Kaspersky's Object Identifiers

[De Hollander]

If i understand it correctly kaspersky is gone use a different method regarding the object identifiers issue. What happens with those object identifiers when you upgrade to V8?

[BlueZannetti]

{QUOTE-> If i understand it correctly kaspersky is gone use a different method regarding the object identifiers issue. What happens with those object identifiers when you upgrade to V8? <-QUOTE}Well, unless KL provides a tool to delete them, or a user invokes the native MS fsutil utility to delete them, .... nothing.

Blue

[TonyW]

As a Kaspersky user myself, I ain't even bothered about the objectIDs.

[De Hollander]

So why are they changing the methode?
Is this because of reports about chkdsk.

???




{QUOTE-> Well, unless KL provides a tool to delete them, or a user invokes the native MS fsutil utility to delete them, .... nothing.

Blue <-QUOTE}

[Firecat]

{QUOTE-> So why are they changing the methode?
Is this because of reports about chkdsk.

??? <-QUOTE}
Yes, it is due to the chkdsk problems and the fact that Microsoft did not approve of Kaspersky's method of using object identifiers.........:)

[De Hollander]

Is there a "official" response from KL.

[Firecat]

{QUOTE-> Is there a "official" response from KL. <-QUOTE}
Yes, something that is not very frequently mentioned.....

http://www.kaspersky.com/support/kav7/error?qid=208279501

Of interest is this quote:

{QUOTE-> The Microsoft Corporation officially states that API means were not developed for the mechanism deployed in the iSwift technology. On the other hand no restrictions to use API means were mentioned in the API description. In Kaspersky Labs products version 8.0 experts are planning to add a new scheme to index computer objects (files); this scheme will allow avoiding problems by co-work with the service CHKDSK. <-QUOTE}

IMO Kaspersky has not handled this issue in a proper way at all......The issue is very much there, even if not for all users, and the fact that one will have to wait for version 8 to get this "problem" finally fixed is not going to make customers happy.

Whether or not this is a significant issue; Kaspersky has not handled it properly.

[De Hollander]

So did they shoot themselves in the foot with this technique ???

If having no problems, you just end up with 200mb max of extra data on your HD, (digital form of tattoo), or to resolve it, you can use MS fsutil utility (plastic surgery)

[BlueZannetti]

{QUOTE-> So did they shoot themselves in the foot with this technique ??? <-QUOTE}Basically yes. They violated one of those implicit rules of good behavior - even if you remove KAV/KIS from your machine, a fairly large and obvious footprint of the installation remains. A fair number of users freak out about a handful of residual registry entries, this is a lot more extensive that that. However, like inactive registry entries, they are innocuous once properly created and as long as chkdsk can complete an execution.
{QUOTE-> If having no problems, you just end up with 200mb max of extra data on your HD, (digital form of tattoo), or to resolve it, you can use MS fsutil utility (plastic surgery) <-QUOTE}Yes.

Blue

[Firecat]

Yeah, even after removing KAV the chkdsk issue does not get solved........For those having the problem the only solution is a complete reformat or to live with the chkdsk scan delay.

Removing NTFS object IDs is not as simple as removing Alternate Data Streams (which was another trick Kaspersky tried in version 5.0, called iStreams - adding ADS tags to files); so I doubt there will ever be a fix for the affected users.

[BlueZannetti]

{QUOTE-> Yeah, even after removing KAV the chkdsk issue does not get solved........ <-QUOTE}Just be clear on specifically what the issue really is. Chkdsk takes a bit of time to process stage 2: not a problem. Chkdsk will not complete: this is potentially a problem. File system is inconsistent and cannot be fixed due to chkdsk's inabiliity to complete leading to cascading filesystem corruption: this is the problem
{QUOTE-> For those having the problem the only solution is a complete reformat or to live with the chkdsk scan delay. <-QUOTE}Correct, if by "problem" you mean an inconsistent and corrupted file system. A simple delay is, once again, not the problem and should not be used as a guideline to recommend users execute a system reformat.
{QUOTE-> Removing NTFS object IDs is not as simple as removing Alternate Data Streams (which was another trick Kaspersky tried in version 5.0, called iStreams - adding ADS tags to files); so I doubt there will ever be a fix for the affected users. <-QUOTE}For home users, it is as simple. For business users on a networked domain with application servers, probably not simple.

