Kaspersky Home
Products
Support
- Contact
- Policy
- Forums
- FAQs
Downloads
Resellers
Buy / Renew
Latest Security/Hacking News
 



ICE Systems is constantly updated a the list of questions and answers to common issues posted on this page. Please check back on this page frequently, and be sure to review the FAQs on the Kaspersky Labs site.

Frequently Asked Questions - Kaspersky Antivirus

ICE Systems

Updated: 05/2006

Contact ICE Systems Technical Support - email: antivirus@useice.com  phone: 877.332.3250

Q: My license key won't install. What can I do?

Q: Since installing KAV when I start my computer I cannot access any programs or get on the Internet for a minute, sometimes longer. Why does it run so slowly like this?

Q: My Updater fails when I start an update. What do I do?

Q: I use Hotmail for my email. Is it protected by KAV?

Q: In the On-Demand Scan settings I am trying to exclude all of the files and folders in my C:\WINDOWS folder but when I run the scan they are still getting scanned. I am using a mask C:\WINDOWS\*.* Why are files and folders in that directory still being scanned?

Q: KAV has detected a backdoor threat. My settings are such that any infected or suspicious file is to be deleted upon detection, however this infected file is not deleted. When I try to delete it from the KAV interface I get a message that the operation can not be performed. How can I get rid of this infected file?

Q: After installing Kaspersky Workstation or office's main application no longer runs correctly. Users are reporting strange VBA errors when they try to save files in our MS Access database or their MS Excel spreadsheets. What is the problem?

Q: I have installed the KAV File Server 5.0 and I cannot configure anything, where is the Control Center?

Q: After we installed Kaspersky File Server whenever anyone tries to access one of our .jsp's from our IIS server we get JScript and Wscript errors. What can we do?

Q: I am downloading the KAV Admin Kit 5.0 from your site. What is the MSDE component and do I need it?

Q: How can I exclude trusted riskware via the Admin Kit?

Q: I am using the KAV Admin Kit 5.0 and my policies are not taking effect. What should I do?

Q: I have installed the KAV Admin Kit v5.0. When I first try to connect I get a message about an "invalid certification", did I install something wrong?

Q: With the Admin Kit 5.0 whenever I try to make a connection to the server it fails.

Q: I have installed and configured the Kaspersky Admin Kit. When I open the Admin Console and look at the computers in the group I created, they are all dark red and under the Status column are "Critical". What does this mean?

Q: Can the Admin Kit be used to uninstall a Kaspersky application?

Q: I am trying to install the Admin Kit on one of our servers. I only want to install the Administration Server component of the Admin Kit on the server and the Administration Console on my workstation. The installer will not let me un-select the Administration Console component. Why?

Q: I am installing the Admin Kit on my Domain controller. At the end of the installation I get and error: "Error 1923.Service Kaspersky Administration Kit Server could not be installed. Verify that you have sufficient privileges to install system services." What is causing this?

Q: I needed to reinstall the Admin Kit and MSDE component. Everything went fine so I created my logical network again. All of my client pc’s still have the Network Agent installed but when I look at the Properties for any of these computers I get a message “Can not obtain list of installed applications.” What is the problem?

Q: After I used the Admin Kit ot deploy successfully the Network Agent to all of my computers, I noticed that their icons are still light pink. Why

Q: How do I get tracing files of Kaspersky Anti-Virus 6.0\ Kaspersky Internet Security?

Q: We've experienced an error on Win2k Server running IIS that originally occurred 2 years ago.  I just installed KAV FileServer 5.0.72?

Q: During install of Admin Kit the following two errors are appearing. Why?

Kaspersky  Administration Kit Error
Error 1935.An error occurred during the installation of assembly ‘Microsoft.MSXML2,publicKeyToken=”6bd6b9af345378f”, version=”4.20.9818.0”type=”win32”,processorArchitecure”x86”. Please refer to Help and Support for more information. HRESULT: 0x80070002

Feature transfer error
Error: -1603  Fatal Error During installation.
Consult Windows Installer Help (Msi.chm) or MSDN for more information

____________________________________________________________________

Q: My license key won't install. What can I do?

A: Check to make sure the date and time are correct on your pc. If they are not correct modify them to the correct settings and try to install the license key again. If the error still persists restart your pc and see if the date/time are still correct. If the date/time are incorrect again then the system date (the computer's date used for internal synchronization) is bad. Experienced Windows users should uninstall Kaspersky, shut down their computers, and upon restart set the system date correctly. New Windows users should uninstall Kaspersky and contact ICE Systems Technical Support.

