostly myself, Mike Weideli and Alex our ITC) we are nowhere closer to finding the cause of this problem, but we have a fix which works for us here (and I have tested it comprehensively).

Amid all the variables, the only constant we have is SQLserver 2012 causing the problem on any machine which has previously had an installation of Recorder 6 using our older SQL2000 db. I have successfully installed R6 to four brand new machines without problems. Even that is not the full story as we did have the problem on one brand new machine (installed by Alex not me) and even after doing a complete format & reinstall on my own workstation, I still get the problem.

Furthermore the physical location of the workstation, or its proximity to the server do not make any difference (or at least no consistent difference). I have installed to one new workstation plugged into the same network socket as the one Alex failed to install with.

However we do no when the error happens and it happens consistently on affected workstations. The error is caused at the point that RecorderApp.exe is being registered. This occurs at various times. So far we have noted the following:
1. when running workstationsetup.exe, halfway through the install process. after choosing to close or continue after the error message, the installation runs to completion (and the installation appears to be valid in all respects).
2. when running recorder after the problem has occurred with workstationsetup.exe, the error occurs after the splash screen is displayed, but before the login dialog appears. Recorder will not run after this point.
3. manually attempting to register recorderapp.exe from the command line using regsrvr also fails with the same error.
4. I have just discovered that the error also occurs when running a Recorder6 upgrade (but not a dictionary upgrade) from an affected workstation. Here it occurs close to the end of the upgrade process, but after clicking continue or close, the upgrade continues to completion and there appear to be no problems with the installation on the server side (although the workstation is still affected).

So we now have a functioning server install running under SQL2012 with no problems detected apart from those few known bugs relating to that version of the dbms.
Connected to it we have four normally functioning, brand new workstations, two normally functioning installations on remote access (RDP) terminals which are in the same physical box as the SQLserver (effectively local installations on the server) and two installations on affected workstations.

Somehow, rather randomly during all of this we stumbled upon a fix for the affected machines. Refreshing the IP address on the workstation seems to get around the problem.
So on the two affected machines I have created a batch file as follows

ipconfig /release
ipconfig /renew
Z:\Recorder.exe

(our file server is mapped to Z:\)

Saved it somewhere locally as StartRecorder.bat, created a shortcut to that file and replaced the shortcuts to Recorder 6 on the start menu and desktop.

Recorder now works as expected on all our installations. Hooray!

However I have to remember not to run future software upgrades on the affected machines, just in case.