Avast VS Kaspersky

[F4]

Hi all,

Avast told me that he found Kaspersky installed on my machine while I tried to install avast, can I use Kaspersky 4.5 as a backup scanner while running avast pro as a primary scanner on a same machine? As we know that Kaspersky has the best unpacking engine and strong in trojan detection rate. I don't have a dedicated anti-trojan program and want to implement avast by these Kaspersky's abilities.

Virus monitor, script checking, KAV control centre these Kaspersky's component aren't installed, I install only Kaspersky on-demand scanner and virus updater. Will it conflict with avast?

Thanks.

[neal62]

F4,

If I am not mistaken Avast does not like to co-exist with any other anti-virus program on anyones computer. I use Avast 4 Home edition (free) on my computer at my house. At my place of employment the computer I use for work has a Anti-Virus program called "Visnetic" which is based on the Kaspersky engine.
    About 1 week ago I saw a e-mail for me in my Outlook Express mail on the computer at work. I thought it was suspicious so I deleted it with no harm done. Since I choose to "Leave message on the server" option in O.E. when I got home and opened it up again later that same suspicious e-mail was downloaded to my inbox. Immediately my free version of "Avast 4 Home " edition warned me that the e-mail had the "worm Netsky-C". I also deleted the e-mail with no harm done. What I am surprised about is that the Kaspersky based Anti-Virus program on the pc at work did NOT warn me about this e-mail yet my free version of Avast DID warn me. So, I guess one never knows which Anti-Virus program will respond better than others at any given time. You may want to look into downloading both "Spywareguard", and "SpywareBlaster".
They work very well with any Anti-Virus program and give you the extra protection from Trojans.  

[Vlk]

Neal62, thanks for sharing your little experience. Maybe VisNetic is not properly managed in your office, i.e. it doesn't update it's virus database as it should...? I doubt it would miss the Netsky-family worms -- they're highly in-the-wild and any antivirus absolutely must catch them...

F4, you can use KAV as a backup scanner but you need to disable its kernel-mode drivers. To do this, delete the following registry keys (first backing them up could probably be useful):

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\AVPD
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\KLIF

and reboot.


That should solve the problem.

Thanks
Vlk

[compdrug]

Neal62, thanks for sharing your little experience. Maybe VisNetic is not properly managed in your office, i.e. it doesn't update it's virus database as it should...? I doubt it would miss the Netsky-family worms -- they're highly in-the-wild and any antivirus absolutely must catch them...

F4, you can use KAV as a backup scanner but you need to disable its kernel-mode drivers. To do this, delete the following registry keys (first backing them up could probably be useful):

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\AVPD
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\KLIF

and reboot.


That should solve the problem.

Thanks
Vlk

This is fine. However, there is a problem. KAV Personal Pro 5 recreates the KLIF key upon reboot. AVAST will then complain that it must shut down the standard provider once rebooted. I have tried everything possible...disabled realtime ALL realtime scanning, changed the KAV service to manual run, disabled the start application and systray icon in the additional settings, renamed the klif.sys file which also recreates upon reboot. I run NOD32 and AVG Pro on demand and AVAST does not complain. There must be a way to have AVAST ignore this detection. KAV is not running in realtime!
Perhaps, the AVAST.INI file?

Vlk, any suggestions?

[Vlk]

One trick that came into my mind is to let KAV recreate the KLIF key, then e.g. change the "Start" value to 4, which means "Disabled", and consequently set an ACL (access control list) on that key so that you deny write access to the account you're using (or the KAV installer is using)...

[mantra]

ummm
and using drweb like backup virus what should i do?

[compdrug]

One trick that came into my mind is to let KAV recreate the KLIF key, then e.g. change the "Start" value to 4, which means "Disabled", and consequently set an ACL (access control list) on that key so that you deny write access to the account you're using (or the KAV installer is using)...

Thanks Vlk. This basically worked as stated. I went through alot of tweaking with it. Actually, setting the "start" value to 4 presented a problem in that KAV would not even run manually. I tried values 1,2 and 3 and these did not work well either. What worked is leaving the KLIF key as an empty key and assigning a deny all to the ACL. This is working well so far and even allows KAV to start in the tray as well as a manual run and scanning from the context menu. I appreciate your help.