nwq

1) I travel so I'm "regionless". 2) ID INC000015246132

UPDATE: K Support says their solution for the `huge registry branch problem` is dumping KIS and installing ”K MR9". The link they provided says it's a beta version. I'm tired with debugging problems so I won't be installing it. In my conversation (emails) with Kaspersky support, I have asked what kind of data is collected in this reg branch that bloats in time and becomes a hog for system; HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData I've asked this for 3 times and K support just ignored my question. I post this here so maybe someone who has an answer reads it. 1) What kind of data is collected in `CollecionData` reg branch? HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData 2) Why does KIS creates this HUGE data dump in Windows Registry instead of a separate file on disk?

Thanks, I received an email `ticket` from K Support and i replied to them with the following; ----------------------------------------------- Hello, there is an update in my help request; HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData This windows reg key growed into 850 MB in years and caused hangs during Windows logon. I deleted it and the issue is fixed for now. After deleting that `CollectionData` branch, I checked it again and it was populated with 44 entries again.(~1 MB in size) What kind of data is collected in this reg entry and why is it written in Windows Registry file? Is there an option to prevent KIS from bloating this reg entry? Thanks. Regards, ------------------------------------------ Thanks for your help.

I took the risk and deleted the registry branch (after creating a backup) I disabled the self-defence in KIS and deleted the reg entries in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\klflt\Parameters\CollectionData (ControlSet001 did not have the `CollectionData` entry so I did nothing in that branch) I booted the PC and the problem is fixed. No delay at logon. After deleting the `CollectionData` I checked it again and it was populated with 44 entries (~1 MB in size) It appears KIS will keep writing to this reg until it's bloated again. I'd like to skip the K support and ask to experts on this forum; What kind of data is collected in this reg entry and why is it written in Windows Registry file? HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData

I wanted to get support with chat but Support is not responding.

Hi, I'm using a KIS 21.3.10.391 on a Windows 7 64 SP2 system. Recently I had ~40 second freezes every time I boot to windows. I investigated the issue and detected that registry file has become too large. (~2.7 GB file size when I export it with REGEDIT.EXE) After inspecting the registry, I saw that the bloated size is caused by this entry; Kaspersky Lab Filter Core HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt This reg entry is 858 MB in size. It has 2 copies in ControlSet001 and 002 (which explains the 2.7 GB backup file.) Why this large data is stored in Windows Registry file? What happens if I delete it? Is there a solution for this? Any help will be appreciated.

I'm using KIS 21.3.10.391 (j) on Win 7 SP2. I see warnings in Event Viewer with Event ID 1530 after every Winlogon event. ----------------------------- Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 5 user registry handles leaked from \Registry\User\S-1-5-21-3626183451-712689859-1435294722-1001: Process 1832 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001 Process 1832 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Policies\Microsoft\SystemCertificates Process 1832 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\SmartCardRoot Process 1832 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\ROOT Process 1832 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\trust --------------------------- Log from another day --------------------------- Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 12 user registry handles leaked from \Registry\User\S-1-5-21-3626183451-712689859-1435294722-1001: Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001 Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001 Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001 Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\My Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\CA Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Policies\Microsoft\SystemCertificates Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Policies\Microsoft\SystemCertificates Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Policies\Microsoft\SystemCertificates Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\SmartCardRoot Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\ROOT Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\Disallowed Process 1836 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.3\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-3626183451-712689859-1435294722-1001\Software\Microsoft\SystemCertificates\trust ------------------------ This repeats after every login. Why do I get this warning and what should I do to fix it?

I managed to disable WD using services.msc panel and I rebooted but it still pauses for 37-40 seconds after desktop appears. I think I'll need Tech Support. Thanks Berny

Oh I have checked Windows Defender and it was active. ?! I thought KIS have turned it off when I installed it years ago. Is that a problem? KIS never warned me about any conflicts. ( BTW I can't change/disable Windows Defender. I get a "No such interface supported" error. )

Thanks for the reply. No, I have KIS only. Why did you assume I have 2 SS running?

I've been experiencing this problem on Win7 x64 SP1 for a few weeks and I just discovered that it's caused by KIS 21.3.10.391 Every time I reboot, 5-10 secs after desktop appears, Windows becomes dead for 40 seconds. It does not respond to any keyboard or mouse commands. I can still move the mouse around and see taskbar respond to mouse position but none of the apps work. During that ~40 seconds of sleep, it takes all the commands in buffer though. For ex; I run Windows File Explorer during the first 5-10 seconds of startup while it's still responsive. Then it goes dead... I try to drag-move the File Explorer window and it does nothing... After 40 secs passes, it moves the window. (this is not due to slow HDD or swap file etc...it's running on SSDs, and it used to be very fast and responsive a few weeks ago). This buffering also works for keyboard entries too.. Somehow KIS pauses the system for 40 secs on every boot after desktop appears. It does not happen when i PAUSE the protection. Any ideas to fix this?