AutoCad LT and CSA version 6.0.0.201

[ddevecka]

I am a newbie to CSA and we are running version 6 and I can't get AutoCAD LT to run on a machine running CSA. When I uninstall all is well. I am sure I am missing something and was hoping someone could help me on this one.

Thanks,

Dan

[ddevecka]

It turns out it is the csauser shim causing the problem. I will post the final fix once I have it.

[tsteger1 · Accepted solution]

That is typically the case with these problematic apps. Disabling csauser.dll will make the problem go away but you lose much functionality.

Mine worked with this rule:

When try to run it will .

That should fix it.

Is that how your rule is configured?

Tom

[ddevecka]

TAC had me change the hosts csauser shim reg key to csauser.dll to csauser.dll.org. They claimed it will not hurt anything doing this on the hosts. It concerns me, but I am not sure what else to do.

Thanks,

Dan

[ddevecka]

The Fix is a reg hack to disable the csauser shim. according to Cisco this is an okay work around, but it does fix the problem.

[tsteger1]

We had to do that for another mysterious problem which they eventually released a hotfix for.

What is 'assist.exe' and where does it reside?

Tom

[ddevecka]

Assist.exe is what starts with AutoCAD LT. It is just like a help screen.

Dan

[johuston]

Hi Dan,

Have you configured kernel-only protection for this application? When you disable csauser it disables user space hooking for all applications on the endpoint. This is a good test to see if that is your problem (which it sounds like is the issue.) To get more granular and only disable for a single application you can use this procedure:

http://supportwiki.cisco.com/ViewWiki/index.php/Configuring_Kernel-only_Protection_for_an_Application_in_CSA_6.0

Hope that helps!

Thanks,

Josh

[tsteger1]

Hi Josh, I asked him to do that and he said it didn't work for either process.

Unsure what his configuration was.

Tom

[johuston]

Hi Tom - Saw your previous post so thanks for the heads up as I didn't see that before.

Dan - It may be an issue of the actual processes you are targeting. Instead of narrowing down to these 2 .exes start by creating an app class for all .exes in the AutoCad directory. Then you can narrow it down more from there (assuming that works.) Also, make sure you reboot the PC in case some AutoCad processes start at boot time.

A little background (for those that are interested.) The reason AutoCad LT has an issue is it's licensing protection mechanism. AutoCad sees CSA hooking the user space memory and thinks that you are trying to evade their licensing. Therefore the application shuts down, or otherwise doesn't quite work properly.

Let us know if the larger App Class works for you.

Thanks,

Josh

[ddevecka]

I will try this and let you know.

Thanks for all the input.

Dan

[daneilhudson]

In CSA 4, I needed to tune for AutoCAD LT because it was causing a buffer overflow. It did not create any events, I had to write a manual rule for the main executable. I think the rule migrated to 6 without any chanes.

[daneilhudson]

Another thought is that you have a buffer overrun, and need to create an exception even though an event is not logged. I had to "blind tune" several apps in 4.0 due to this behaviour.