Kaspersky Virus Removal Tool Latest Topicshttps://forum.kaspersky.com/forum/kaspersky-virus-removal-tool-76/Kaspersky Virus Removal Tool Latest TopicsenWeird KL Drivers on my system after uninstall.https://forum.kaspersky.com/topic/weird-kl-drivers-on-my-system-after-uninstall-40181/ I noticed these while asking someone to do malware removal on my system. Are these safe?

IMG_0038.jpeg

]]>40181Mon, 01 Apr 2024 19:07:01 +0000Kaspersky Anti-Virushttps://forum.kaspersky.com/topic/kaspersky-anti-virus-38466/ Kaspersky Anti-Virus is interfering with my system updates. these updates are unsecure but useful to me any solution?

]]>38466Wed, 10 Jan 2024 15:38:41 +0000KVRT command linehttps://forum.kaspersky.com/topic/kvrt-command-line-37886/ I want to eliminate system memory, starupobject, and bootsector scanning by command, how do I do this? Because each scan takes a lot of time for the above 3 options. I only want to scan the folder I want to scan.

]]>37886Wed, 13 Dec 2023 02:23:23 +0000The new KVRT version Crushed my Windows 11https://forum.kaspersky.com/topic/the-new-kvrt-version-crushed-my-windows-11-35350/ I downloaded at 30.7.2023 the "Kaspersky Virus Removal Tool application" (https://www.kaspersky.com/downloads/free-virus-removal-tool). For the first time it asked for reboot for drivers (before the scan). But the system, Windows 11 pro 22H2 (OS build 2261.2070) version 10.0.2261 Build 22621, failed to start. There was nothing I could do but to restore to my latest retore point, to fix it.

Since then I'm afraid to use KVRT again.

Did anyone had this same problem?
Please check the KVRT.exe. It act like a virus this time.

]]>35350Thu, 03 Aug 2023 06:44:15 +0000Defender blocks TDSSKillerhttps://forum.kaspersky.com/topic/defender-blocks-tdsskiller-36297/ Hi, newbie here. I apologize if this question has already been answered here in the forum.

When I run TDSSKiller, Win Defender tells "For security reasons, the administrator does not allow you to access the content from C:\Windows\System32\drivers\[numbers].sys." Defender's options are OK or UNLOCK. (Please note that if I do NOT choose anything, TDSSKiller still opens and runs a scan.)

What should I do? Thanks in advance.

]]>36297Fri, 29 Sep 2023 16:01:02 +0000My Kaspersky removal tool displays dozens of products to removehttps://forum.kaspersky.com/topic/my-kaspersky-removal-tool-displays-dozens-of-products-to-remove-35901/ I uninstalled Kaspersky from my system, but then I learned that I should use the Kaspersky removal tool to fully remove it. So I did that and the tool displays dozens of products to be removed. Some of the products don't even leave the list when I remove them. What on Earth am I to do? The image doesn't even show all of the products that are listed. 

image.png

]]>35901Tue, 05 Sep 2023 05:44:34 +0000KVRT marked as malwarehttps://forum.kaspersky.com/topic/kvrt-marked-as-malware-35374/ I downloaded KVRT and decided to check the version... Its version(20.0.11.0) is seemingly not documented, and it seems to be a recent file change(a few hours prior to posting this)
Then I threw it into the file analysis page, and it returned as malware. Don't know if anything of this is legit or a false positive, figured I should mention it here.

]]>35374Sat, 05 Aug 2023 12:02:54 +0000TDSSKiller - Download link not workinghttps://forum.kaspersky.com/topic/tdsskiller-download-link-not-working-35240/ The download link for TDSSKiller isn't working: Download Free TDSSKiller - Rootkit Removal | Kaspersky Lab US

After clicking in "Download Now" it just sends to another page and doesn't perform any download. This is a recent problem.

Can someone please report / fix / let know if the tool has been discontinued?

Thanks.

]]>35240Thu, 27 Jul 2023 09:12:12 +0000Does Kaspersky Virus Removal Tool include Anti-Rootkit and Firmware Scanner ?https://forum.kaspersky.com/topic/does-kaspersky-virus-removal-tool-include-anti-rootkit-and-firmware-scanner-22720/Greetings to the entire Kaspersky community ! My question below.

The logs of the scan performed with the portable Kaspersky Virus Removal Tool, includes paths corresponding to the hidden Windows10 Recovery and Boot Efi partitions ( \\?\Volume{GUID1}\ \\?\Volume{GUID2}\ ), as well as specific files present in these partitions ( …\EFI\Microsoft\Boot\bootmgfw.efi ).

If possible, I would like to know if Kaspersky Virus Removal Tool includes the Anti-Rootkit and Firmware Scanner functions described in this page and if the related scanning patents are implemented.

