 Error Messages; Klif Driver And Kav: Are They Only For Kaspersky |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.  |
 Jul 14 2006, 08:50 AM
Post
#1
|
|
 OBleepin Investigator  Group: Moderator Posts: 17,441 Joined: 14-July 06 From: Bloomington, IN Member No.: 76,150  |
Dimension 2400 Dell I get an error message as follows: Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7026 Date: 7/14/2006 Time: 7:43:36 AM User: N/A Computer: Description: The following boot-start or system-start driver(s) failed to load: Klif ------- I get another error message: Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7000 Date: 7/14/2006 Time: 7:43:36 AM User: N/A Computer: Description: The KAV Monitor Service service failed to start due to the following error: The system cannot find the path specified. --------------- I looked through the internet, and found the information pasted in below from this site. My question: is the klif driver ONLY for that anti-virus program? If so, I can get rid of it. I have uninstalled and deleted some anti-spyware and anti-virus programs, but I know that bits are still left of at least one of these. I'm wondering if these files are it. -------------------------- Additional info.: I have searched in several ways for both KAV and Klif. Using the SC find service method in the command module, I was informed that KAV Monitor Service was not an installed service, no surprise. Now I'm wondering if there is something in the registry. I've used Registry Cleaner Optimizer but it does not find anything out of wack. Orange Blossom ------------------------------- Name: klif Filename: klif.sys Command: C:\WINDOWS\system32\drivers\klif.sys Description: Driver used by the Kaspersky Anti-Virus. File Location: C:\WINDOWS\system32\drivers\klif.sys Startup Type: This startup entry is installed as a Windows NT, 2000, 2003, or XP service. Service Name: klif Service Display Name: klif HijackThis Category: O23 Entry This post has been edited by Orange Blossom: Jul 14 2006, 09:31 AM -------------------- Orange Blossom An ounce of prevention is worth a pound of cure ESET NOD32, SuperAntiSpyware Pro, SpywareBlaster, Spybot 1.6.2.46, WinPatrol Plus, Sunbelt Personal Firewall - Full, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript |
 |
 
|
|
Jul 14 2006, 09:48 AM
Post
#2
|
|
 Forum Regular Group: Members Posts: 267 Joined: 18-June 06 Member No.: 72,563 |
have u uninstalled kaspersky completely??? it sounds like its running a boot service...and something went wrong so its messing up your booting..
did u even have kaspersky? ok well i'm officially confused cuz its saying its a service...but was it an add on service... ok well i think wat i posted above is right  if its not sorry
This post has been edited by moomoo: Jul 14 2006, 09:50 AM |
|
|
|
 Jul 14 2006, 02:49 PM
Post
#3
|
|
|
OBleepin Investigator Group: Moderator Posts: 17,441 Joined: 14-July 06 From: Bloomington, IN Member No.: 76,150 |
Yes, I did have Kaspersky for a while: just a few days. I was trying out different programs last year. I turned off the program and uninstalled through Add - Remove programs. I knew at the time that this process at times resulted in an incomplete uninstall, so I searched for all the files and folders associated with the program using Search and deleted and erased them completely beyond DoD standards.
I did the same thing for Counterspy, put out by SunBelt. This is the program that has been starting up a bit then quitting. Oddly, I do not get error messages related to this program. Earlier today I discovered a folder of registration keys under SunBelt. I have also just now found a folder of registration keys under Kaspersky. So how does one completely uninstall a program so this kind of thing does not happen? Is it safe to remove the Kaspersky registration keys? Orange Blossom Correction: It was CyberScrub AntiVirus which used the Kaspersky drives etc. It has been over a year since I uninstalled and deleted the program. This post has been edited by Orange Blossom: Jul 14 2006, 06:28 PM -------------------- Orange Blossom An ounce of prevention is worth a pound of cure ESET NOD32, SuperAntiSpyware Pro, SpywareBlaster, Spybot 1.6.2.46, WinPatrol Plus, Sunbelt Personal Firewall - Full, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript |
|
|
|
|
Jul 14 2006, 07:18 PM
Post
#4
|
|
|
Forum Regular Group: Members Posts: 267 Joined: 18-June 06 Member No.: 72,563 |
yea it is...lemme ask u this..its probly a boot process so be4 u deleted anything did u end all processes related to it in task manager and taks bar??
|
|
|
|
|
Jul 14 2006, 08:02 PM
Post
#5
|
|
|
OBleepin Investigator Group: Moderator Posts: 17,441 Joined: 14-July 06 From: Bloomington, IN Member No.: 76,150 |
I stopped the processes in the task bar, but I didn't in the task manager not knowing how to use it at the time. Apparently some parts of the program that would start up automatically weren't shut down and obviously weren't uninstalled or deleted.