If you have just purchased the Kaspersky product, it may take up to one day before a license key file is accepted for installation. If your key reports as "damaged", "invalid" or "not compatible", wait at least 12 hours and try again.

If you are installing multiple products make sure that you are using the correct key for the associated product and that you are not exceeding your license entitlement.

For ICE Systems customers upgrading to KAV or KIS 6.0 from KAV 5.0 your license key should be detected during the installation process. Please read our KAV 6.0 upgrade document - CLICK HERE.

If you are not upgrading but installing KAV or KIS 6.0 for the first time, you will receive your license key from ICE Systems via email attachment. Save the key file to your computer preferrably in the ‘My Documents’ folder. During the installation process you will see a window with a request to enter product activation information. There will be four options to choose from; select the option ‘Apply existing license key’. After clicking the Next button you will be asked to specify the location of the key file. Click the Browse butto and navigate to the My Documents folder where you saved the key. When you locate the key double-click it. The key will be loaded into the program and the license data will be displayed. Click Next and your key will be loaded.

If running KAV Personal Pro, KAV Workstation, or KAV File Server check the folder C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\Kaspersky <product>\5.0\Bases and be sure there is a file named 'black.lst'. If possible, run the Updater program to get new copies of the av database definitions and try to add your key again.

If there is no key installed, when you click the red or grey "K" in the system tray the Add Key popup window will appear. If there is a trial key installed delete it. Try again to add your new key.

If all attempts fail do the following:

1. Start 'regedit' (Click the Windows Start button, select Run, type in regedit and click OK)
2. Search for 'LK.AUTO' (Type the Ctrl and f keys at the same time, type in LK.AUTO and then click Find or Find Next). Make sure Keys, Values, and Data are selected. 'Match whole string only' does NOT have to be selected.
3. If LK.AUTO or LK.Auto is found, delete it (hit the delete key and respond Yes when asked if you want to delete the key). Continue to search and delete until LK.AUTO is no longer found.

If after performing these steps your key will still not install, uninstall the product via Control Panel-Add Remove Programs. When the uninstall is complete restart your computer. When your machine is back up click here to run the Kaspersky registry cleaner utility. Please read the ReadMe.txt file before running the program. After the registry cleaner finishes reinstall the product and try to add your key again. If it still fails contact ICE Systems Technical Support.

Q: Since installing KAV 5.0 when I start my computer I cannot access any programs or get on the Internet for a minute, sometimes longer. Why does it run so slowly like this?

A: Whenever your computer is restarted Kaspersky performs a startup scan of all objects and files associated with applications configured to launch when your pc is turned on. This scan can be safely disabled in some cases. Read our PERFORMANCE TUNING guide for information regarding the startup scan.

Q: My Updater fails when I start an update. What do I do?

A: Are you connected to the Internet? Be sure you are. Also make sure that your firewall software is not blocking Kaspersky. You can turn off your firewall software while you try the update. If still no luck, try resetting your connection to the internet (if using dial-up modem, disconnect and re-dial, if using a broadband cable modem or router disconnect the modem/router and reconnect). Also check to be sure the following folder exists: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\KAV for <product>\5.0\Bases. If this folder is missing, reinstall KAV. If your Internet access is supplied via a proxy server make sure you configure the Updater settings to use the appropriate proxy settings. You can do this from the Settings tab - Configure Updater - LAN Settings option in the program interface. A valid license key is also required in order to download the AV updates.

Q: I use Hotmail for my email. Is it protected by KAV?

A: KAV will detect and block any malicious scripts or embedded HTML that
is found in web-based email systems, like Hotmail or Yahoo mail. Because web mail is retrieved as a web page in a browser, however, Kaspersky AV cannot always catch a virus attachment before it reaches the INBOX of your web mail facility. Any attempt to download or open the infected object would be detected and prevented by Kaspersky AV, so there is still no way for the virus to be activated.


Q: In the On-Demand Scan settings I am trying to exclude all of the files and folders in my C:\WINDOWS folder but when I run the scan they are still getting scanned. I am using a mask C:\WINDOWS\*.* Why are files and folders in that directory still being scanned?

A: If you want to exclude all files and folders in your C:\WINDOWS folder you need to use the mask: C:\WINDOWS\ If you use the *.* syntax you are telling the scanner to only exclude all FILES in the specified folder, and folder under the WINDOWS folder would still be scanned.

Q: KAV has detected a backdoor threat. My settings are such that any infected or suspicious file is to be deleted upon detection, however this infected file is not deleted. When I try to delete it from the KAV interface I get a message that the operation can not be performed. How can I get rid of this infected file?

