Help me with Kav and Streams

I finally got around to buying Kav Personal 5 but I need help with the streams.

Everybody keeps telling me that during the installation process that Kav will allow me to choose whether streams should be enabled or not. I installed both 5.014 and 5.0227 and neither asked me or gave me an option to disable it.

Are there any problems if I use a 3rd party software to remove the streams afterwards?

 

If you remove the streams after you have run Kav it will just replace them with the first scan.

 

ummm what? I have trouble understanding that response.

What I need to know is how do I make Kav stop making streams. I was never given that option during the installation process.

 

I also have kav 5.0 and was not given the option to not install streams either.


and that should say it will replace the streams on the next scan not the first scan.


bigc

 

Actually you was, it was just sort of hidden. When you install 5.0.227, you will during the install be prensented with a "Operate to recommended settings" or something like that, uncheck this move on, next the option to disable ADS/Istreams and also IDS/network module is possible, so you unfortunately have to uninstall, clear the ADS with for example ADS spy and then reinstall the way i desciped.

In Pro you disable ADS via the GUI.

 

Thanks Don Pelotas that is good info to have.

bigc

 

Thanks, I saw that checkbox but thought that was an agreement license or something and left it checked.

Could I enable the streams in the future if I needed to?

 

I thought you already knew about disabling iStreams bigc

 

If you want to enable streams on the PERSONAL version of KAV, you need to reinstall. On the PERSONAL PRO version, streams can be disabled/enabled through the program settings.

 

But if you disable iStreams using the GUI in KAV5 Pro does it also automatically remove all current NTFS data streams?

 

Kaspersky has a tool called Klstreamremover. Find it here: http://www.kaspersky.com/faq?qid=156666512

Rename it kls.exe and place it in your root directory. Bring up a DOS prompt and run the command kls.exe c: -r

Run it again for any other partitions you may have on your hard drive replacing the "c:" with the appropriate drive letter.

This puppy will remove every Kaspersky related stream. I've used it after evaluating various KAV builds, and it works flawlessly.

 

Thats the first time I hear that!? People on the ICE kasperky board had serious problems with it.

 

What I read, no it won't. But I haven't tested Personal Pro, I'm very happy with my Personal version

 

The KAV removal tool did not work for me and for some folks in the KAV forums. Using a tool that BigC recommended finally did the trick. (Thanks again, BigC).

Acadia

 

I shall learn about this PC thing YET, with your help.

What is the root directory??

Thanks a bunch again people!

 

root directory= c:\

.....

Thanks for the link to the official Kav Stream Remover. I was using AdsSpy but it couldnt do a "select all" to remove all the streams at once and so it was taking a long time. I used the official Kav Remover and it works nice and fast.

 

The KAV Stream remover did not work properly for some people.

 

I was one of those who had my video drivers eaten by that KAV tool. ADS Spy doesn't remove them either although it is good for other ADS tags you want to identify and remove. I have a few remaining and it says it has removed them but when I check with Streams Shell Extensions they are still there. Streams Shell Extensions cannot remove them either although it removes every other ADS tag I have found and I use it daily. Streams from System Internals worked best for me but it needs to be run in safe mode which I didn't know and it takes many hours to remove them so you need to run it while sleeping.

 

Or use RejZor's stream-removal tool (based on Sysinternals program), run it first in normal mode to remove most streams, then reboot to safe-mode to remove most of the remaining streams. This way, the process goes much quicker

 

no matter what you use, these utilities do not seem to get rid of the ads on files with the read only attribute. On a typical XP system there will be quite a bit of stuff left over until these attributes are cleared. Oh, yes, reset the attributes when done, which may be a pain in some cases.

 

What specific reasons might one have for removing the streams? Are they deleterious in some way? Do they slow down the machine? Are they just messy? I know they are supposed to speed up KAV scanning (at least that's what I thought) - but in what ways might they be considered undesirable, with or without KAV?

 

KAV ADS are not harmful themselves. However, some forms of exotic malware hide in ADS. The large number of ADS that KAV generates make it difficult to use utilities that detect malware hidden in ADS. Most recently, Sysinternals released a free utility to scan for rootkits. It also picks up KAV ADS, making the utility nearly useless unless the KAV ADS are deleted.

 

At least one program that I know of, Raxco's FirstDefense-ISR, is incompatible with the ADS that Kav creates. Raxco will not offer tech support for FirstDefense to systems that also have KAV 5.0 installed.

Acadia

 

Hmmmm, is it just me or do others also find it ironic that a program like KAV, whose sole reason for existence is to root out the baddies, is also giving the baddies a place to hide?

Acadia

 

I think Kaspersky didn't consider such a thing when they decided to go this route. I don't think Eugene Kaspersky had the slightest notion that users would become upset by this tagging and that IStreams would become such a "hot potato". I think he was thinking primarily of how to set up KAV 5.0 so that he could sell it to the OEMs. OEMs generally want an AV that has an easy to use GUI with few choices (so as not to confuse the masses) and which does an on demand scan in a "reasonable" period of time and doesn't bog down the owner's computer too much. The latter isn't too important on the new computers the OEMs would put this AV on because they are fast and come with plenty of RAM. So, Kaspersky had to address the first two issues. They did so admirably. 5.0's GUI is so different from 4.5 that you would think, at first glance, that the two were from different vendors. Kaspersky also solved the problem of a scheduled scan taking too long for the average user's taste by introducing the now "infamous" IStreams.

So, IMO, all this stems from Kaspersky's desire to get into the OEM market.