Blue

[Peter2150]

{QUOTE-> <SNIPPED> <-QUOTE}

That isn't really a fair statement. I for one had no issue with the OI's and prefer that being added as opposed to the junk some US software adds to my system.

[trjam]

I would say it borders on violating this. (http://www.wilderssecurity.com/TOS-Privacy.html)

[Sjoeii]

{QUOTE-> <SNIPPED> <-QUOTE}
I believe this is rather a strange statement. This has nothing to do what country it is from

[De Hollander]

I agree :thumb: Nothing at all to do with country-of-origin

Is there any info about what kind of technique is going to be use in the new version v8

[Menorcaman]

One gratuitous and potentially inflammatory post removed.

Regards

Menorcaman

[larryb52]

{QUOTE-> Yeah, even after removing KAV the chkdsk issue does not get solved........For those having the problem the only solution is a complete reformat or to live with the chkdsk scan delay.

Removing NTFS object IDs is not as simple as removing Alternate Data Streams (which was another trick Kaspersky tried in version 5.0, called iStreams - adding ADS tags to files); so I doubt there will ever be a fix for the affected users. <-QUOTE}


that sucks, this answers why it hung up the other day almost to the point where I thought the machine froze & it's a new machine, I'm running another solution at the moment but this doesn't make me feel very good about the potenial problems could be there on a machine that is barely 45 days old...maybe I should reformat but the programs on there was tough to get going in vista, not sure if a reformat would cause more headaches...

[ccsito]

Because programs are created to intergrate and "fit" into an Operating System, that allows them to tinker around with what is installed there. For PCs, that only impacts the user of that PC only. On mainframes, only systems programmers can tinker with the Operating System. If the application programmer tries to do that, they get reprimanded and told to cease and desist or else.:gack:

[C.S.J]

it seems some av's will do anything to lower their scan speed, it must be a really big seller :)

[ccsito]

{QUOTE-> it seems some av's will do anything to lower their scan speed, it must be a really big seller :) <-QUOTE}

Speed and execution time is a critical factor whether a program is used or not. ANY program that takes a long time to run won't stay on any user's PC for long. I tried the ZA online AS scanner and it was finished scanning my system in less than 15 seconds??!! I said WHAT? That was FAST! :D Almost too fast. :-\

[TonyW]

{QUOTE-> I for one had no issue with the OI's and prefer that being added as opposed to the junk some US software adds to my system. <-QUOTE}I look at it this way: if the objectIDs impede my day to day use of the computer, posting here, sending emails etc., then I'll worry. As it is, I'm not aware of any problems.

There are bigger issues in the world to worry about.

[Peter2150]

{QUOTE-> it seems some av's will do anything to lower their scan speed, it must be a really big seller :) <-QUOTE}

You bet. And if I put any AV back on my system it would be KAV. Had it on for two years, and no problems with OID's. What I did like was I could do a full scan in 5 minutes as opposed to 1 hour.

Pete

[De Hollander]

{QUOTE-> I look at it this way: if the objectIDs impede my day to day use of the computer, posting here, sending emails etc., then I'll worry. As it is, I'm not aware of any problems.

There are bigger issues in the world to worry about. <-QUOTE}


Anybody or every company can and will make mistakes.

If you want to remove the OID, because you don’t want to have a chkdsk slow down.
What are the current solutions?
Format, Clean image, Fsutil, or does KL offer you a tool?

If I wood be using a KL product, and KL wood stated, “Costumer, Sorry, we where wrong, and will work on a permanent solution for you” I wood be happy with that, Now, they stop using this method and start with something else in version 8. So as a hypothetical costumer, I wood dump this program.


But as you stated :thumb: "There are bigger issues in the world to worry about"

[C.S.J]

basically they have made a technology with a big flaw, and instead of fixing it in the current version, they say "Wait for next version"

refund.....

[steve1955]

I can't think of any piece of software that doesn't have one problem or another,can all you "experts" actually with hand on heart say that this is a major issue that affects more than a handful of users?Its Kaspersky and there are some guys on this forum who like to make a mountain out of a mole-hill when any problem re-kaspersky is brought up
I have a friend who because of his hardware"combination" cannot install either service pack 1 or service pack 2 for XP(bsod everytime no matter what is tried!),does this make these updates to XP "bad programs"?or is just a problem that affects very few users so on the whole the updates are worthwhile installing for the vast majority?Its the same with Kav/Kis most users would not even be aware of this problem if a few "bashers" didn't keep banging on about it

[Macstorm]

{QUOTE-> I look at it this way: if the objectIDs impede my day to day use of the computer, posting here, sending emails etc., then I'll worry. As it is, I'm not aware of any problems. <-QUOTE}
Agreed.
Did you steal my thoughts, did you? ;D

[steve1955]

{QUOTE->
I look at it this way: if the objectIDs impede my day to day use of the computer, posting here, sending emails etc., then I'll worry. As it is, I'm not aware of any problems. <-QUOTE}You and probably 99.999% of users!

