RE: KAV

[AV Newbie]

Is KAV the only AV that can be used successfully without a seperate AT or any other programs?

I'm thinking of getting KAV Lite and be protected without any otehr programs other than a firewall.

[jdong]

KAV is very very good at detection trojans (I think that's an understatement ;))


So basically _yes_...

[Blackcat]

Will probably depend on your system spec and whether you are a supporter of the layered defense system.

KAV and the AV's based on the same engine( eg AVK, F-Secure) have probably the best unpackers and trojan detection.

However, these programs are generally resource hungry and may not sit well on low spec systems.

Other AV's such as McAfee, Dr Web, and Bit Defender are also good at unpacking and trojan detection and Dr Web is an excellent choice for the older computer.

All of these can offer you good antitrojan detection by themselves but then many people would suggest you do use a separate AT as part of a LAYERED defense system.

In addition some people would recommend additional spyware protective software to your AV/AT and firewall. Check out the spyware section here at Wilders.

[AV Newbie]

I am now trialing KAV Lite and I really like it. I find that on HIGH settings it slows my comp down to a halt even on a p4 3g w/ 1gb ram dcddr.

I recently tried NOD32 but after reading on how I would need a seperate program for Trojan detection and other stuff the NOD department is lacking in I opted to try kav because I heard so many good things about it.

I don't like the idea of layered defense because I dont like having 50 programs running in my taskbar slowing things down.

On another note, NOD32 recently gave me this reply when I told them I was looking for an AV that doesn't require a seperate AT...

"Thanks for getting back to me - sounds like we need to work on our product information. If had looked a little deeper into it before dumping NOD32 you may have stuck with NOD32. With the new heuristics in version 2 which released last month - I believe we have the only product on the market in any category that can detect most viruses, worms and trojans automatically without update. For example NOD32 nailed bugbear B without needing to update its' virus signature. Even the old version detected Love Letter, Nimda, and about 90+% of viruses and Trojans using heuristics - version 2 brought in the new heuristics for worms."

Now I'm a bit confused because NOD32 sounds really good and I really liked nod32. Is NOD32 good enough to run alone?

I am very confused ???

[root]

First, it is recommended by most to have an AV and an AT. If for some reason you can't have both, then NOD is not going to give you much trojan protection. They are adding some, and do go after worms I believe, but still NOD does not have a huge base of trojan signatures.
KAV is without a doubt in many peoples mind the very best combination AV/AT that can be had. I use KAV and do not run an AT resident, just KAV.
The other AVs that have KAV as one of their AV engines vary in how well they do as compared to KAV alone. F-Secure seems to do very well with its combination KAV, F[Prot and Orion, but not so much better that I would be concerned about the difference.
I would be amazed if KAV lite let you down. I don't think it is necessary to run in High setting. I have used KAV for years and followed the testing results from several sites for a long time, and KAV is the ONE AV that consistantly scores at or near the top of the field in all testing facilities..
If you want NOD, definitely get an AT. There is only one AT that may detectect as many or more trojans as KAV and that is TDS, So the combination of NOD and TDS is the only thing that can equal or better KAVs protection in my opinion.
If you only run KAV, keep an eye on the icon in the tray. As long as it is there, you have not lost your protection.
Some will agree with what I just said, and some wont. I offer it as my opinion based on my experience from the days when McAfee was the only AV there was. I think ;D

[AV Newbie]

Thank you for the thorough replies.

I dled some Eicar test files and on medium settings it would not alert me until I double clicked the zip and ran the exe. On High settings, KAV would alert me as soon as I double clicked the zip. I believe on NOD32 it would alert me of the virus as soon as it dled onto the desktop. Just some things I noticed with the RTM :)

[Andrew B.]

Hi. I am also shopping for new AV software and reading the threads here. Is there some trick to setting up KAV so it doesn't slow down the computer so much? For example, are there settings that all KAV users know to change from the default?

Also, I've been reading here that F-Secure and Extendia use the KAV engine, or part of it. Has anyone reported whether these are just as demanding on the system.

