Help - Search - Members
Full Version: KAV 6.0.3.837 and large TMP files?
Kaspersky Lab Forum > English User Forum > Protection for Small and Medium Businesses
neXus2007
As title says.
But why is KAV doing this? Without any/my permission, it somehow silently scans my PC(none of the scans are started), and it's hoging it, because it's taking up a lot of GB in temp folder. Can this be somehow disabled, because it is reaaaaaallllyyyyy anoying? And because of that Nero is tripping that some other program is taking up temp folder and cannot continue because it needs space.
neXus2007
Need to add: It's periodicly hoging when i'm typing, even here on this topic.
And my PC is not slow: C2D E8400 @ 3300, 4GB ram, etc....
Ken Giese
QUOTE(neXus2007 @ 23.09.2009 12:24) *
Need to add: It's periodicly hoging when i'm typing, even here on this topic.
And my PC is not slow: C2D E8400 @ 3300, 4GB ram, etc....


We ran into this problem as well back when we first inplemented Kaspersky in our company. The problem is the Web Anti-virus and Proactive Defense. These two modules seem to like creating log files that can take upto 50gig of hard drive space. We contacted Kaspersky about the issue and finally resolved to turn these two features off as no one could give us a good resolution.
neXus2007
Actually I'm using it at home, but my company purchased 1 more licence (14 licences), as I've said - for me to use at home. But nevertheless, also the same problem appears at work. As I administer company computers, I had comments how KAV actually slows down PC from time to time, except "after boot scan" of critical areas, making it unusable for like an hour, more-less.

KAV has only these precautions: File, Mail and Web protection. All of the other: spam, proactive defence, are not installed, because it always asks this and that, and it is hard to educate workers there on how to allow or disallow, and even to put it in "trusted". And it is very annoying after all. For trojan/malware etc. we purcashed another software. And I even didn't installed those components at home.

I don't believe that, only left, Web protection is causing this, because there are PC's that are not conected to the web, nor have anything to do with web(WWW). Mostly because it is consuming space in GBytes(temp), and you cannot download 1GB in, like, few seconds on 3MBps connection. Nor on 44Mbps.

This has something to do with some sort of background scanning, without any admin permission, or without any permission at all.

If anyone knows how to disable this, preferably Moderators or even if there is a KAV employee herre on forums, free feel to give some explanation.
neXus2007
OK, I had online chat and this is reeeeaaaaalllllyyyyyy stupid that KAV from USA, and only that provides online chat support, does this:

QUOTE
removed by admin


Ok, if a software is purchased, I expect software support, not for where I'm from. Actually I could be US citizen living in Serbia, and I need online support. Who gives a damn where I'm from, if this product is purchased(key) then I expect support even if I'm on Mars. Like I've asked to support my country, not KLabs product.

Damn, because of this my company can sue KLabs because of this policy. And they provide judicial system(mediation center).

Luckly we have official MS in our country(with software engineers), but imagine if there is no MS in my country, or stuck with resellers:

- Hello

Hello

- I've purcashed WinXP, and I have serious problems with it.

OK. Where are you from?

- Serbia.

Sorry we do not support Serbia.

Click.....tuuuut.....tuuuut.


Bravo Kaspersky, bravo laugh3.gif bravo.gif
Natalia Pasynkova
Dear neXus2007,

KL Americas does not provide tech support for our customers who have purchased KL’s products in other countries (not in Americas). That is really true.

You should contact our Serbian partner Singi Inzenjering d.o.o. by phone or via HelpDesk web-form.

If this KL partner cannot solve your problem they will send your request to KL EEMEA.

Please, submit the request and keep me informed.

Thank you!
neXus2007
Thank you Natalia, but it would be nice if there would be a chat on international level. wub.gif

Singi inzenjering cannot help me on this issue, because this is more of a dev. issue. So can you ask them, or if you know, as I've explained, why KAV is making these large TMP files, without any scan started? And can it be fixed with some next software update.

There is one more thing I wanted to ask KAV chat support, but I hope I can resolve this issue here.

Some webpages, and Youtube/flash embeded webpages have problem with loading.
Webpages just sit at the begining of loading, and Youtube videos do not even load or just don't want to start. Issue can be resolved by pausing protection, or unchecking everything that has to do with HTTP monitoring in Port monitoring option, thus leaving protection on.

Youtube problems occur randomly, sometimes it works, but after few clicks on different videos don't. And sometimes just happens instantly.
Tybilly
Hello,

What are the names of these temporary files and where are they located ?
Also create the GetSystemInfo report of an affected computer, upload it on the parser and put the URL here.
neXus2007
I created temp folder to root (C:\Temp) for easy access (system properties/advanced/enviroment variables/everything that has to do with temporary files and folders), because I want everything to pile up onto this one folder for easy deleting. I hope you catch my drift.

