Kav 5 is pissing me off

[tempnexus]

OK I installed the KAV 5 TRIAL but I don't want the thing to run in real time so I went to troubleshooting and disabled realtime protection...once I did that I can't use my IE or MYIE to access the web. It just goes to my homepage, then when I want to go to any other site it just kills the explorer. (the small kav icon in explorer is grey then it turns into a black square and next thing I know it IE is dead). If I turn on the real time scanning and try to visit any site the CPU goes 100% and the IE freezes.

I have NOD32 and BoClean as my realtime so maybe there is a conflict there but it sure pissing me off. If I can't fix that then I am going back to 4.5 where I could use KAV as onDemand scanner without any need for this resource hungry app to run in realtime.

[Paul Wilders]

tempnexus,

KAV v5 is very, very new; all sorts of problems are bound to be encountered - and this does ot go for KAV only, but for fairly all new releases. In case you really want to go for it, better wait say a month; issues might have been sorted out by then.

On a side note: the NOD32/BOClean combo surely will keep your system sound and safe ;).

regards.

paul

[JPM]

I have encountered a bug myself. Today I updated the database files and KAV then said the database was corrupt and to update again. I tried updating them again but nothing changed. I uninstalled KAV 5, rebooted and made sure there were no traces of KAV on my system. Re-installed it and all was well untill I updated the database which again led to them becoming corrupt and the program will not work. Oh well back to NOD until this is resolved :)

[Delgado]

I have tried various Kav Anti Viruses, and find them all a pain in the ass. Technical support is limited to telling you that there is conflict, which is basic info, and the scan takes for ever. Stick with Nod 32-first class

[AMRX]

KAV 5 was at beta stage few days ago. please send your bugs so that the next version is improved. its a good plan to wait for the pro version to be released. then a lot of problems could be sorted out. KAV 4.5 is better suited for the On Demand Scanning.

[nameless]

I have tried various NOD32 Anti Viruses, and find them all a pain in the ass. Technical support is limited to ignoring your, or asking for your specs and then ignoring you, and running runtime-packed executables takes for ever. Stick with KAV-first class

[Paul Wilders]

{QUOTE-> I have tried various NOD32 Anti Viruses, and find them all a pain in the ass. Technical support is limited to ignoring your, or asking for your specs and then ignoring you, and running runtime-packed executables takes for ever. Stick with KAV-first class <-QUOTE}

Thanks for the merely personal opinion. That said: to put the record straight, 99% of all NOD32 users are not experiencing support troubles in any way. Sorry to hear you seem to belong to the 1% minority.

regards.

paul

[Monster]

I got similiar problem also. I was running KAV 4.5 and 5.0 beta on XP of traditional chinese version. The real time protection always bursted my CPU
usage to 100% and created a ultra huge temporary file to eat all my space on C drive ( ~ 1 GB). KAV is excellent but it is unacceptable to surffer the horrible lag everyday.

[Ga1tar]

{QUOTE-> I have tried various NOD32 Anti Viruses, and find them all a pain in the ass. Technical support is limited to ignoring your, or asking for your specs and then ignoring you, and running runtime-packed executables takes for ever. Stick with KAV-first class <-QUOTE}

In a moment of madness I installed Kav5 during which time I lost 4 yrs work, am now back with NOD32. As my mum used to say "a man must know their own limitations" never was a truer word spoken

[Nitrox]

I am not too thrilled with this new version either, I have uninstalled it and went back to version 3.5 which I have been using without problems for many years.
Here is another interesting thing I discovered about this new version; it attaches some kind of identification string to all your files.
Here is a screen capture of a desktop wallpaper as an example.
I could be mistaken but this only started to happen when I had version 5 installed, after I uninstalled it the files no longer had this string attached to them.
I do not appreciate the fact of having invisible strings attached to any file, what is it used for?
Any one come across this or is it specific to my computer only?
Thanks.