A: In this case the best way to get rid of this file is to reboot your computer into 'Safe Mode' and then manually delete the file. To boot into 'Safe Mode' restart your computer and as soon as it begins to power up repeatedly hit the 'F8' key on your keyboard. You will eventually see a boot menu where you can use your arrow keys to navigate to the 'Safe Mode' choice. If you see the option 'Safe Mode without network resources' choose this, otherwise choose 'Safe Mode'. The startup process will take a bit longer than a regular restart and when Windows starts in 'Safe Mode' your Desktop's appearance may be different than you are used to seeing. Once the computer is available and in 'Safe Mode' navigate to the infected file, select it (DO NOT OPEN IT) and hit your 'delete' key on the keyboard, empty your Recycle Bin. Restart Windows, (it will restart it normal mode w/o user intervention) and manually scan the folder where the previously infected file was located. If the infected file does not appear in the location determined by KAV call ICE Systems Technical Support immediately.

The best way to apply the saved settings is to copy the folders over the existing folders as soon as a new installation completes and before the computer is restarted. You will need to restart the computer in order for the saved settings to take effect.

Q: After installing Kaspersky Workstation or office's main application no longer runs correctly. Users are reporting strange VBA errors when they try to save files in our MS Access database or their MS Excel spreadsheets. What is the problem?

A: The problem is likely being caused by the default settings for the Real-Time Macro protection module. By default these settings disallow macro execution, something Excel and Access programs use frequently. To allow your application to run smoothly, while still staying protected, we suggest that you disable Macro protection by unchecking the box "Enable real-time VBA macro monitoring" in the Real-Time protection settings, under the Macro tab. You need to restart your computer after making this change. You are not losing any protection by making this change; any malicious macro that could possibly attempt execution would be caught and deleted by default Real-Time File Protection settings. The VBA macro monitoring tool is intended for VBA savvy administrators who wish to allow some MS Office related macros while disabling others. By unsetting the feature you avoid the tedious process of figuring out which macros to allow and which to avoid.

Q: I have installed the KAV File Server 5.0 and I cannot configure anything, where is the Control Center?

A: Beginning with version 5.0 the KAV File Server has no native GUI. Instead, install the KAV Admin Kit along with the MSDE component (if there is no MS SQL Server installed) and use it for administration. You can read more about the Admin Kit here. You can download the Admin Kit here.

Q: I am downloading the KAV Admin Kit 5.0 from your site. What is the MSDE component and do I need it?

A: The MSDE component is the Microsoft Desktop Engine; basically a runtime version of SQL Server. You need this if the host running the Admin Kit does not already have Microsoft SQL Server installed. . Only the MSDE component available from Kaspersky can be used. "

Q: How can I exclude trusted riskware via the Admin Kit?

Kaspersky AV will at times detect remote access programs such as WinVNC or RPCNET as threats due to the nature of the program. The detection of the these programs as threats can cause a serious performance hit on the machines where the programs are ran.  If you receive email notifying you that one of these programs has been detected as a threat you can go ahead and take the below action to avoid these detections. If you do not have email notifications configured you will likely be made aware of the detections by users of the affected machine complaining of performance problems. If this occurs check the virus count for the affected workstation. If you notice the count is unusually high run the preconfigured Virus Activity Report located under the Reports icon in the Admin Kit. If you see something like the following in your report then you also can take the below steps to remedy the problem:

Object C:\WINDOWS\SYSTEM32\RPCNETP.EXE is infected with the virus  not-a-virus:Dialer.Win32.Rpcnet.b

To exclude threats like this:

- Open your group policy and select the ‘Threats and Exclusions’ tab.
- Click the ‘Add’ button in the ‘General list of exclusions’ section.
- In the ‘Object:’ box cut and paste:

      C:\WINDOWS\SYSTEM32\RPCNETP.EXE
     
- In the ‘Threat:’ section cut and paste:

     virus not-a-virus:Dialer.Win32.Rpcnet.b

- Be sure you cut and paste the exact Object and Threat as seen in your report or email notification. Once the exclusion has been added click the ‘Apply’ button.
- Open  the Enforcement tab, select the last option in the bottom section and click the ‘Modify’ button.

Q: I am using the KAV Admin Kit 5.0 and my policies are not taking effect. What should I do?

A: Make sure that after creating your policy settings each setting that you want to take effect is locked. There is a small lock icon next to each policy setting. Also, policies are applied from the bottom up; a policy created for a specific group will override a global policy. Some policies require the effected clients to be restarted, (Hide program icon is an example).