Names of those files are: PR(some numbers, 2 of them)letter.TMP

Here is the GSI Parser link: http://www.getsysteminfo.com/read.php?file...f43bb5&ms=0
Tybilly
Yes it's ok.

I did some research on the forum and this issue could be related to a malware or a crash of the AV scanner (which can explain why you face some freezes while typing).
The GetSystemInfo could really give more details.
neXus2007
No, there is no malware nor other "ware" on this PC nor on company PC's. The "freezing" while typing occurs only when TMP files of KAV fills up Temp space, actually remaining space on C drive.
phr3n1c
Try to lower saving time for logs to 1 day and have a look if problem persists.
neXus2007
I tried that, even disabling them, but as I see it has nothing to do with logs or reports.
neXus2007
Here is the picture of those TMP files being created. Note - As I've said, KAV doesn't do any scan at all.

Tybilly
What about the GetSystemInfo report?
neXus2007
Here it is, if you missed:

http://forum.kaspersky.com/index.php?showt...t&p=1102170
Tybilly
Try this:

1. Use the KAVremover utility and uninstall KAV: http://support.kaspersky.com/kis2010/service?qid=208279463
Reboot the computer at the end of the process.
2. Install KAV once again. Run the update task during the installation process.
Reboot the computer and run a full scan
neXus2007
Thanks for the info Tybilly, but I already tried everything possible. From that utility to manual deletion in registry. But this is not a problem that is caused by malfunction of KAV, as I've tracked what is it doing.

Edit: Tybilly, this doesn't happen on my PC only, it happens on 11 more that have, let's say, fresh WinXP. Few programs installed. And 2 of them are freshly installed about 2 months ago.

I have several files that are stored in ISO and Acronis backup that are pulled back from server and transfered, by me, onto my PC for addition checkout of employees work, and of course few games from D2D that are "ISO" based. Anyway, I think I figured out why KAV is making those TMP files. At least what tracking software logged.

QUOTE
-- avp.exe - access/read - E:\Backup\25.09.2009\PC3 Backup.ISO - 27.09.2009 - 17:43:06
-- avp.exe - write - E:\Backup\25.09.2009\PC3 Backup.ISO - C:\Temp\PR2F5.TMP - 27.09.2009 - 17:43:08
-- avp.exe - access/read - E:\Backup\25.09.2009\PC3 Backup.ISO - 27.09.2009 - 17:44:15
-- avp.exe - write - E:\Backup\25.09.2009\PC3 Backup.ISO - C:\Temp\PR2F6.TMP - 27.09.2009 - 17:44:19

etc....


And even there is deletion captured in log file: -- avp.exe - delete - C:\Temp\PR2F5.TMP - 27.09.2009 - 17:51:06

And this is the "thinking" part:

Large files, ISO or any large "package" files, when modified, KAV scans them in unusal way. The part that is File AntiVirus in KAV, instead of scaning large files within, it somehow makes those TMP files, copies of the actual files, while checking with KAV File AntiVirus.

For example:
I store backup onto my HDD, KAV starts scaning that backup(no actual scan active), and makes TMP files while scanning. it's not immediate, but sometimes it does that upon finished copying. Although KAV scanned those files while copying. I wonder why it is doing that. Also, as I've said, it "scans" them upon finished modification, and even "scans" them without any modification or tempering with them. That last thing is what is bugging me, and ofcourse, making TMP files while "scanning".

Either devs must modify KAV that makes at most 100MB TMP files, and upon finishing of first 100MB TMP file KAV must delete that, and continue with new 100MB file. Or disable that function and let KAV scan files without any TMP. And possibly include that in update.


Now, what about other problem, with HTTP port monitoring?
Tybilly
That's a deep analysis, anyway I can't explain this behavior. What I know is that KAV is able to scan several formats of archives and that sometimes it's not a benefit as it can take time and resources.

Kaspersky Lab will release a new version of some corporate products soon (in about 1 week as far as I know) which include protection of workstations, servers and centralized management. I participated in the beta test and the new version has a different engine from the one you know so maybe it will help solving your issues.
Moreover, script analysis are done in a different way compared to the current version then it may also help with your browsing issue.
neXus2007
QUOTE
Moreover, script analysis are done in a different way compared to the current version then it may also help with your browsing issue.


Well this problem occured after some update, also few months ago. I can install KAV from scratch, and without any update I can browse flawlessly, and as soon as I update(latest software upgrade and antivir def.) something is messed up. Perhaps some script for HTTP monitoring, as you say. So there is no option for me but to uncheck everything that has to do with HTTP within Port monitoring.

I hope there will be new corporate products. But will existing licence key for multiple computers work with new version of corporate/workstation product?
Tybilly
Citation (neXus2007 @ 27.09.2009 13:55) *
I hope there will be new corporate products. But will existing licence key for multiple computers work with new version of corporate/workstation product?


Yes, as long as your current license key is valid, you can use new version for free.
You can subscribe to the mailing list of new articles in the KB? then you will be warned when this new version will be available.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.