Remaining problems at this time: the KAVMonitoringservice. This tries to start when windows starts, and of course cannot. There are at least three very similar registration keys related to this service in the H Keys Local Machine. Some of them have LEGACY as part of the name: e.g. Root/Legacy_KAVMONITORSERVICE/OOOO The slashes go in the other direction of course. I've been searching elsewhere, and apparently some folks ran into a similar problem when installing the next version of Kaspersky Antivirus, as opposed to Cyberscrub. I have not been able to get rid of the registration keys. The system won't let me. KAV Monitor Service also shows up in the local services under the services and applications area. I have just now disabled it using the properties box. I wonder if this will help in getting rid of it. I'm still left with the question of how to get rid of it. I have solved the Klif driver problem and I do not get that error message anymore. I was able to delete the driver in the managing devices area. I have successfully gotten rid of all the Counterspy stuff including the registration keys. Orange Blossom p.s. I've noticed other registration keys from yet another software program, AVG7.0 I'd gotten rid of - and I can't get rid of those registration keys either. Fortunately, there are no error messages related to it that I can tell. -------------------- Orange Blossom An ounce of prevention is worth a pound of cure ESET NOD32, SuperAntiSpyware Pro, SpywareBlaster, Spybot 1.6.2.46, WinPatrol Plus, Sunbelt Personal Firewall - Full, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript |
|
|
|
|
Jul 15 2006, 06:27 AM
Post
#6
|
|
|
Forum Regular Group: Members Posts: 267 Joined: 18-June 06 Member No.: 72,563 |
lol im no good with registry and looks like i wont be getting kaspersky lawl
|
|
|
|
|
Jul 15 2006, 07:27 AM
Post
#7
|
|
|
Distinguished Member  Group: Banned Posts: 880 Joined: 14-January 06 Member No.: 50,692 |
I suggest you post a HijackThis log for examination.
A member of the HijackThis Team will walk you through, step by step, how to disinfect your computer. Once you post your log, don't make any changes to your system, as that could change the results of the posted log, making it difficult to properly clean your system. Read Preparation Guide for use before posting a HijackThis Log. http://www.bleepingcomputer.com/forums/topic34773.html Please read, and follow, all directions carefully!!! Then, run a log, and post it in the HijackThis forum, at this link below. http://www.bleepingcomputer.com/forums/forum22.html Do not, fix anything, yet. A member, of the HJT Team, will help you out. It may take a while to get a response, because the HJT Team are very busy. Please, be patient, as these people are volunteers. They will help you out, as soon as possible. NOTE: Once you have made the post, please, DO NOT make another post in the HJT forum, until it has been responded to by a member of the HJT Team. The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post, there will be 1 reply. The team member, glancing over the replies, might assume someone is already helping you out, and will not respond. So, just make your post, and let it sit there, until a team member responds. This way you will be taken care of, in the most timely manner. |
|
|
|
|
Jul 15 2006, 08:31 AM
Post
#8
|
|
|
Forum Addict Group: Members Posts: 5,898 Joined: 10-March 05 From: Florida, USA Member No.: 14,085 |
You can also use Startup Inspector to stop them from starting with Windows.
Startup Inspector And Startup Monitor http://www.windowsstartup.com/download.php |
|
|
|
|
Jul 15 2006, 12:45 PM
Post
#9
|
|
|
OBleepin Investigator Group: Moderator Posts: 17,441 Joined: 14-July 06 From: Bloomington, IN Member No.: 76,150 |
I'll do the "Hijack this log" sometime tonight or tomorrow after I read all the instructions.
Thanks! Orange Blossom --------- Quoting ThorXP "Once you post your log, don't make any changes to your system, as that could change the results of the posted log, making it difficult to properly clean your system." ---------- I run Spybot, AdAware SE Plus, on a regular basis to remove tracking information including logs in addition to searching for adaware, spyware and cookies. Should I not do some of this after doing the HiJack this log? Orange Blossom This post has been edited by Orange Blossom: Jul 15 2006, 04:58 PM -------------------- Orange Blossom An ounce of prevention is worth a pound of cure ESET NOD32, SuperAntiSpyware Pro, SpywareBlaster, Spybot 1.6.2.46, WinPatrol Plus, Sunbelt Personal Firewall - Full, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 8th November 2009 - 08:03 AM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.