]]>22720Mon, 24 Jan 2022 10:35:55 +0000About KVRT Drivers in process systemhttps://forum.kaspersky.com/topic/about-kvrt-drivers-in-process-system-34891/ When I use the kvrt2020 to scan my computer, I found that after scanning in the Windows 10 environment, the cleanup file script released by kvrt cannot delete the klupd driver files released in the drivers directory and kvrt_data directory. These driver programs are usually mounted in the system process. However, when using it in the Win7 SP1 version, the above problem does not exist. Do I need to restart the device to delete the driver program, or do I need to do other additional configurations?

]]>34891Wed, 05 Jul 2023 03:29:24 +0000Can't launch KVRT "Can't initialize dump writer"https://forum.kaspersky.com/topic/cant-launch-kvrt-cant-initialize-dump-writer-10663/Hello,

I can’t launch the KVRT.

It block at 35% with the Error message : “Can’t initialize dump writer”.

Before, the tool works nice, no problem.

I tried old version, same message.

I deleted all files about KVRT (C:/KVRT_Data) but no improvement.

It seems be on my computer, may be a corrupted DLL but the tool do not send any information about the error.

I found nothing about my problem on any plateform (here included).

Some one can help me ?

 

Regards,

Ju’

]]>10663Thu, 06 Aug 2020 15:13:50 +0000Dangerous website (according to Kaspersky Security Network) http://himachaltaxitourpackages.com/https://forum.kaspersky.com/topic/dangerous-website-according-to-kaspersky-security-network-httphimachaltaxitourpackagescom-30413/ the website are clean  from virus plz remove from Kaspersky Security 

https://sitecheck.sucuri.net/results/https/www.himachaltaxitourpackages.com

]]>30413Wed, 04 Jan 2023 07:52:56 +0000USB, CD, NETWORK, unusable after cleaning with kavremover on windows 7 prohttps://forum.kaspersky.com/topic/usb-cd-network-unusable-after-cleaning-with-kavremover-on-windows-7-pro-30182/ Hello,

I have a windows 7 pro pc with kes installed.

I removed kes using kavremover in safe mode since I could not find the password.

After removal I have the peripherals not working, if i plug a vga a ps2 mouse and keyboard I can login.

Checking with the Device Manager it says that network card, usb, cd devices are unusable with Error 19.

Some corruption or block at a registry level.

Is that some sort of security measure inside kes?

Do you happen to know how can I fix that?

 

]]>30182Thu, 22 Dec 2022 13:51:20 +0000KTS AMD Chipset Software false positivehttps://forum.kaspersky.com/topic/kts-amd-chipset-software-false-positive-29878/ It's the second time KTS thinking my AMD Chipset Software installer has a trojan. I can't update my chipset drivers because of this. Get you stuff together!

OS: Windows 10 Pro 22H2 KTS: 21.3.10.391 (j)

AMD Chipset Installer version: 4.11.15.342, downloaded directly from amd.com

]]>29878Fri, 09 Dec 2022 16:09:57 +0000How to uninstall kaspersky virus remover toolhttps://forum.kaspersky.com/topic/how-to-uninstall-kaspersky-virus-remover-tool-29728/ Hello, im need help. How to do full uninstall kaspersky virus remover tool ? Pls help

]]>29728Sat, 03 Dec 2022 06:52:56 +0000KVRT: Can't load driver: Windows 10 Enterprise:https://forum.kaspersky.com/topic/kvrt-cant-load-driver-windows-10-enterprise-29123/ Hello, I get the error message "Can't load driver" with the actual KVRT 2020. It woould be nice to get some help.
Thank you in advance!

Trace:

KVRT...log:

AVP TRACE FILE     Time: 10.11.2022 10:43:30.215 PID: 25936 (0x6550)