[Rainwalker]

Greetings........for the first time i bought a product w/out trying it first ::)
This was a huge mistake......kav really messed things up ...i was unable to load me desktop.......went to safe mode...ran chkdsk /f ....was able to load desktop but when i tried to reboot again desktop would not load.....stopped other scanners from loading @ startup....problem persisted....removed Kav from startup....problem persisted...unchecked Kav in system configuration utility / services and things were back to normal.......also, while Kav was loaded tested with eicar and Kav did not see it ( failed ).......OK...maybe i should have reinstalled but too unhappy...maybe i will try again when next version update appears...... Kav embeds a number of streams..maybe no big deal....will post my stream concern to Trojan Defense Suite

[ronjor]

Nitrox

That entry you see is made in your alternate data streams. Do a google on alternate data streams for info.
I don't like antivirus programs do this without my permission.
Etrust is another that will do it.

Links


http://www.dmares.com/maresware/articles/ads.htm

http://www.crucialsecurity.com/downloads.html

[Rainwalker]

:o :o :o :o Ronjor, thanks for http://www.crucialsecurity.com/downloads.html
every bit of information on my system has been embeded with Kav :-X :-X
have no idea how to get rid of it :'(

[ronjor]

I tried a beta of KAV and found these entries afterwards. Having used Etrust, I was familiar with the cause.
Only way I found to get rid of them was to format.
They probably don't harm anything. I just don't like the fact they are there.

[Rainwalker]

WOW......... nor do i >:(

[Oomingmak]

Does anyone know if this still happens in eTrust even with the 'Scan Alternate Data Strems option turned' off?

[Pilli]

TDS3 will remove hidden data streams but it is long winded as you have to do each one individualy. Hidden data streams are also used by some image files as a sort of tag.
Another way to remove them is to copy files to a FAT or FAT32 filing system and then copy them back to NTFS :)

For more information: http://www.diamondcs.com.au/index.php?page=archive&id=ntfs-streams

[Paul Wilders]

{QUOTE->
KAV v5 is very, very new; all sorts of problems are bound to be encountered - and this does ot go for KAV only, but for fairly all new releases. In case you really want to go for it, better wait say a month; issues might have been sorted out by then. <-QUOTE}

Strange, quoting myself :) - then again: it still stands.

regards.

paul

[Nitrox]

{QUOTE-> Nitrox

That entry you see is made in your alternate data streams. Do a google on alternate data streams for info.
I don't like antivirus programs do this without my permission.
Etrust is another that will do it.

Links


http://www.dmares.com/maresware/articles/ads.htm

http://www.crucialsecurity.com/downloads.html <-QUOTE}

Thanks Ronjor, very useful info you have provided.
Now I am really pissed off, I will never use any new version of KAV and if they stop supporting 3.5 I will find another anti-virus to use.
This is really bad programming on the part of KAV, they should have a way of uninstalling all that crap when you uninstall the program.
Guess I'll be uninstalling Etrust as well.

[Rainwalker]

I don't believe there is a way to uninstall them via an uninstall program......someone will correct me if i am wrong. I'll try tomorrow to ran another tds scan to see if it will scan correctly and NOT post ALL streams....

[solarpowered candle]

You may like to try the kav registry cleaner
www.kasperskylab.co.uk/files/utils/remkav.zip This should clean any remnants of kav from your system . I would suggest you post over at http://forums.useice.com/cgi-bin/ikonboard.cgi?s=4026ce7c747bffff as you may find a simple solution to your problem s . Many run both Kav and Nod successfully. It would be most interesting, also, to hear what Igor or Lisa have to say of the entry into your pc s alternate data streams .

[Rainwalker]

Thanks for getting back Solarpowered candle.....can not use cleaner as i have removed all the Kav stuff except the streams....i will post to their site when i have time....maybe later today.

[noone]

in regards to removing the ADSs that Kaspersky creates, you may want to check the Cygwin mailing list archives, I think I remember something related to removing ADS there sometime. Basically, I think the idea is to dissociate the ADS from the files, and then run chkdsk, which sees the orphaned ADS and removes it. Cygwin uses ADSs to help it translate between Unix/Windows security permissions on files it creates.
Good luck!

[nil]

{QUOTE-> TDS3 will remove hidden data streams but it is long winded as you have to do each one individualy. <-QUOTE}
Then it is not really a solution if you have e.g. 100000 files to clean from KAV streams.