Q: I have installed the KAV Admin Kit v5.0. When I first try to connect I get a message about an "invalid certification", did I install something wrong?

A: This message is a bit misleading. When the Admin Kit is started for the first time the Admin Console requests an authentication certificate from the Admin Server. There will be a message displayed prior to the initial connection stating that the certificate is invalid, with choices to download the certificate from the Admin Server or to specify the location of the certificate. The first choice, downloading the certificate from the server is appropriate for this operation. The certificate is stored in the product files folder under the sub-folder Cert.

Q: With the Admin Kit 5.0 whenever I try to make a connection to the server it fails.

A: If you are running Windows XP SP2 the default ports that the Admin Server uses might be blocked by the integrated Windows firewall. The default port used by the Admin Server is 13000 SSL, 14000 non-SSL is also available. Make sure these ports, as well as port 15000 UDP (which the NetAgent uses) are available. If you need to change the port that the Admin Server uses you can do so by accessing the localhosts properties in the Admin Console. You have to restart your machine for the change to take effect. To change the port for the NetAgent create a policy for the NetAgent. In the policy options you will be able to change the port number. Also if you are connecting to the Admin Server locally be sure that you specify either the ip address of your local host or enter the word "localhost" as the server name. Do not enter 127.0.0.1 or the computer name.

Q: I have installed and configured the Kaspersky Admin Kit. When I open the Admin Console and look at the computers in the group I created, they are all dark red and under the Status column are "Critical". What does this mean?

A: Likely the "Critical" status you are seeing is because the computer(s) have not been scanned (On-Demand full scan) or have not had their AV database definitions updated. You can see all of the conditions associated with the colors of the computers in your logical network by right clicking on the server icon (usually called 'localhost' or the ip address of the machine running the Admin Kit) and choosing 'Properties'. The 'Computer status' tab will display the default settings and allow you to modify these as desired.

Q: Can the Admin Kit be used to uninstall a Kaspersky application?

A: Yes. Any Kaspersky application that was deployed and installed via the Admin Kit and an associated .kpd file can be uninstalled. This excludes the Network Agent package. To uninstall KAV Workstation 5.0 or KAV File Server 5.0 from the Admin Kit follow these steps:

1. Locate the installation packages under the 'Remote Install' icon in the Admin Console.

2. Right click on the package associated with the program you want to uninstall and choose 'Properties'.

3. In the 'Properties' window click the 'Installer Settings' tab and then check the box marked 'Remove application'.

4. Close the 'Properties' window, right click again on the package and choose 'Install'.

5. Create a new task just like the one you created to install the package. When the task is created open the task and click the 'Settings' tab.

6. In the 'Settings' window click the 'Advanced' button in the bottom right corner. In the 'Advanced' window uncheck the first box marked "Do not install on hosts on which this product is already installed". Apply and save your changes, then run the task to uninstall.

Q: I am trying to install the Admin Kit on one of our servers. I only want to install the Administration Server component of the Admin Kit on the server and the Administration Console on my workstation. The installer will not let me un-select the Administration Console component. Why?

A: Your configuration idea is fine. However anytime you install the Administration Server component of the Admin Kit the Administration Console is automatically installed along with it. You can choose to only install the Administration Console if you wish, without the Administration Server. But you cannot install the Administration Server without the Administration Console.

Q: I am installing the Admin Kit on my Domain controller. At the end of the installation I get and error: "Error 1923.Service Kaspersky Administration Kit Server could not be installed. Verify that you have sufficient privileges to install system services." What is causing this?

A: During the install when you are prompted to select a specific account to start the Admin Server service do not type in the user name you want to use, instead use the Browse button to locate the correct DOMAIN\USER to start the Admin Server service. For full functionality you should select a DOMAIN\USER that has domain administrator rights.

Q: I needed to reinstall the Admin Kit and MSDE component. Everything went fine so I created my logical network again. All of my client pc’s still have the Network Agent installed but when I look at the Properties for any of these computers I get a message “Can not obtain list of installed applications.” What is the problem?

A: When the Network Agent is installed and synched up with the Admin Server it stores a unique id associated with the specific Admin Server installation. When the Admin Server is reinstalled its unique id changes thus the Network Agent can no longer communicate with the Admin Server. Here is what you need to do:

1. Remove affected computers from your user created group(s).
2. Remove the affected computers from the Unassigned folder.
3. Restart the Admin Server service or restart the pc.
4. Upon restart check the Unassigned folder to see if the affected computers have been added back. This may take a few minutes depending on the size of your network.
5. When the affected computers are back in the Unassigned folder reassign them to their appropriate group you created.
6. Create a new task to deploy the Network Agent to the affected computers.
7. When the task is finished open the task properties and select the Settings tab.
8. In the Settings tab click the Advanced button.
9. In the Advanced settings window uncheck the box “Do not install on hosts where the product is already installed”. Click Apply and OK. Run the task.