BTW, I'm test-driving Dr. Web right now. The only bad thing I've heard about this one is a sprinkling of false positives. Other than that I get the impression that it even does well with trojans. Is this the general view of Dr. Web.

[solarpowered candle]

Hey AV Newbie. I think that because Kav lite is so simple in its approach one can become a little worried that its not doing its job. however as root says , and a few others who have used Kav Lite or have knowing about it , One is well protected from virus/ trojons/ worms and malware . Running it on high is rather severe . It is recommended to use the medium settings. hjowever a scan on high once a week wouldnt be a bad thing . I think you have made a good choice.

[Blackcat]

Hi Andrew

You're a little off the main thread but recent posts on Dr Web are here;

http://www.dslreports.com/forum/remark,7418019~root=security,1~mode=flat

http://www.wilderssecurity.com/showthread.php?t=11526

http://www.wilderssecurity.com/showthread.php?t=9782

In addition, the number of false positives given out by Dr Web, is I think, slightly overestimated. The few I have found are very easy to spot e.g files associated with TSD-3, Script Sentry and SpywareBlaster. It simply marks these as 'suspicious'. You can check out any of the 'false positives' found by running an on-line scanner.

It is also a good unpacker and trojan detector but not comparable to KAV.

http://www.rokop-security.de/main/article.php?sid=494&mode=thread&order=0

Since you are trialing AV software I would be interested in your findings with KAV Lite and Dr Web. I could not get KAV Lite to start with any other AV software on my machines( I did receive the 30-day key-file from Lisa) and I found that Dr Web also did not like any other AV software installed.

Therefore you may need to completely uninstall any previous AV software before trialing these 2 programs.

PS There is a KAV registry cleaner you can use, which removes ALL Registry entries.

Added URL tags

[Andrew B.]

Hi Blackcat,

My testing was not perfect. When I tested KAV I would let it load along with AVG, but then I would kill AVG's processes in memory. Not the best way to do it. So I was going to go back and test KAV again with AVG completely gone from the hard disk, but other messages here confirmed my experience about slowness. This slowness only became annoying to me when launching programs. Which I do a lot. So for other people this might not be annoying.

I noticed that KAV would sound the alarm if I simply opened a folder that contained a file with malware. This much scanning could be part of the reason for slowness. That is why I was curious about whether the community of KAV users routinely pulled it back to a less busy level to speed things up.

And btw, thanks for the links. The comparison tests were especially interesting.

[Blackcat]

I would check KAV Lite again with AVG completely uninstalled from your machine, on moderate settings. I am sure it will move along nicely on your computer.

I know solarpowered candle has had no problems with the new Lite on his relatively low spec machine.

No disrespect to AVG, but most commercial AV's would offer better protection overall.

Give KAV Lite another go. If for some reasons, it does not fit well on your system, I can heartily recommend another one of your trial AV's, Dr Web, as an excellent alternative.

[Graystoke]

I hope I'm not hijacking this thread from AV Newbie. If I am, please let me know.

I just installed KAV 4.5 trial version. I'm finding it a little tricky. I have a couple of questions if I may.

When I first installed it, I had trouble connecting to the internet. Finally tried configuring the KAV monitor. I have unchecked everything in Scan Compound Files except for Plain Mail. That did the trick. I have Ask User, Scan Local Hard Drive, Scan Sectors, Scan Memory, and Enable Code Analyser all checked. Is this ok?

In the KAV Scanner I have everything checked except Scan Local Removable Disks. I have checked ALL under Scan Files Of The Following Types. Is this ok?

Final question. Where do I look to see if virus updates are current. I know how to update them manually. I don't know if it is being done automatically.

I also didn't install the Control Panal. Hope that's ok.

Sorry for asking for so much help at one time.

[Blackcat]

Have a look at some of these threads;


http://forums.useice.com/cgi-bin/ikonboard.cgi?s=3f1dacb25fc4ffff;act=SF;f=1

http://www.iggyz.com/files/Bookmarkz/antivirus.html

http://www.wilderssecurity.com/showthread.php?t=10274


Look particularly for Fedorov's settings for the KAV Monitor over in one of the posts over at the Ice forums.