KAV should release a tool for this task! It's unbelievable ...

{QUOTE-> Another way to remove them is to copy files to a FAT or FAT32 filing system and then copy them back to NTFS :) <-QUOTE}
I'll try it this way.

Regards

[owziee]

I can't understand what the problem is since it doesn't take up any extra HD space and it doesn't slow down the computer either. It isn't exactly spyware either ::)

[noone]

{QUOTE-> Then it is not really a solution if you have e.g. 100000 files to clean from KAV streams.

KAV should release a tool for this task! It's unbelievable ...


I'll try it this way.

Regards <-QUOTE}

very bad idea.
you'll lose all the security permissions on the files in the process.
like I said, check the Cygwin list, there's probably a tool included in Cygwin just for dissociating the ADSs.

[Joerg]

You can try "streams" from Sysinternals which should be capable to delete such ADS.
Link: http://www.sysinternals.com/ntw2k/source/misc.shtml#streams

"streams -s -d C:\" from the command line should to the trick.

regards, Joerg

[Ailric]

Thanks Joerg, that seems to have done the trick!

[tazdevl]

Holy cases of thread resurrection batman. ;D

[Eliot]

{QUOTE-> You can try "streams" from Sysinternals which should be capable to delete such ADS.
Link: http://www.sysinternals.com/ntw2k/source/misc.shtml#streams

"streams -s -d C:\" from the command line should to the trick.

regards, Joerg <-QUOTE}

What if your program files are on a different drive? Does it need to be ran there too? Thanks
*puppy*

[Mele20]

This is sure an interesting thread! I had never even heard of alternate data streams until I read this thread. I am currently trialling KAV 5.0. So, I was immediately concerned. I downloaded Crucial ADS. It found 145 instances of files with ADS. So, I guess KAV fixed their problem.

Should I use the System Internals Stream program to delete the ADS from these 145 files? I'm wondering if some of the ADS is useful and should be left.

[tazdevl]

Leave them alone if everything is running fine. ADS' are just tags used to make the scan process more efficient. People are more pissed off about the fact that KAV installed them without asking permission first. Also in version 121 they were added to pretty much everything.

[Mele20]

I don't think these are from KAV although I don't really know how to tell. How do I tell? Since there are not a lot of them and they are mostly certain programs but not all, Dell stuff and system restore files, I don't think KAV put them there. KAV would have tagged all the program files right? Why just some? What if some of them contain viruses? From the information I have read on ADS that can happen and no AV can detect it. What if there is some kind of tracking information put there and not by KAV?

[dvk01]

ADS are information embedded within files on the NTFS file systems only

KAV wouldn't have put them on the computer all it did was made them visible to you

ALL jpg images have them

Nothing to worry about normally, but some baddies use this method to infect system files so if when you scan any system folder or file has an ADS then investigate further

It is used by Windows NTFS file systems (XP/W2K 2003) as a method of tagging files so it can manage them more efficiently

[Joerg]

{QUOTE-> What if your program files are on a different drive? Does it need to be ran there too? Thanks
*puppy* <-QUOTE}

Yes, you have to run it on each drive separately.

[noone]

{QUOTE-> You can try "streams" from Sysinternals which should be capable to delete such ADS.
Link: http://www.sysinternals.com/ntw2k/source/misc.shtml#streams

"streams -s -d C:\" from the command line should to the trick.

regards, Joerg <-QUOTE}

That removes all ADSs from all files on drive C...
Does anyone know the names of the ADSs that Kaspersky adds, something like:
C:\filename.exe:Kaspersky.md5
maybe then it would be possible to just clean out KAV's ADSs.

It's possible to check the name with the Sysinternals tool, I would do it myself but since it seems some other people have it installed already maybe they could pipe in...

[steve_h]

{QUOTE-> It's possible to check the name with the Sysinternals tool, I would do it myself but since it seems some other people have it installed already maybe they could pipe in... <-QUOTE}

It adds ADS to basically ALL files, not just a few as you will see if you run Streams. The ADS additions have various names, e.g. kav64xxx, kav 128xxx.

Steve