10:43:30.209    0x5244    INF    alloc: Use allocator 0x2b0ef18 and tag <KVRT root> in 0x49c07a0
10:43:30.209    0x5244    INF    alloc: Use allocator factory 0x49c0a50 and tag <KVRT> in 0x49c0a68
10:43:30.209    0x5244    INF    kvrt: klmd: KLMD driver object 0x48df564 was created
10:43:30.209    0x5244    INF    kvrt: klsl: KLSL driver object 0x48df650 was created
10:43:30.210    0x5244    INF    vrt: lang: System default language is English
10:43:30.210    0x5244    INF    kvrt: cmdline: App type is <Product>, default language is <English>
10:43:30.211    0x5244    INF    kvrt: cmdline: Language is <English>
10:43:30.211    0x5244    INF    vrt: env: Begin expanding environment var <C:\KVRT2020_Data>
10:43:30.211    0x5244    INF    vrt: env: Expand <C:\KVRT2020_Data> into <C:\KVRT2020_Data>
10:43:30.211    0x5244    INF    vrt: bl: Path <C:\KVRT2020_Data> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.211    0x5244    INF    vrt: fshlp: Make secure directory <C:\KVRT2020_Data> accessFlag = 1
10:43:30.212    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.212    0x5244    INF    vrt: fshlp: Security information bit mask 0x4
10:43:30.212    0x5244    INF    vrt: secDesc: SecurityDescriptor is equal
10:43:30.212    0x5244    INF    vrt: bl: Path <C:\KVRT2020_Data\Traces> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.212    0x5244    INF    vrt: fshlp: Make secure directory <C:\KVRT2020_Data\Traces> accessFlag = 0
10:43:30.212    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data\Traces> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.212    0x5244    INF    vrt: fshlp: Security information bit mask 0x4
10:43:30.212    0x5244    INF    vrt: secDesc: SecurityDescriptor is equal
10:43:30.212    0x5244    INF    vrt: bl: Path <C:\KVRT2020_Data\Quarantine> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.212    0x5244    INF    vrt: fshlp: Make secure directory <C:\KVRT2020_Data\Quarantine> accessFlag = 0
10:43:30.213    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data\Quarantine> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.213    0x5244    INF    vrt: fshlp: Security information bit mask 0x4
10:43:30.213    0x5244    INF    vrt: secDesc: SecurityDescriptor is equal
10:43:30.213    0x5244    INF    vrt: bl: Path <C:\KVRT2020_Data\Reports> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.213    0x5244    INF    vrt: fshlp: Make secure directory <C:\KVRT2020_Data\Reports> accessFlag = 0
10:43:30.213    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data\Reports> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.213    0x5244    INF    vrt: fshlp: Security information bit mask 0x4
10:43:30.213    0x5244    INF    vrt: secDesc: SecurityDescriptor is equal
10:43:30.213    0x5244    INF    vrt: bl: Mod directory <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}>
10:43:30.213    0x5244    INF    vrt: bl: Path <C:\KVRT2020_Data\Temp> , isExists 0, isFolder 0, bSymlink 0, bLocal 1
10:43:30.213    0x5244    INF    vrt: fshlp: Make secure directory <C:\KVRT2020_Data\Temp> accessFlag = 0
10:43:30.213    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data\Temp> , isExists 0, isFolder 0, bSymlink 0, bLocal 1
10:43:30.213    0x5244    INF    vrt: fshlp: Create secure directory <C:\KVRT2020_Data\Temp> accessFlag = 0
10:43:30.213    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data\Temp> , isExists 0, isFolder 0, bSymlink 0, bLocal 1
10:43:30.214    0x5244    INF    vrt: bl: Path <C:\KVRT2020_Data\Anomalies> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.214    0x5244    INF    vrt: fshlp: Make secure directory <C:\KVRT2020_Data\Anomalies> accessFlag = 1
10:43:30.214    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data\Anomalies> , isExists 1, isFolder 1, bSymlink 0, bLocal 1
10:43:30.214    0x5244    INF    vrt: fshlp: Security information bit mask 0x4
10:43:30.214    0x5244    INF    vrt: secDesc: SecurityDescriptor is equal
10:43:30.215    0x5244    INF    vrt: bl: ============================================================
10:43:30.215    0x5244    INF    vrt: bl: Product version:  Kaspersky Virus Removal Tool 20.0.10.0
10:43:30.215    0x5244    INF    vrt: bl: Compilation date: Oct 25 2021 16:21:50
10:43:30.215    0x5244    INF    vrt: bl: Scan type:        Active OS
