Knowledge Base

NOTE: additional causes of this problem have been identified in April 2009 and are listed at the bottom of this article.

This applies to Carlson Survey 2006 and older and Carlson Takeoff R1.

Carlson is probed by CSA (Cisco Security Agent) and it thinks Carlson is a malware process and shuts the Carlson product down.  The following procedure instructs CSA to ignore the Carlson Software product.  The alternative is to uninstall CSA completely from the computer exhibiting this behaviour.

Create an exception to allow the app to run on CSA 5.0.0.183 or higher. The app referenced in the doc will be Carlson. Substitute your app name for this:

1 - Setup "Admin" rights to view all applications classes :
- On the CSAMC, go to :  Maintenance > Admin Preferences, click on "Advanced"
- Locate this line at bottom to the page :
"Where Apply these preferences to the following selected administrators", select "Admin" by clicking on it.
- Click "Save"

2 - Create a "Carlson" Application class :
- On the CSAMC, go to :  Configuration > Applications > Application Classes[ Windows ], click "New"

Name : Carlson Appl Class
Description : Carlson Appl Class
OS : Windows
Display only in Show All mode : CheckBox ( checked )
Add process to application class
when created from one of the following executables, type in :  **\surv.exe  (use **\site.exe for Takeoff products).
- Click "Save"

3 - Create a Carlson rule module :
- On the CSAMC, go to :  Configuration > Rule Modules > Rule Modules ( Windows ), click "New"

Name : Carlson Rule module
Description : Carlson Rule Module
- Click "Save"
- Click on " Modify rules", click on "Add rule" and select "Application Control"
Description : Carlson Application Control Rule
Check the "Enabled" box
Take the following action, select "Add NEW process to Application Class"
Dynamic Application Class, select "<*Processes requiring Kernel Only Protection>"
and Current Applications in any of the following selected classes, select ""
But not in any of the following selected classes, select ""
attempt to run New applications in any of the following selected classes, select
"Carlson App Class" ( Use the name of the Carlson Application Class that was created )
But not in any of the following selected classes, select ""
- Click "Save"

4 - Create a "Carlson" policy :
- On the CSAMC, go to :  Configuration > Policies, click "New"

Name : Carlson Policy
Description : Carlson Policy
Target Architectures, check the box that read "Windows"
- Click "Save"
- Click on "Modify rule module Associations"
On the left hand sided windows, locate "Carlson Rule Module"
that was just created above, select it and click "add"

5 - Create a "Carlson" Group
- On the CSAMC, go to :
Configuration > Groups, click "New"

Name : Carlson Group
Description : Carlson Group
- Click "Save"
- Click on "Modify policy associations"
On the left hand sided windows, locate "Carlson Policy", select it and click "add".
- On the CSAMC, go to :  Configuration > Groups, locate "Carlson Group"
- Click on "Modify host membership"
On the left hand sided windows, locate the host that "Carlson"
was running on, select it and click "add"
- Click "Save"

6 - Click "Generate rules", click "Generate"

7 - Upon the completion of the rule generation, go to the machine where Carlson was running, do a fast Poll.

8 - Now, invoke Carlson again, it should run.

================================

In April 2009 Microsoft Updated rolled out some updates with appear to have broken compatibility with additional anti-virus or firewall packages.

Going under Add/Remove programs and selecting "Show updates", leads to the following list of updates installed at the time when the problems begin: 958687, 956572, 963027, 961373, 960803, 960225, 959426, 958690, 923561, 952096, 952004.

One currently known firewall/antivirus confict is with Comodo firewall. This has been confirmed by internal testing and the resolution is to remove Comodo or upgrade to current versions of Carlson (Embedded 2009 or IntelliCAD) which are not affected by this conflict.

There also reports of a confict with McAfee Enteprise Client, affecting Carlson Survey Standalone versions 2006, 2007, 2008 and 2009 and Takeoff R1 and R2. It has been reported that uninstallation of hot fix 952004 fixes that crash.