Removing Tags made by KAV

[magoood]

Hi - have installed Kaspersky personal which was released a long time ago b4 the current version (don't remember its exact version, may be 5.0.156) and as everybody knows, it tags some information without user's request and these tags don't go away even after uninstalling the prog 4 ever. Any tool that can remove it totally from system ?

[fredra]

{QUOTE-> Hi - have installed Kaspersky personal which was released a long time ago b4 the current version (don't remember its exact version, may be 5.0.156) and as everybody knows, it tags some information without user's request and these tags don't go away even after uninstalling the prog 4 ever. Any tool that can remove it totally from system ? <-QUOTE}

There is a member here...her name is MELE20...and she has ALL the relevant information on these tags and how to remove them or not.
She will be able to help you.
Hey MELE20...this person needs your assistance!!!!
Cheers :)

[dog]

Merijn's ADS Spy will remove those :kavich ADS streams without any trouble.

You can DL it here --> http://www.spywareinfo.com/~merijn/ (center pane - 3rd text box down)

I used it myself ... for that very same problem. It works like a charm, as do all of Merijn's Products.

HTH, ;)

Steve

[Diver]

These utilities work best if run in the safe mode. I have not tried this particular one, but some of the others willl not remove ads from read only, hidden or system attribute files.

[magoood]

{QUOTE-> Merijn's ADS Spy will remove those :kavich ADS streams without any trouble.

You can DL it here --> http://www.spywareinfo.com/~merijn/ (center pane - 3rd text box down)

I used it myself ... for that very same problem. It works like a charm, as do all of Merijn's Products.

HTH, ;)

Steve <-QUOTE}
Hi - thanks 4 the program. I tried it but unfortunately, it scans for c: only while i suffer with this tagging on F: partition >:(
I PM MELE20 but no answer so far. Searching 4 her posts is v. exhaustive 4 me 2 search coz they r 2 many. I'll wait then till i get a response from her >:(

[dog]

Have you tried run the app from the F drive ... copy it to that drive and see if the results differ. I don't know if that will work but it's worth a shot.

Steve

[Don Pelotas]

Or try NTFS Streams Eraser from http://www.excessive-software.tk/. :)

[ronjor]

http://www.wilderssecurity.com/showthread.php?t=47855

Older thread.

http://www.wilderssecurity.com/showthread.php?t=30616

[nameless]

{QUOTE-> It works like a charm, as do all of Merijn's Products. <-QUOTE}Charms don't work at all! ;)
-

[Mele20]

Sorry, I've been fighting a nasty virus for ten days now and haven't been here in a few days. Usually I come every day.

Kaspersky has a tool to remove them. I was one of the first to try the tool and it ate my video drivers. :( There was no "read me" file with the tool so I'm not sure I even used it correctly. I had removed most of them anyhow before this tool was available. Once there were instructions for using the tool, I didn't want to try again as I didn't have many and was not interested in having it eat my video drivers again. It ate a lot of nVidia drivers and a few ATI ones according to reports from users. If that problem has been fixed and especially if you don't have nVidia drivers then you should probably try Kaspersky's tool first.

I was able to remove the vast majority of them using Streams from System Internals.
http://www.sysinternals.com/ntw2k/source/misc.shtml#streams
It took forever but I didn't know to run it in command line safe mode. That is where it needs to be run. The ones that are left can be removed one by one by hand after getting a trial of TDS_3 if you don't have it. I don't know though if either of these will run on a partition other than C. I think the command is
streams -s -d c:\

You may also be interested in Streams Shell Extensions from a member of the SANS Institute. When installed as part of the Windows Shell it will show you, in Properties on any file, if there are any ads on that file. KAV is not the only company doing this and viruses can be placed this way also. Here is the thread I started on this at dslr.
http://www.dslreports.com/forum/remark,11624432?hilite=ads+tags+plus+explorer+shell