10:43:30.215    0x5244    INF    vrt: bl: Command line:     I:/temp/{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}/\9ec603af.exe -trace -dontencrypt
10:43:30.215    0x5244    INF    vrt: bl: Product folder:   "C:\KVRT2020_Data"
10:43:30.215    0x5244    INF    vrt: bl: Mod folder:       "I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}"
10:43:30.215    0x5244    INF    vrt: bl: Trace level:      700
10:43:30.215    0x5244    INF    vrt: bl: ============================================================
10:43:30.215    0x5244    INF    vrt: sysinfo: Current local date / time: 2022/11/10 10:43:30.0215
10:43:30.215    0x5244    INF    vrt: sysinfo: SystemInfo:
10:43:30.215    0x5244    INF    vrt: sysinfo:
10:43:30.215    0x5244    INF    vrt: sysinfo: OS Version: Windows 10
10:43:30.215    0x5244    INF    vrt: sysinfo: OS build: 10.0.19045.2251
10:43:30.215    0x5244    INF    vrt: sysinfo: OS bitness: x64
10:43:30.215    0x5244    INF    vrt: sysinfo: OS ServicePack: empty
10:43:30.215    0x5244    INF    vrt: sysinfo: OS Wow64: enabled
10:43:30.215    0x5244    INF    vrt: sysinfo: OS KMCI: disabled
10:43:30.217    0x5244    INF    vrt: sysinfo: Windows directory: C:\WINDOWS
10:43:30.217    0x5244    INF    vrt: sysinfo: System windows directory: C:\WINDOWS
10:43:30.217    0x5244    INF    vrt: sysinfo: Number of processors: 32
10:43:30.217    0x5244    INF    vrt: sysinfo: Page size: 4096
10:43:30.218    0x5244    INF    vrt: sysinfo: Boot type: Normal boot
10:43:30.218    0x5244    INF    kvrt: bl: ============================================================
10:43:30.218    0x5244    INF    kvrt: bl: Drop KVRT cleanup script
10:43:30.219    0x5244    INF    vrt: fshlp: Create secure directory <I:/temp/{7929329b-4bd1-471b-8bc7-f0785c8c4858}/> accessFlag = 0
10:43:30.219    0x5244    INF    vrt: fshlp: Path <I:/temp/{7929329b-4bd1-471b-8bc7-f0785c8c4858}/> , isExists 0, isFolder 0, bSymlink 0, bLocal 1
10:43:30.219    0x5244    INF    Folder deleter: Folder <I:\temp\{7929329b-4bd1-471b-8bc7-f0785c8c4858}> has been added in list
10:43:30.219    0x5244    INF    vrt: env: Begin expanding environment var <%KLIF_DEVICE_NAME%>
10:43:30.219    0x5244    WRN    vrt: env: Var <%KLIF_DEVICE_NAME%> is not found
10:43:30.219    0x5244    INF    vrt: env: Expand <%KLIF_DEVICE_NAME%> into <%KLIF_DEVICE_NAME%>
10:43:30.219    0x5244    WRN    kvrt: bl: Error query klif name with status 0x8000004c
10:43:30.219    0x5244    INF    vrt: fshlp: File <I:\temp\{7929329b-4bd1-471b-8bc7-f0785c8c4858}\0c73b130-a541-4da2-a3ac-3635aa629066.cmd> has been created
10:43:30.219    0x5244    INF    kvrt: reg winapi: Registry key <0x80000002, SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce> is opened as <0x23c>
10:43:30.219    0x5244    INF    kvrt: reg winapi: Registry value <0c73b130-a541-4da2-a3ac-3635aa629066> of key <0x23c, SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce> was set (b2 bytes)
10:43:30.219    0x5244    INF    kvrt: bl: Value <HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\0c73b130-a541-4da2-a3ac-3635aa629066> has been written with data <"I:\temp\{7929329b-4bd1-471b-8bc7-f0785c8c4858}\0c73b130-a541-4da2-a3ac-3635aa629066.cmd">
10:43:30.219    0x5244    INF    Folder deleter: Folder <I:\temp\{7929329b-4bd1-471b-8bc7-f0785c8c4858}> has been removed from list
10:43:30.219    0x5244    INF    kvrt: reg winapi: Registry key <0x80000002, SOFTWARE> is opened as <0x23c>
10:43:30.219    0x5244    INF    kvrt: reg winapi: Registry key <0x23c, KasperskyLab\Binaries\KVRT2020> is created as <0x244>
10:43:30.220    0x5244    INF    kvrt: reg winapi: Registry value <kldw.exe> of key <0x244, KasperskyLab\Binaries\KVRT2020> was set (70 bytes)
10:43:30.220    0x5244    INF    kvrt: bl: KLDW is setuped
10:43:30.222    0x5244    INF    vrt: dw: Module <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}\dumpwriter.dll> has been loaded at 0x0x6c3a0000
10:43:30.223    0x5244    INF    vrt: dw: Module <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}\dbghelp.dll> has been loaded at 0x0x66230000
10:43:30.223    0x5244    INF    vrt: dw: Dump writer has been initialized successfully
10:43:30.223    0x5244    INF    kvrt: bl: Creating kvrt clients logic...