[De Hollander]

Before this tread goes out of control, I never in the past have been trolling, or bashing any program or vendor, and surely are not trying to do so right now or in the future. I‘m only expressing my opinion after what I have be learning in this tread.

Thank you.

De Hollander.

[Blackcat]

{QUOTE-> Its Kaspersky and there are some guys on this forum who like to make a mountain out of a mole-hill when any problem re-kaspersky is brought up. <-QUOTE}
And girls, one of which now has in her signature "Don't Forever Alter Your Computer! Don't Install or Use Anything with Kaspersky" :P :-X :wacko:

[steve1955]

{QUOTE-> And girls, one of which now has in her signature "Don't Forever Alter Your Computer! Don't Install or Use Anything with Kaspersky" :P :-X :wacko: <-QUOTE}
Sorry:-didn't intend to be sexist!(lol)

[dread]

Does anyone have a page explaining Alternate Data Streams and objectids and how they are related? I asked in the Kaspersky forum and one person said removing the ADS would not remove the objectids. Here (http://forum.kaspersky.com/index.php?showtopic=52822) is the post.

[danny9]

{QUOTE-> I can't think of any piece of software that doesn't have one problem or another,can all you "experts" actually with hand on heart say that this is a major issue that affects more than a handful of users?Its Kaspersky and there are some guys on this forum who like to make a mountain out of a mole-hill when any problem re-kaspersky is brought up
I have a friend who because of his hardware"combination" cannot install either service pack 1 or service pack 2 for XP(bsod everytime no matter what is tried!),does this make these updates to XP "bad programs"?or is just a problem that affects very few users so on the whole the updates are worthwhile installing for the vast majority?Its the same with Kav/Kis most users would not even be aware of this problem if a few "bashers" didn't keep banging on about it <-QUOTE}

Obviously you never had the problem with kav. I'd like to see how quiet you'd be if you did.
I had to reformat to fix the problem once and for all.
Them made an error once and then did it again.
Their software cannot be trusted and will never be on my computer again.
And if I can talk someone out of using kav, bashing if you will, then damn straight I will. >:( :thumbd:

[zfactor]

so am i right then saying there is no way to use kis without these identifiers? even if you uncheck iswift when installing they still get installed??

[King Grub]

Yes, when you uncheck iSwift within the graphic user interface or during installation, it only prevents on-demand scans from using it. Real-time protection will still use it.

However, one can disable that, too, from within the registry, by going to...

HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\protected\AVP7\profiles\File_Monitoring\settings

...and set the UseIStreams key to 0 instead of the default 1.

[zfactor]

^^^ so what are the results of doing this.. does this still have the effect on chkdsk or anything else. how does this effect system performance without them turned on?? im considering kis but want no issues with slowdown or hdd issues especially with chkdsk

[Firecat]

{QUOTE-> ^^^ so what are the results of doing this.. does this still have the effect on chkdsk or anything else. how does this effect system performance without them turned on?? im considering kis but want no issues with slowdown or hdd issues especially with chkdsk <-QUOTE}
No, using the reg key edit described above should totally disable iSwift for good, though the real-time scanner may use more resources as a consequences. I think the difference will not be significant.

