Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Error Messages; Klif Driver And Kav: Are They Only For Kaspersky


  • Please log in to reply
8 replies to this topic

#1 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,849 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:11 AM

Posted 14 July 2006 - 08:50 AM

I have Windows XP service pack 2
Dimension 2400 Dell
I get an error message as follows:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 7/14/2006
Time: 7:43:36 AM
User: N/A
Computer:
Description:
The following boot-start or system-start driver(s) failed to load:
Klif
-------
I get another error message:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 7/14/2006
Time: 7:43:36 AM
User: N/A
Computer:
Description:
The KAV Monitor Service service failed to start due to the following error:
The system cannot find the path specified.
---------------
I looked through the internet, and found the information pasted in below from this site. My question: is the klif driver ONLY for that anti-virus program? If so, I can get rid of it. I have uninstalled and deleted some anti-spyware and anti-virus programs, but I know that bits are still left of at least one of these. I'm wondering if these files are it.
--------------------------
Additional info.: I have searched in several ways for both KAV and Klif. Using the SC find service method in the command module, I was informed that KAV Monitor Service was not an installed service, no surprise.

Now I'm wondering if there is something in the registry. I've used Registry Cleaner Optimizer but it does not find anything out of wack.

Orange Blossom
-------------------------------
Name: klif
Filename: klif.sys
Command: C:\WINDOWS\system32\drivers\klif.sys
Description: Driver used by the Kaspersky Anti-Virus.
File Location: C:\WINDOWS\system32\drivers\klif.sys
Startup Type: This startup entry is installed as a Windows NT, 2000, 2003, or XP service.
Service Name: klif
Service Display Name: klif
HijackThis Category: O23 Entry

Edited by Orange Blossom, 14 July 2006 - 09:31 AM.

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

BC AdBot (Login to Remove)

 


#2 moomoo

moomoo

  • Members
  • 267 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 14 July 2006 - 09:48 AM

have u uninstalled kaspersky completely??? it sounds like its running a boot service...and something went wrong so its messing up your booting..

did u even have kaspersky?
ok well i'm officially confused cuz its saying its a service...but was it an add on service... ok well i think wat i posted above is right :thumbsup: if its not sorry

Edited by moomoo, 14 July 2006 - 09:50 AM.


#3 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Topic Starter

  • Moderator
  • 36,849 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:11 AM

Posted 14 July 2006 - 02:49 PM

Yes, I did have Kaspersky for a while: just a few days. I was trying out different programs last year. I turned off the program and uninstalled through Add - Remove programs. I knew at the time that this process at times resulted in an incomplete uninstall, so I searched for all the files and folders associated with the program using Search and deleted and erased them completely beyond DoD standards.

I did the same thing for Counterspy, put out by SunBelt. This is the program that has been starting up a bit then quitting. Oddly, I do not get error messages related to this program. Earlier today I discovered a folder of registration keys under SunBelt. I have also just now found a folder of registration keys under Kaspersky.

So how does one completely uninstall a program so this kind of thing does not happen? Is it safe to remove the Kaspersky registration keys?

Orange Blossom

Correction: It was CyberScrub AntiVirus which used the Kaspersky drives etc. It has been over a year since I uninstalled and deleted the program.

Edited by Orange Blossom, 14 July 2006 - 06:28 PM.

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#4 moomoo

moomoo

  • Members
  • 267 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 14 July 2006 - 07:18 PM

yea it is...lemme ask u this..its probly a boot process so be4 u deleted anything did u end all processes related to it in task manager and taks bar??

#5 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Topic Starter

  • Moderator
  • 36,849 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:11 AM

Posted 14 July 2006 - 08:02 PM

I stopped the processes in the task bar, but I didn't in the task manager not knowing how to use it at the time. Apparently some parts of the program that would start up automatically weren't shut down and obviously weren't uninstalled or deleted.

Remaining problems at this time: the KAVMonitoringservice. This tries to start when windows starts, and of course cannot. There are at least three very similar registration keys related to this service in the H Keys Local Machine. Some of them have LEGACY as part of the name: e.g. Root/Legacy_KAVMONITORSERVICE/OOOO The slashes go in the other direction of course. I've been searching elsewhere, and apparently some folks ran into a similar problem when installing the next version of Kaspersky Antivirus, as opposed to Cyberscrub. I have not been able to get rid of the registration keys. The system won't let me. KAV Monitor Service also shows up in the local services under the services and applications area. I have just now disabled it using the properties box. I wonder if this will help in getting rid of it.

I'm still left with the question of how to get rid of it.

I have solved the Klif driver problem and I do not get that error message anymore. I was able to delete the driver in the managing devices area.

I have successfully gotten rid of all the Counterspy stuff including the registration keys.

Orange Blossom

p.s. I've noticed other registration keys from yet another software program, AVG7.0 I'd gotten rid of - and I can't get rid of those registration keys either. Fortunately, there are no error messages related to it that I can tell.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#6 moomoo

moomoo

  • Members
  • 267 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 15 July 2006 - 06:27 AM

lol im no good with registry and looks like i wont be getting kaspersky lawl

#7 ThorXP

ThorXP

  • Banned
  • 880 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 15 July 2006 - 07:27 AM

I suggest you post a HijackThis log for examination.
A member of the HijackThis Team will walk you through, step by step, how to disinfect your computer.
Once you post your log, don't make any changes to your system, as that could change the results of the posted log, making it difficult to properly clean your system.

Read Preparation Guide for use before posting a HijackThis Log.
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

Please read, and follow, all directions carefully!!!

Then, run a log, and post it in the HijackThis forum, at this link below.
http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/ Do not, fix anything, yet.
A member, of the HJT Team, will help you out.
It may take a while to get a response, because the HJT Team are very busy. Please, be patient, as these people are volunteers. They will help you out, as soon as possible.

NOTE:

Once you have made the post, please, DO NOT make another post in the HJT forum, until it has been responded to by a member of the HJT Team. The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post, there will be 1 reply. The team member, glancing over the replies, might assume someone is already helping you out, and will not respond. So, just make your post, and let it sit there, until a team member responds. This way you will be taken care of, in the most timely manner.

#8 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:03:11 AM

Posted 15 July 2006 - 08:31 AM

You can also use Startup Inspector to stop them from starting with Windows.

Startup Inspector
And
Startup Monitor

http://www.windowsstartup.com/download.php

#9 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Topic Starter

  • Moderator
  • 36,849 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:11 AM

Posted 15 July 2006 - 12:45 PM

I'll do the "Hijack this log" sometime tonight or tomorrow after I read all the instructions.

Thanks!

Orange Blossom
---------
Quoting ThorXP

"Once you post your log, don't make any changes to your system, as that could change the results of the posted log, making it difficult to properly clean your system."
----------
I run Spybot, AdAware SE Plus, on a regular basis to remove tracking information including logs in addition to searching for adaware, spyware and cookies. Should I not do some of this after doing the HiJack this log?

Orange Blossom

Edited by Orange Blossom, 15 July 2006 - 04:58 PM.

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users