10:43:30.223    0x5244    INF    kvrt: bl: kvrt clients logic has been created
10:43:30.236    0x5244    INF    kvrt: bl gui: GuiClientFactory: Verify
10:43:30.236    0x5244    INF    kvrt: bl gui: GuiClientFactory: Init
10:43:30.236    0x5244    INF    kvrt: bl gui: GuiClientFactory: GetInitializationClient
10:43:30.236    0x5244    INF    kvrt: bl gui: compver: 20.0.10.0 32-bit (Oct 25 2021 16:18:14)
10:43:30.236    0x3304    INF    kvrt: bl gui: qt thread start
10:43:30.236    0x3304    INF    kvrt: bl gui: guiThread begin
10:43:30.260    0x3304    INF    kvrt: bl gui: guiThread: Application font name "Tahoma", size 9
10:43:30.260    0x3304    INF    kvrt: bl gui: guiThread: Create MainDlg
10:43:31.033    0x3304    INF    kvrt: bl gui: Graphics info:
10:43:31.033    0x3304    INF    kvrt: bl gui:
10:43:31.033    0x3304    INF    kvrt: bl gui: 1. * pixelRatio = 100%, dpi = 96, geom = 3840x2160, scalingFactor = 100%
10:43:31.033    0x3304    INF    kvrt: bl gui: 2.   pixelRatio = 100%, dpi = 96, geom = 1920x1080, scalingFactor = 100%
10:43:31.033    0x3304    INF    kvrt: bl gui: 3.   pixelRatio = 100%, dpi = 96, geom = 1920x1080, scalingFactor = 100%
10:43:31.033    0x3304    INF    kvrt: bl gui: 4.   pixelRatio = 100%, dpi = 96, geom = 1920x1080, scalingFactor = 100%
10:43:31.034    0x3304    INF    kvrt: bl gui: 5.   pixelRatio = 100%, dpi = 96, geom = 1920x1080, scalingFactor = 100%
10:43:31.034    0x3304    INF    kvrt: bl gui: 6.   pixelRatio = 100%, dpi = 96, geom = 1920x1080, scalingFactor = 100%
10:43:31.034    0x3304    INF    kvrt: bl gui: 7.   pixelRatio = 100%, dpi = 96, geom = 1920x1080, scalingFactor = 100%
10:43:31.034    0x3304    INF    kvrt: bl gui: textScalingFactor = 100%
10:43:31.034    0x3304    INF    kvrt: bl gui:
10:43:31.034    0x3304    INF    kvrt: bl gui: qt thread init
10:43:31.034    0x5244    INF    vrt: clients: Module init client has been initialized successfully
10:43:31.034    0x5244    INF    vrt: clients: Module <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}\KvrtGui.dll> init client has been initialized
10:43:31.034    0x5244    INF    vrt: bl: Init client has been initialized
10:43:31.034    0x3304    INF    kvrt: bl gui: qt thread starting
10:43:31.034    0x3304    INF    kvrt: bl gui: qt thread continues
10:43:31.064    0x5244    INF    vrt: win env: Begin expanding environment var <%ProgramData%>
10:43:31.064    0x5244    INF    vrt: win env: Var <%ProgramData%> -> <C:\ProgramData>
10:43:31.064    0x5244    INF    vrt: env: Var <ProgramData> was setuped in <C:\ProgramData>
10:43:31.064    0x5244    INF    vrt: win env: Begin expanding environment var <%ProgramFiles%>
10:43:31.064    0x5244    INF    vrt: win env: Var <%ProgramFiles%> -> <C:\Program Files (x86)>
10:43:31.064    0x5244    INF    vrt: env: Var <ProgramFiles> was setuped in <C:\Program Files (x86)>
10:43:31.064    0x5244    INF    vrt: win env: Begin expanding environment var <%ProgramFiles(x86)%>
10:43:31.064    0x5244    INF    vrt: win env: Var <%ProgramFiles(x86)%> -> <C:\Program Files (x86)>
10:43:31.064    0x5244    INF    vrt: env: Var <ProgramFiles(x86)> was setuped in <C:\Program Files (x86)>
10:43:31.064    0x5244    INF    vrt: win env: Begin expanding environment var <%ProgramW6432%>
10:43:31.064    0x5244    INF    vrt: win env: Var <%ProgramW6432%> -> <C:\Program Files>
10:43:31.064    0x5244    INF    vrt: env: Var <ProgramW6432> was setuped in <C:\Program Files>
10:43:31.064    0x5244    INF    vrt: win env: Begin expanding environment var <%SystemDrive%>
10:43:31.064    0x5244    INF    vrt: win env: Var <%SystemDrive%> -> <C:>
10:43:31.064    0x5244    INF    vrt: env: Var <SystemDrive> was setuped in <C:>
10:43:31.064    0x5244    INF    vrt: win env: Begin expanding environment var <%SystemRoot%>
10:43:31.064    0x5244    INF    vrt: win env: Var <%SystemRoot%> -> <C:\WINDOWS>
10:43:31.065    0x5244    INF    vrt: env: Var <SystemRoot> was setuped in <C:\WINDOWS>
10:43:31.065    0x5244    INF    vrt: win env: Begin expanding environment var <%windir%>
10:43:31.065    0x5244    INF    vrt: win env: Var <%windir%> -> <C:\WINDOWS>
10:43:31.065    0x5244    INF    vrt: env: Var <windir> was setuped in <C:\WINDOWS>
10:43:31.065    0x5244    INF    vrt: env: Var <TEMP> was setuped in <C:\KVRT2020_Data\Temp>
