KIS caused Windows system registry to become 2.8 GB in size! HELP!

[nwq]

Hi,

I'm using a KIS 21.3.10.391 on a Windows 7 64 SP2 system.

Recently I had ~40 second freezes every time I boot to windows. I investigated the issue and detected that registry file has become too large. (~2.7 GB file size when I export it with REGEDIT.EXE)

After inspecting the registry, I saw that the bloated size is caused by this entry;

Kaspersky Lab Filter Core
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt

This reg entry is 858 MB in size. It has 2 copies in ControlSet001 and 002 (which explains the 2.7 GB backup file.)

Why this large data is stored in Windows Registry file?
What happens if I delete it?

Is there a solution for this?

Any help will be appreciated.

[Flood and Flood's wife]

Hello @nwq

Welcome back!

Please log a request with Kaspersky Customer Service: https://support.kaspersky.com/b2c#contacts; on the support page, select either Chat or Email, then fill in Application malfunction, Other template; please include any screen images of the error & a detailed history. Support may request logs, traces & other data; they will guide you. 

Please share the outcome with the Community, when it's available? 
Thank you?
Flood?+?

[nwq]

I wanted to get support with chat but Support is not responding.

Edited April 22, 2023 by nwq

[Flood and Flood's wife]

22 minutes ago, nwq said:

I wanted to get support with chat but Support is not responding.

Hello @nwq, 

After entering (your) email address, did (you) wait for a Kaspersky Customer Service agent to reply before proceeding with the chat?

Edited April 22, 2023 by Flood and Flood's wife
spelling

[nwq]

I took the risk and deleted the registry branch (after creating a backup)

I disabled the self-defence in KIS and deleted the reg entries in 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\klflt\Parameters\CollectionData

(ControlSet001 did not have the `CollectionData` entry so I did nothing in that branch)

I booted the PC and the problem is fixed. No delay at logon.

After deleting the `CollectionData` I checked it again and it was populated with 44 entries (~1 MB in size)

It appears KIS will keep writing to this reg until it's bloated again.

I'd like to skip the K support and ask to experts on this forum;

What kind of data is collected in this reg entry and why is it written in Windows Registry file?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData

[Flood and Flood's wife]

1 minute ago, nwq said:

I'd like to skip the K support and ask to experts on this forum;

Hello @nwq, 

Please log the request with Kaspersky Customer Service - the issue will get escalated to the experts & you will be answered by them.  

When you've successfully logged the request, please post back the Incident request number, it will be prefixed with: INC000. 

Thank you?
Flood?+?

[nwq]

8 minutes ago, Flood and Flood's wife said:

Hello @nwq, 

Please log the request with Kaspersky Customer Service - the issue will get escalated to the experts & you will be answered by them.  

When you've successfully logged the request, please post back the Incident request number, it will be prefixed with: INC000. 

Thank you?
Flood?+?

Thanks, I received an email `ticket` from K Support and i replied to them with the following;

-----------------------------------------------

Hello, there is an update in my help request; 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData

This windows reg key growed into 850 MB in years and caused hangs during Windows logon. I deleted it and the issue is fixed for now.

After deleting that `CollectionData` branch, I checked it again and it was populated with 44 entries again.(~1 MB in size) 

What kind of data is collected in this reg entry and why is it written in Windows Registry file? Is there an option to prevent KIS from bloating this reg entry?

Thanks. Regards,

------------------------------------------

Thanks for your help.

[nwq]

UPDATE:

K Support says their solution for the `huge registry branch problem` is dumping KIS and installing ”K  MR9". The link they provided says it's a beta version. I'm tired with debugging problems so I won't be installing it.

In my conversation (emails) with Kaspersky support, I have asked what kind of data is collected in this reg branch that bloats in time and becomes a hog for system;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData

I've asked this for 3 times and K support just ignored my question.

I post this here so maybe someone who has an answer reads it.

1) What kind of data is collected in `CollecionData` reg branch?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionData

2) Why does KIS creates this HUGE data dump in Windows Registry instead of a separate file on disk?

 

 

 

 

Edited April 29, 2023 by nwq

[Flood and Flood's wife]

1 hour ago, nwq said:

1. UPDATE: K Support says their solution for the `huge registry branch problem` is dumping KIS and installing ”K  MR9". The link they provided says it's a beta version.
2. In my conversation (emails) with Kaspersky support, I have asked what kind of data is collected in this reg branch that bloats in time and becomes a hog for system. I've asked this for 3 times and K support just ignored my question.

Hello @nwq, 

Thank you for posting back & the update!

1. MR9 has been commercially released, may we know which REGION (you're) physically located in & see Kaspersky: Basic, Standard, Plus, Premium - info & FAQ by Danila T.  & Kaspersky for Windows release notes. 
2. Please post the Incident reference number, it begins with INC0000? 

Thank you?
Flood?+?

Edited April 29, 2023 by Flood and Flood's wife
added links

[nwq]

6 hours ago, Flood and Flood's wife said:

 

1. MR9 has been commercially released, may we know which REGION (you're) physically located in & see Kaspersky: Basic, Standard, Plus, Premium - info & FAQ by Danila T.  & Kaspersky for Windows release notes. 
2. Please post the Incident reference number, it begins with INC0000? 

 

1) I travel so I'm "regionless".

2)  ID INC000015246132

[Flood and Flood's wife]

59 minutes ago, nwq said:

1) I travel so I'm "regionless".

Hello @nwq, 

Thank you for the information!

IF the support team have provided a beta link to MR9, it may be because MR9 is not available in (your) region, the fact *you* travel may be relevant to you but it's irrelevant to Kaspersky's for the purpose of registering (your) software; what is of relevance is - the software must be activated in the region it's purchased; so may we know which REGION you were physically located in when you originally purchased & activated the Kaspersky Internet Security license please? 

Thank you?
Flood?+?

Edited April 29, 2023 by Flood and Flood's wife
spelling

[travelator]

On 4/29/2023 at 7:05 PM, Flood and Flood's wife said:

Hello @nwq, 

Thank you for the information!

IF the support team have provided a beta link to MR9, it may be because MR9 is not available in (your) region, the fact *you* travel may be relevant to you but it's irrelevant to Kaspersky's for the purpose of registering (your) software; what is of relevance is - the software must be activated in the region it's purchased; so may we know which REGION you were physically located in when you originally purchased & activated the Kaspersky Internet Security license please? 

Thank you?
Flood?+?

All this beating around the bush, asking for additional information, and the OP's question was never answered, neither here nor by support, apparently.

I'm sure the country of purchase has all the relevance in the world as to why KS is bloating the registry... 😂

Way to go....🤦‍♂️

Very confidence-inspiring...