The main GUI of the Scanner should inform you of the number of viruses in the data base, which you can then check with the present updated figure on the main Kaspersky site. In addition, obviously when you try to download, the updater will tell you that you have the latest definitions or not.


Should be good bed-time reading ;).

[octogen]

-{ Quote: " quoting: AV Newbie link=board=24;threadid=11566;start=0#msg74913 date=1058838186]
Thank you for the thorough replies.

I dled some Eicar test files and on medium settings it would not alert me until I double clicked the zip and ran the exe. On High settings, KAV would alert me as soon as I double clicked the zip. I believe on NOD32 it would alert me of the virus as soon as it dled onto the desktop. Just some things I noticed with the RTM :)
" }-

Makes sense, because only when it's in the high setting does KAV Lite scan inside archives. In the other two settings (normal and medium) it kicks in when you unzip, just as you did. This is not to be confused with KAV's realtime unpacking capability. In all settings, it has this capability.

[octogen]

-{ Quote: "when you unzip" }-

I'm sorry, I meant to say "when you unzip and try to execute, as you did".

[Graystoke]

Thanks Blackcat.

[Graystoke]

Well, I think I got all the answers to my questions by checking here and there in the software and reading a little. I also installed the Control Center.

One more question. I ran a complete scan. No nasties found but it said I have 91 corrupted files and 31 l/O Errors. Doesn't say what I'm supposed to do. Maybe KAV is too much for me and I should stick with NAV.

[solarpowered candle]

You must be running with the Kav personal , not the Kav Lite Hobnob. I get that with the personal re all the corrupt files etc . Not sure why as I had a clean windows install prior to when i when i first downloaded it. I wouldnt be in too much of a worry that its too tough for you . As you can learn heaps from it and there is a wealth of help available by those here and at the ice forum to get you on track and comfortable . For me i prefer the Kav lite as You can set and forget and just update daily . but if you want to get into it all the personal is great . :)

[the Tester]

Errors and corrupt file messages from my experience so far are normal.
Although my total is 38.
These are probably files that are protected or not accessible?
Some av's give you a message like that for Windows files that are locked.
Examples from a recent KAV 4.5 scan of XP Home:
pagefile.sys
hiberfil.sys.
Certain particular program files are listed in my report as password protected or read access...
I know what the programs are,so I'm not too concerned.

[Graystoke]

Yep, I'm trialing KAV personal. I read so much about it, I had to give it a try.

They were a bunch of CAB files. I guess I'll just not worry about them.

Thanks guys.

[illukka]

check out this for kavlite, what it does on which settings:

http://forums.useice.com/cgi-bin/ikonboard.cgi?s=3f1e12216b2fffff;act=ST;f=1;t=9

- Fixed link

[Graystoke]

Hi illukka. I gave KAV lite a try a little while ago. I just didn't feel comfortable with it not being able to configure anything. I'm sure it's great, but, I like the feeling of seeing what's there. JMHO. Not sure if I wanted that as my primary AV. I'm going to give KAV personal trial some more time to see if I can get comfortable with it.

[illukka]

yaeh kavlite is less configurable but it still offers the same protection as more expensive kav versions.. it's best for those who want a set it and forget it kind of av...
kav personal and personal pro offer much more in that departement.. i'd say that kav personal pro is the ultimate av in many ways, configurability in only one of it's better properties..
most of the i/o error files are system files which are used by the operating system with exclusive rights, so that an av can't scan them..or thats what f-secures report tells me

[Graystoke]

Hi illukka. So you believe that KAV lite is fine as a primary AV? I wouldn't need another AV for a back up? I don't want to run two AVs.

All I really want in an AV is good protection and daily updates. I'm also concerned with e-mail protection. I know KAV lite doesn't have an e-mail scanner. Am I correct that KAV lite's real time monitor takes care of that?