10:43:31.065    0x5244    INF    vrt: bl: Generated PCID: {1CF27FB1-1091-D240-A514-1878A67CB5E0}
10:43:31.065    0x5244    INF    vrt: env: Var <PCID> was setuped in <{1CF27FB1-1091-D240-A514-1878A67CB5E0}>
10:43:31.065    0x5244    INF    vrt: env: Var <ProductType> was setuped in <kvrt>
10:43:31.065    0x5244    INF    vrt: env: Var <ProductVersion> was setuped in <20.0.10.0>
10:43:31.065    0x5244    INF    vrt: env: Var <ProductTypeNumKsn> was setuped in <51>
10:43:31.065    0x5244    INF    vrt: env: Var <Localization> was setuped in <en>
10:43:31.065    0x5244    INF    vrt: env: Var <Bases> was setuped in <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}\Bases>
10:43:31.065    0x5244    INF    vrt: env: Var <BaseFolder> was setuped in <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}\Bases>
10:43:31.065    0x5244    INF    vrt: env: Var <Data> was setuped in <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}>
10:43:31.065    0x5244    INF    vrt: env: Var <DataRoot> was setuped in <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}>
10:43:31.065    0x5244    INF    vrt: env: Var <ProductRoot> was setuped in <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}>
10:43:31.065    0x5244    INF    vrt: env: Var <TraceRoot> was setuped in <C:\KVRT2020_Data\Traces>
10:43:31.065    0x5244    INF    vrt: env: Var <DumpRoot> was setuped in <C:\KVRT2020_Data\Traces>
10:43:31.065    0x5244    INF    vrt: env: Var <KsnConfigPackedFileName> was setuped in <ksn_kvrt20.xms>
10:43:31.065    0x5244    INF    vrt: env: Var <KvrtPersistentDataRoot> was setuped in <C:\KVRT2020_Data>
10:43:31.069    0x5244    INF    vrt: env: Begin expanding environment var <%PCID%>
10:43:31.069    0x5244    INF    vrt: env: Var <%PCID%> -> <{1CF27FB1-1091-D240-A514-1878A67CB5E0}>
10:43:31.069    0x5244    INF    vrt: env: Expand <%PCID%> into <{1CF27FB1-1091-D240-A514-1878A67CB5E0}>
10:43:31.071    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data\Legal notices> is directory
10:43:31.071    0x5244    INF    vrt: fshlp: Path <C:\KVRT2020_Data\Legal notices> is deleted
10:43:31.071    0x5244    INF    vrt: bl: Folder <C:\KVRT2020_Data\Legal notices> is created
10:43:31.073    0x5244    INF    kvrt: bl gui: LegalNotices was dropped
10:43:36.191    0x3304    INF    kvrt: bl gui: qt thread continues
10:43:36.191    0x5244    INF    vrt: bl: EULA was accepted
10:43:36.192    0x5244    INF    kvrt: klmd: Initializing KLMD...
10:43:36.192    0x5244    INF    vrt: env: Begin expanding environment var <%SystemRoot%\System32\Drivers>
10:43:36.192    0x5244    INF    vrt: env: Var <%SystemRoot%> -> <C:\WINDOWS>
10:43:36.192    0x5244    INF    vrt: env: Expand <%SystemRoot%\System32\Drivers> into <C:\WINDOWS\System32\Drivers>
10:43:36.192    0x5244    INF    kvrt: klmd: Getting KLMD driver body from <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}\klmd.sys>...
10:43:36.192    0x5244    INF    vrt: fshlp: File <I:\temp\{da91e92d-0faf-4796-a212-7d2a2d9a1c1a}\klmd.sys> has been read
10:43:36.192    0x5244    INF    kvrt: klmd: KLMD drive body has size 299544 bytes
10:43:36.192    0x5244    INF    vrt: env: Begin expanding environment var <%PCID%>
10:43:36.192    0x5244    INF    vrt: env: Var <%PCID%> -> <{1CF27FB1-1091-D240-A514-1878A67CB5E0}>
10:43:36.192    0x5244    INF    vrt: env: Expand <%PCID%> into <{1CF27FB1-1091-D240-A514-1878A67CB5E0}>
10:43:36.192    0x5244    INF    kvrt: drv: Driver ID for service <klmd> is <0xe34ffe8e>
10:43:36.192    0x5244    INF    kvrt: srv reg: Reg API service manager 0x49cb690 was created
10:43:36.192    0x5244    INF    kvrt: drv: Service file <C:\WINDOWS\System32\Drivers\e34ffe8e.sys> is exist
10:43:36.192    0x5244    INF    kvrt: reg winapi: Registry key <0x80000002, SYSTEM\Select> is opened as <0x404>
10:43:36.192    0x5244    INF    kvrt: reg winapi: Registry value <Current> of key <0x404, SYSTEM\Select> was get (4 bytes)
10:43:36.192    0x5244    INF    kvrt: srv reg: Reg API service 0x49c0d98 was created
10:43:36.192    0x5244    WRN    kvrt: reg winapi: Can't open registry key <0x80000002, SYSTEM\ControlSet001\Services\e34ffe8e> with error 0x80010102 (native error 0x2)
10:43:36.192    0x5244    WRN    kvrt: reg winapi: Can't open key <0x80000002, SYSTEM\ControlSet001\Services\e34ffe8e> with error 0x80010102
