"Access Denied" (error opening) during scan

[Bizadi]

Hi,

Sorry if this has already been covered and I did read the Preliminary questions about NOD32 (http://www.wilderssecurity.com/showthread.php?t=173669&highlight=error+opening) thread before posting today. Whenever I do a full scan every file has an "... :KAVICHS error opening (Acces Denied) [4]" appendage. Is there a difference between locked files, which I understand from this post (http://www.wilderssecurity.com/showpost.php?p=833165&postcount=100), and my "Access Denied" situation?

Is there a way for me to "unlock" all of these processes so that Nod can perform a more thorough scan or am I worrying excessively? Btw, I have no partitions and am the only user of this XP machine. Thanks!:)

[ASpace]

Hello!

Are you sure that every file gets this error ?

I would suggest you that you get rid of Kaspersky's ADS (the so called KAVICHS) .

Contact Kaspersky's support support @ kaspersky.com and ask them for klstreamremover.exe to remove KAVICHS . Let them give you instructions to use it . This klstreamremover.exe is known to remove the video card driver on some machines so it will be handy if you keep a copy of your video driver.

Then you can also use this program called ADSSPY
http://computercops.biz/zx/Merijn/adsspy.zip
http://www.bleepingcomputer.com/files/adsspy.php

Then try again with NOD32 :thumb:

[Bizadi]

Well, I don't know if every possible file gets this error but Nod's Scanning Log shows KAVICHS errors on all but 2 locked files:
C:\hiberfil.sys
C:\pagefile.sys

Also, you apparently can no longer just e-mail Kaspersky; you must now fill out a Technical Support form (http://support.kaspersky.ru/helpdesk.html?LANG=en).

[Bizadi]

I posted on KL's official forum to see if I could get KLStreamRemover online and "Skywalker" referred me to this KL Tech Support troubleshooting article (http://support.kaspersky.com/faq/?qid=193238621).

Kaspersky forum thread (http://forum.kaspersky.com/index.php?showtopic=52880&st=0&gopid=477371&#entry477371).

[ASpace]

Ok , follow the instructions of Kaspersky's support page and use the KAVICH's removal tool .

1. To use KAV's tool , extract the zip file into C:\
goto Start->Run->type
C:\KLStreamRemover.exe -r

2. Use ADSSpy as per the instructions I gave you.

3. Read the FAQ (the first in the list about [4] Locked files):
http://www.wilderssecurity.com/showthread.php?t=150856

4. If you have no issues with v3 , I recommend you that you install v3 of ESET Antivirus
http://www.eset.com/products/nod32.php
http://www.eset.com/download/index.php

[Bizadi]

There is one step in Kaspersky's instructions that I do not understand:

"Unzip the archive in the root catalogue of the section where you are planning to clear the streams"

- - What do they mean by "root catalogue of the section"? Do I just go to Start->Run-> and then type C:\KLStreamRemover.exe -r ?

I've got an updated backup for my video card, just in case.

Thanks again or your help.

[ASpace]

-{ Quote: "- - What do they mean by "root catalogue of the section"?
" }-

You got an answer for this in the Kaspersky forum . Haven't you read it ...??

This means in the root of C:\ (e.g. in the main C:\ but in no folder , just in C:\)

-{ Quote: "Do I just go to Start->Run-> and then type C:\KLStreamRemover.exe -r ?" }-

Yes

[Bizadi]

-{ Quote: "You got an answer for this in the Kaspersky forum . Haven't you read it ...??
" }-

(re: Root catalogue): Yes I did but I did not fully understand the reply. Also, I was not able to access the Kaspersky forum last night, which is why I asked here. Sorry to have bothered you.

[ASpace]

-{ Quote: "Sorry to have bothered you." }-

No problem.

What happened , did you run the tools ?

[Bizadi]

Not yet. I just ordered ESET Smart Security and just received my username & password. I'll be busy with that installation for awhile and will post back if KAVICHS is still a problem (the ESET rep. said that it would not be an issue with Nod 3.0).

[ASpace]

Installing ESS and cleaning the ADS (a.k.a the KAVICHs) are two different thing , btw

[Bizadi]

Well, I ran KLStreamRemover as well as ADS Spy and then did my first full scan with Nod v3. I still see a lot of KAVICHS errors, for example in:

C:\WINDOWS\Installer\$PatchCache$\Managed\9040111900063D11C8EF10054038389C\11.0.5614\ADDRPARS.DLL:KAVICHS - error opening

C:\Program Files\ArcSoft\PhotoStudio 5.5\Plug-ins\FILTERS\3D TEXT FACTORY\abc3d1.avv:KAVICHS - error opening

I'm running KLStreamRemover.exe again to see if it missed any of these. I will do another ADS Spy scan and then a new Nod v3 scan and see if this improves. I suppose I should start a new thread in the Version 3 forum.

Oh, I also called Eset tech support and the engineer that I spoke with had never heard of KAVICHS and told me to ask about it here. Kind of a waste of time, although I do understand that KAVICHS is not really their problem - I just hoped that they had encountered it before.

[ASpace]

-{ Quote: "
the engineer that I spoke with had never heard of KAVICHS and told me to ask about it here." }-

This is because this is Kaspersky issue.

IMO not all files should be marked as locked (it may be due to the KAVICHs) but you may read what error-opening/file locked error is in the FAQ
http://www.wilderssecurity.com/showthread.php?t=150856