Having experienced this behaviour from ZoneAlarm AV myself (though to a far lesser extent than what people have reported), I think the problem (as per Blue's description :)) is only experienced in a significant level on large partitions with a very large number of files. :)

[De Hollander]

{QUOTE-> Does anyone have a page explaining Alternate Data Streams and objectids and how they are related? I asked in the Kaspersky forum and one person said removing the ADS would not remove the objectids. Here (http://forum.kaspersky.com/index.php?showtopic=52822) is the post. <-QUOTE}

Perhaps this:

Useful links
NTFS-Identifiers detailed description
Microsoft API detailed description

http://www.kaspersky.com/support/kav7/error?qid=208279501

[steve1955]

{QUOTE-> Obviously you never had the problem with kav. I'd like to see how quiet you'd be if you did.
I had to reformat to fix the problem once and for all.
Them made an error once and then did it again.
Their software cannot be trusted and will never be on my computer again.
And if I can talk someone out of using kav, bashing if you will, then damn straight I will. >:( :thumbd: <-QUOTE}

There can be probs with almost any piece of software,especially ANY AV product:-due to the very nature of what we expect them to do:-monitor very deep inside your system to protect you against attack from malware that is trying to install itself/alter file structure/install rootkits etc,but that doesn't mean that other users will have same experience:-like I said earlier 99.999% of users probably never have a problem you fall within the 0.001% that have!
Another point is:-just because Microsoft don't "like" the way any 3rd party vendor use the way their operating system work in some respects doesn't make it wrong,as for stating "their software cannot be trusted"??this seems verging on paranoia

[C.S.J]

{QUOTE-> There can be probs with almost any piece of software,especially ANY AV product:-due to the very nature of what we expect them to do:-monitor very deep inside your system to protect you against attack from malware that is trying to install itself/alter file structure/install rootkits etc,but that doesn't mean that other users will have same experience:-like I said earlier 99.999% of users probably never have a problem you fall within the 0.001% that have!
Another point is:-just because Microsoft don't "like" the way any 3rd party vendor use the way their operating system work in some respects doesn't make it wrong,as for stating "their software cannot be trusted"??this seems verging on paranoia <-QUOTE}
i too had this problem with KIS steve, i think its a little more common than you think.

if kaspersky themselfs are doing a re-write and giving out statements about the issue, it really is more of an issue to more than 0.001% of customers.

glad to hear you havn't had the problem though, long may it continue :)

[BlueZannetti]

{QUOTE-> Does anyone have a page explaining Alternate Data Streams and objectids and how they are related? <-QUOTE}They are unrelated to one another.
{QUOTE-> I asked in the Kaspersky forum and one person said removing the ADS would not remove the objectids. Here (http://forum.kaspersky.com/index.php?showtopic=52822) is the post. <-QUOTE}Correct. because they are different things. Think of ADS' as distinct files associated with a primary one while file object ID's are akin to classical file attributes. However, file Object ID's, rather than being set/cleared bit flags, are fixed length bits of information (16 bytes, note that when a file object ID is set BirthVolumeID, BirthObjectID, and DomainID (currently all zeros) are also set, so it's basically a 64 byte collection of information).

Blue

[De Hollander]

{QUOTE-> They are unrelated to one another.
Correct. because they are different things. Think of ADS' as distinct files associated with a primary one while file object ID's are akin to classical file attributes. However, file Object ID's, rather than being set/cleared bit flags, are fixed length bits of information (16 bytes, note that when a file object ID is set BirthVolumeID, BirthObjectID, and DomainID (currently all zeros) are also set, so it's basically a 64 byte collection of information).

Blue <-QUOTE}

??? So KL ad something withing that 64 byte ???

[steve1955]

{QUOTE-> i too had this problem with KIS steve, i think its a little more common than you think.

if kaspersky themselfs are doing a re-write and giving out statements about the issue, it really is more of an issue to more than 0.001% of customers.

glad to hear you havn't had the problem though, long may it continue :) <-QUOTE}

The main problem it would seem is patience on the part of the PC operator,chkdsk doesn't actually freeze,but appears to freeze:-From Kaspersky:-

An index of all object IDs is stored on the volume. Once Kaspersky Anti-Virus has performed initial scan with the iSwift technology and an object ID is given to each file, database volume may increase form 2MB to 200 MB depending on the number of objects/ files on this computer.

CHKDSK checks the database of objects IDs and their integrity set up in the operating system; their average size might be 200MB). And the problem is CHKDSK does not show the scan progress of such big index and appears to hang for a period of time, that is normal.
Is this the "statement(s)" you are referring to?,I only ever use chkdsk when any PC is not needed,so hanging for a while isn't a problem for me,and it seems from reading between the lines that they are only chnging the method of indexing to "keep Microsoft happy"
Don't Microsoft themselves use a similar system to help users find files on a PC?