10:43:36.192    0x5244    WRN    kvrt: srv reg: Can't get registry key for service <e34ffe8e> with error 0x80010102
10:43:36.192    0x5244    WRN    kvrt: srv reg: Can't open service <e34ffe8e> with error 0x80010102
10:43:36.192    0x5244    INF    kvrt: srv reg: Reg API service 0x49c0d98 was destroyed
10:43:36.192    0x5244    INF    kvrt: drv: Service <e34ffe8e> is absent
10:43:36.192    0x5244    INF    kvrt: srv: Checking status of driver <\SystemRoot\System32\Drivers\e34ffe8e.sys>...
10:43:36.193    0x5244    INF    kvrt: srv: Driver <C:\WINDOWS\System32\Drivers\e34ffe8e.sys> status is <Running>
10:43:36.193    0x5244    INF    kvrt: drv: Driver <e34ffe8e> is loaded
10:43:36.193    0x5244    INF    kvrt: srv reg: Reg API service manager 0x49cb690 was destroyed
10:43:36.193    0x5244    INF    kvrt: drv: Random name for service <klmd> is <e34ffe8e>
10:43:36.193    0x5244    INF    kvrt: drv: Current driver <e34ffe8e> installation status:
10:43:36.193    0x5244    INF    kvrt: drv:    File is installed
10:43:36.193    0x5244    INF    kvrt: drv:    Service isn't installed
10:43:36.193    0x5244    INF    kvrt: drv:    Driver is loaded
10:43:36.193    0x5244    INF    kvrt: drv: Driver object 0x49c08f8 was created
10:43:36.193    0x5244    INF    kvrt: srv reg: Reg API service manager 0x49cb6e0 was created
10:43:36.193    0x5244    INF    kvrt: drv: Installing driver <e34ffe8e>...
10:43:36.193    0x5244    INF    kvrt: drv: Creating new driver service <e34ffe8e>...
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry key <0x80000002, SYSTEM\Select> is opened as <0x404>
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <Current> of key <0x404, SYSTEM\Select> was get (4 bytes)
10:43:36.193    0x5244    INF    kvrt: srv reg: Reg API service 0x49c0e10 was created
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry key <0x80000002, SYSTEM\ControlSet001\Services> is opened as <0x404>
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry key <0x404, e34ffe8e> is created as <0x4bc>
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <ImagePath> of key <0x4bc, e34ffe8e> was set (3c bytes)
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <Type> of key <0x4bc, e34ffe8e> was set (4 bytes)
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <Start> of key <0x4bc, e34ffe8e> was set (4 bytes)
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <ErrorControl> of key <0x4bc, e34ffe8e> was set (4 bytes)
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <Tag> of key <0x4bc, e34ffe8e> was set (4 bytes)
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <Group> of key <0x4bc, e34ffe8e> was set (24 bytes)
10:43:36.193    0x5244    INF    kvrt: srv reg: Activating SafeBoot for service <e34ffe8e>
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry key <0x80000002, System\CurrentControlSet\Control\SafeBoot\Minimal> is opened as <0x4bc>
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry key <0x4bc, e34ffe8e.sys> is created as <0x404>
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <(null)> of key <0x404, e34ffe8e.sys> was set (e bytes)
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry key <0x80000002, System\CurrentControlSet\Control\SafeBoot\Network> is opened as <0x404>
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry key <0x404, e34ffe8e.sys> is created as <0x4bc>
10:43:36.193    0x5244    INF    kvrt: reg winapi: Registry value <(null)> of key <0x4bc, e34ffe8e.sys> was set (e bytes)
10:43:36.193    0x5244    INF    kvrt: srv reg: Service <e34ffe8e> with <System32\Drivers\e34ffe8e.sys> was created by 0x49c0e10
10:43:36.193    0x5244    INF    kvrt: drv: Driver service <e34ffe8e> has been installed successfully
10:43:36.193    0x5244    INF    kvrt: drv: Driver <e34ffe8e> has been installed successfully
10:43:36.193    0x5244    INF    kvrt: klmd: KLMD has been installed and loaded successfully
10:43:36.193    0x5244    INF    kvrt: klmd: Connected to ARK device <\\.\e34ffe8ea>
10:43:36.194    0x5244    ERR    kvrt: klmd: Can't complete thread authorization with error 0x800700a1 (native error 0xa1)
10:43:36.194    0x5244    ERR    kvrt: bl: Can't authorize current thread to KLMD with error 0x800700a1
10:43:36.194    0x5244    ERR    kvrt: bl: KLMD phase 1 init has been failed with error 0x800700a1