I guess I just can't believe that for only $20, I can get such good protection when almost all the other AVs are over double the cost. That's probably the biggest thing holding me back.

[Blackcat]

Hi Hobnob

Sorry to butt in but check out the KAV Lite threads here at the Ice Forum;

http://forums.useice.com/cgi-bin/ikonboard.cgi?s=3f1f79591637ffff;act=SF;f=1

Most people would consider KAV Lite an excellent PRIMARY scanner.

It uses the same definitions data base as the personal and pro versions, so it gives top notch protection against BOTH viruses and trojans.

The RTM will take care of any e-mail threats by itself and anyway the KAV Mailchecker with the more expensive versions will only work with Outlook. You will have to wait until February for the new pop3 scanner in version5!!!!!

Just because it is much cheaper than the other KAV versions and many other different AV programs does not mean it is an inferior product. It is just not as configurable as the Personal and Pro versions.

Kaspersky markets Lite as its 'newbie' friendly, set and forget product, hoping that with time and more experience, people will switch to their more expensive product line.

So I would not let the 'cheap' price put you off this AV. As your primary scanner you should not need another AV on your box.

Why don't you trial the product for awhile and see how it fits on your system? Further, you can post over at the Ice Forums for members thoughts on KAV Lite.

My daughter is at University and while she is away she is part of a home LAN system with 5 other teenagers, so you can imagine the sites they go and visit!!!!!! I am currently trialing KAV Lite on her laptop, which she likes as she can forget about it after the install, yet it is giving her excellent protection against malware.

But in the end, the choice is up to you ;).

PS Why don't you contact solarpoweredcandle, he seems to be the expert on KAV Lite and he has run it for awile now. I am sure he will be able to answer any queries you have.

[illukka]

yes like i said configuration is only thing that is lacking in kavlite..THE PROTECTION IS THE SAME!! it is recommended to run it at security level normal, maybe once a week to do a manual scan with high settings.. kavlite was designed for older machines running win98,with not so powerful cpus, but it works in all later versions too. like blackcat said it is set it and forget it.. if you have a new 'puter you won't notice it until it intercepts a virus and makes a nice sound ;D it might slow your machine a bit if you haven't got enough memory in it( 128 is enough although it runs on 64mb too) my dad has it on a celeron 300 with 64mb ram and its running fine... he doesn't mind an occasional slowdown coz he says he's slow himself ...

[Blackcat]

Nice post, illukka, with SPC, we now have 2 KAV Lite experts ;).

I can confirm that it will run on relatively low- spec systems as my daughter's laptop is a lowly Celeron 600mHz, 192MB RAM, and it has no noticeable drag using the default settings.

[Graystoke]

Hi. Thanks for all the imput, I really appreciate it.

I am still using KAV personal trial. Each day I am getting more familiar with it and it's not as hard to work with as I thought. :)

One question if I may. Am I wrong in thinking that KAV personal does not have script blocking? When I open Control Center and click on the Script box, nothing happens.

[girobb]

Kav does have script blocking on it, I did a custom install and chose it.
You should be able to turn it on in the control center, I did not install cc myself. If you use IE, look at the bottom towards the right when you surf. You should see the KAV symbol flash. I do not no if it is neccessary to have the script blocker or not, I installed it anyway.

[Graystoke]

Hi girobb. Yep, I see the flashing symbol. Thanks.

The only reason I installed the Control Center is because I thought that was the only way to get virus updates on a daily basis. I take it you really don't need the Control Center? KAV updates daily without the CC?

[illukka]

cc is only needed if you want to schedule your updates etc, you can still do updates by launchin kav updater from start menu(there is a way to schedule that too, see the links) most people i'm aware of have not installed the cc(ihave). they feel it's a waste of resources....kav issues updates daily, seven days a week, sometimes twice a day
you can find kav info here: http://www.iggyz.com/files/Bookmarkz/antivirus.html
about configuration here http://www.hackfix.org/software/configure/avp.html

[Graystoke]

Thanks illukka. I think I'll keep the Control Center. Not really worried about the resources.