[De Hollander]

{QUOTE-> The main problem it would seem is patience on the part of the PC operator,chkdsk doesn't actually freeze,but appears to freeze:-From Kaspersky:-

An index of all object IDs is stored on the volume. Once Kaspersky Anti-Virus has performed initial scan with the iSwift technology and an object ID is given to each file, database volume may increase form 2MB to 200 MB depending on the number of objects/ files on this computer.

CHKDSK checks the database of objects IDs and their integrity set up in the operating system; their average size might be 200MB). And the problem is CHKDSK does not show the scan progress of such big index and appears to hang for a period of time, that is normal.
Is this the "statement(s)" you are referring to?,I only ever use chkdsk when any PC is not needed,so hanging for a while isn't a problem for me,and it seems from reading between the lines that they are only chnging the method of indexing to "keep Microsoft happy"
Don't Microsoft themselves use a similar system to help users find files on a PC? <-QUOTE}

You mean indexing ???

[C.S.J]

steve, on my machine KIS actually caused chkdsk to run, automatically on reboots, regardless of the delays.

This issue stopped on un-installation.

[steve1955]

{QUOTE-> You mean indexing ??? <-QUOTE}

similar in some respects,but Kaspersky is different as it tries to monitor changes to files to speed up total scan times,indexing doesn't

[steve1955]

{QUOTE-> steve, on my machine KIS actually caused chkdsk to run, automatically on reboots, regardless of the delays.

This issue stopped on un-installation. <-QUOTE}

had you had zone alarm insalled pre Kis?

[C.S.J]

{QUOTE-> had you had zone alarm insalled pre Kis? <-QUOTE}
nah, it was just KIS after a fresh format.

i chose not to use it and moved on back to what i use.

kis8 should be interesting, lets all see what they can do ;D

[steve1955]

{QUOTE-> nah, it was just KIS after a fresh format.

i chose not to use it and moved on back to what i use.

kis8 should be interesting, lets all see what they can do ;D <-QUOTE}
that is one thing:-Kaspersky always seem to come up with interesting products,even if you don't like/get along with them!

[Peter2150]

{QUOTE-> steve, on my machine KIS actually caused chkdsk to run, automatically on reboots, regardless of the delays.

This issue stopped on un-installation. <-QUOTE}

Then it wasn't the object Id's as the remain when you uninstall. Could have been some other conflict.

[19monty64]

{QUOTE-> kis8 should be interesting, lets all see what they can do ;D <-QUOTE}
That's still a long ways off though, isn't it???

[steve1955]

{QUOTE-> Then it wasn't the object Id's as the remain when you uninstall. Could have been some other conflict. <-QUOTE}
whatever it was,uninstalling Kis cured his problem,and thats all that really matters in the end,even though Kis by itself may not have been the problem

[C.S.J]

well it was causing chkdsk errors and causing chkdsk to run automatically,

i cant see what conflicts as it was on a fresh formatted installation, does it not work with windows? :wacko:

[steve1955]

{QUOTE-> well it was causing chkdsk errors and causing chkdsk to run automatically,

i cant see what conflicts as it was on a fresh formatted installation, does it not work with windows? :wacko: <-QUOTE}
may have been a conflict with a driver or anything,who can say?main thing is prob wasn't irreversible

[zfactor]

if i do the reg tweak.. how i can be assured it will not add these before i apply the tweak to get rid of iswift?? thanks

[Dwarden]

any idea if KasperskyOnline scanner still uses NTFS Object IDs / ADS ?

when I tried i got no OID on files i scanned ... i remember before it added it ...

if true then it's good change

[BlueZannetti]

{QUOTE-> when I tried i got no OID on files i scanned ... i remember before it added it ...

if true then it's good change <-QUOTE}Just reloaded and ran the KAV online scanner and confirmed your observation. Yes, this is a change for the better.

Blue

[zfactor]

^^^ so it does not use identifiers any more??? or did you do the registry tweak?? thanks very curious about this

[BlueZannetti]

{QUOTE-> ^^^ so it does not use identifiers any more??? or did you do the registry tweak?? thanks very curious about this <-QUOTE}This was the online scanner, not the installed commercial product.

Technically, there is no conceivable reason for having them a part of an online scanner, aside from keeping a common code base. The argument of providing a time saving measure is moot for a once or very infrequently used online scanner.

No registry tweaks performed.

Blue

[trjam]

{QUOTE-> Just reloaded and ran the KAV online scanner and confirmed your observation. Yes, this is a change for the better.

Blue <-QUOTE}
I think a few more surprises may be coming.;)