]]>29123Thu, 10 Nov 2022 10:44:59 +0000Error 'can't load driver' Windows 11 Pro PE KVRT.EXE 2020 versionhttps://forum.kaspersky.com/topic/error-cant-load-driver-windows-11-pro-pe-kvrtexe-2020-version-28708/ With a USB booting Windows 10 PE build, based on Professional 64 bit version 1809, the 2020 version of KVRT.exe runs.

However with a Windows 11 PE build, based on Professional version 22H2, after ticking the three agreement boxes I get the error message

' can't load driver '.

If the message was specific that e.g. xxx.dll was missing I could add to the Windows 11 PE build.

Any hints to either the missing prerequisite(s) or another issue will be helpful.

 

]]>28708Wed, 19 Oct 2022 10:23:09 +0000Kaspersky Virus Removal Tool Processing Errorhttps://forum.kaspersky.com/topic/kaspersky-virus-removal-tool-processing-error-27509/ I notice that I get a lot of Processing Error on some files that Kaspersky Virus Removal Tool scans. Are these something to worry about?Ek_Acklama_2022-09-04_111526.png.9355cbbac13ca08ffde122043934ecf5.png

]]>27509Sun, 04 Sep 2022 12:40:29 +0000KVRT Free won't create cleanup scripthttps://forum.kaspersky.com/topic/kvrt-free-wont-create-cleanup-script-23751/I’ve used KVRT Free for years. Today, when I tried to run it, I got the message “Cannot create cleanup script.” I’ve downloaded the current version but still get the message. What’s wrong, and how do I fix it?

Thanks.

]]>23751Wed, 23 Mar 2022 11:33:14 +0000Can i get a virus by logging with an acount (putting email and password)?https://forum.kaspersky.com/topic/can-i-get-a-virus-by-logging-with-an-acount-putting-email-and-password-16329/so i clicked on a strange website accidentally and then i cleaned all browser data, formatted the drive and made a scan with KVRT. I also changed my accounts credentials, but can i infect my pc again by just logging in?

Please don't ridicularize me, i'm really anxious

]]>16329Tue, 30 Mar 2021 22:53:09 +0000Read before you create a new topic!https://forum.kaspersky.com/topic/read-before-you-create-a-new-topic-23812/

Hello!

 

If you can't find an answer to your question in the Knowledge Base and through searching the community forums, you can create a new topic with a question.

 

Before you post a new topic in the Kaspersky Support Forum, please read the Forum rules.

 

When creating a topic, be sure to specify:

 

  1. Version of your operating system (How to find the version of your operating system).
  2. Name and version number of the Kaspersky application (How to find the name and the version number of a Kaspersky application).
  3. Explain in details the nature of your problem.
  4. If necessary, attach a screenshot of the problem (How to take a screenshot).

 

This will help to identify the problem more quickly and provide solution for you.

 

Thank you.

]]>23812Wed, 30 Mar 2022 05:05:41 +0000Kavremover trojan avast false detectionhttps://forum.kaspersky.com/topic/kavremover-trojan-avast-false-detection-23026/Hi. I downloaded kavremover from the official Kaspersky website. Avast Free Antivirus said it was a trojan. Is it normal?

]]>23026Thu, 10 Feb 2022 16:06:32 +0000Cloud connection for KVRT shouldn't be forcedhttps://forum.kaspersky.com/topic/cloud-connection-for-kvrt-shouldnt-be-forced-20899/KVRT is meant for infected computers.

Assume that a PC is protected by firewall and is infected with a trojan,

I need to disable the firewall leaving the PC vulnerable in order for your tool to work.

That doesn’t make sense.

Furthermore KVRT creates a weird file in the TEMP directory that tries to connect which i cannot whitelist with the Tinywall that i am using so i have to disable the firewall in order to use your software.

At least make it possible to whitelist KVRT,

]]>20899Thu, 14 Oct 2021 00:17:52 +0000The PCID in KVRT Reports is generated from the information in the systemhttps://forum.kaspersky.com/topic/the-pcid-in-kvrt-reports-is-generated-from-the-information-in-the-system-20339/The PCID in KVRT Reports is generated based on what information in the system ？？

<Report>
    <Metadata Version="1" PCID="{A827D0BA-E7BF-DEAC-70F3-D8D20030442E}" LastModification="2021.09.08 15:10:47.195" />
    <EventBlocks>
        <Block0 Type="Scan" Processed ="8241" Found="1" Neutralized="0">
            <Event0 Action="Scan" Time="132755583713339237" Object="" Info="Started" />
            <Event1 Action="Detect" Time="132755586466811855" Object="D:\eicar.com\eicar.com.txt" Info="EICAR-Test-File" />
            <Event2 Action="Scan" Time="1327555864714​​89380" Object="" Info="Finished" />
            <Event3 Action="Select action" Time="1327555864714​​99316" Object="D:\eicar.com\eicar.com.txt" Info="Skip" />
        </Block0>
    </EventBlocks>
</Report>

 

]]>20339Wed, 15 Sep 2021 07:20:11 +0000Too long memory checkhttps://forum.kaspersky.com/topic/too-long-memory-check-18798/

 

 

16Gb RAM was always checked for a few minutes, situation has changed due to recent Windows update to Windows 10 21H1 x64 to version 10.0.19043.1110 .

At the same time in VirtualBox guest Windows 10/11 there is no such problem.

FYI.

]]>18798Tue, 27 Jul 2021 19:46:02 +0000