Q: After I used the Admin Kit ot deploy successfully the Network Agent to all of my computers, I noticed that their icons are still light pink. Why?

A: If you right click in the window where your computer’s icons are displayed, and choose Refresh you should see the icons turn dark red or green.

Q: What do the different colors of the computer’s icons represent? Half of mine are green, some are dark red, and others are pink.

A: You can find out the conditions that cause these color changes by right clicking on the localhost icon (or the ip addr if used) and selecting Properties. Among the tabs in the Properties window is the tab ‘Computer Status’. Click this tab and you will see all of the various conditions and the events associated with each. In general the colors are defined as:

Green: KAV is “healthy”. Database updates have been applied and a full scan has ran.
Red:    KAV is running but there have been either no database updates or no scans ran.
Pink:    KAV is not running or the Network Agent is not installed.

Q: How do I get tracing files of Kaspersky Anti-Virus 6.0\ Kaspersky Internet Security?


A: After installing Kaspersky Anti-Virus 6.0\Kaspersky Internet Security 6.0 there may occur situations when the operating system “bluescreens” or Kaspersky Anti-Virus freezes, for example by computer boot or by task start. It might be a conflict either between Kaspersky Anti-Virus 6.0\Kaspersky Internet Security 6.0 and some software installed on your PC or with the componentry drivers of your PC. If a fall occurs during a task performance then it is necessary to get tracing files of the Kaspersky Anti-Virus 6.0\Kaspersky Internet Security 6.0 components.

1. Download the KavLog.exe utility from our server 

2. Run the utility on the computer where you have the problem 

3. Select the necessary Level

Note! When contacting technical support the expert should know the necessary tracing level. If it was not specified then it is recommended to set Level Notify (500) 

4. Enable tracing by clicking Turn trace on button 

5. Reproduce the problem once again 

6. Click Send to KL(via ftp) button, to send the received tracing files 

7. Enter the SRF number (which was given to your inquiry in the HelpDesk Form) and click OK
Note! After the tracing files have been sent the utility service should be stopped by clicking Turn trace off otherwise the utility will go on recording files until the hard drive is full!

If you are receiving tracing for the first time and have not contacted technical support yet, then the tracing files can be found in the folder, which is located on higher hierarchy level than the folder with program files. Example: you have installed Kaspersky Internet Security 6.0 to the folder C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0. In this case tracing files will be created in the folder C:\Program Files\Kaspersky Lab. Files are created in the text format with the unique name [product name]_[creation date]_[creation time - GMT].

Q: We've experienced an error on Win2k Server running IIS that originally occurred 2 years ago.  I just installed KAV FileServer 5.0.72?


Active Server Pages error '8002802b'

Create object failed

?

An error occurred while creating object 'WScript'.

Active Server Pages error '8002802b'

Create object failed

?

An error occurred while creating object 'JSProxy'

Answer
1. Disable real-time script protection
2. *Unregister "scr_ch_pg.dll" file (type "regsvr32 scr_ch_pg.dll /U" in command shell)
3. Replace existing "scr_ch_pg.dll" file  (located at  \\Admin\Prod-Tools-Key\)
4. *Register the new file (type "regsvr32 scr_ch_pg.dll" in command shell)
5. Restart Web services
6. Enable real-time script protection

Make sure that at step 2 you run the "regsvr32" command from the
C:\Program Files\Kaspersky Lab\Kaspersky Workstation directory. Same
for step 4.

*If these steps do not work you have to disable the script checker module. This is a version 5 bug reportedly fixed in v6 but not backported*

Q: During install of Admin Kit the following two errors are appearing. Why?

Kaspersky  Administration Kit Error
Error 1935.An error occurred during the installation of assembly ‘Microsoft.MSXML2,publicKeyToken=”6bd6b9af345378f”, version=”4.20.9818.0”type=”win32”,processorArchitecure”x86”. Please refer to Help and Support for more information. HRESULT: 0x80070002

Feature transfer error
Error: -1603  Fatal Error During installation.
Consult Windows Installer Help (Msi.chm) or MSDN for more information

A: Disable any anti-spyware applications before installation of the Admin Kit.

Go to Kaspersky FAQs