OK, there have been many requests for a working solution for Kaspersky Anti-virus 6.0 & the day after I started working on a new plugin for it my power supply died and it was a week before I was able to replace it with the help of a very generous donation & Ben being nice enough to make sure I got back up and running as soon as possible. Now that things are getting caught up on the development side of this project, here is the plugin.

Kaspersky Antivirus 6.x for UBCD4Win version 3.x
UPDATED - 12/03/06

NOTES:
You must have Kaspersky installed on the computer you are building with. Get it HERE
The plugin comes disabled by default and has a configuration script to setup the plugin to match your install.

Extract the plugin to ?:\UBCD4WIN\plugin\Antivirus\Kaspersky_Antivirus_6
Run the builder & open the plugins page.
From the plugins page select "AV: Kaspersky Antivirus v.6 <Press CONFIG>" & press the config button.

You will have 4 options for the plugin.
1)Creates a dynamic plugin that copies the files directly from there original placement on your system.
2)Creates a STATIC plugin that copies the needed files to the kaspersky plugin folder. (Uses 22+ mb)
3)Resets the plugin to it's original state & deletes all files from the plugin folder.
4)Quit

After runing the config script you must refresh the ubcd4winbuilder plugin window to see the changes.
When you are finished building the ISO/CD Kaspersky Antivirus will be located in the start menu...

START\Programs\Antivirus\Kaspersky Antivirus 6.0

The first time you run the program on each boot it will copy the virus definitions to the ramdrive & then start the program. After it has been run once per session, it will start faster but there is a small wait before the program opens on slow machines, so be patient & don't keep pressing the menu button.

I set the plugin up in a way that allows the definitions to be updated, but since the program is run from the CD (Read Only Media) it has been adjusted to not update the program files.

This has only been tested by myself & may contain errors, so use at your own risk & please post any sugestion or requests that you may have. I do not use this program on my systems so I am not too familiar with it but it seems to be working as expected.

Be sure to update your Kaspersky Instalation before running the config script so that you have the latest antivirus bases included in your build.

i have testet your plugin with german xp-prof-sp2, and it works without any problems.
Also the virus database update works fine.

Joshua

Did you use the dynamic or static version?

i use the static version.

Joshua

THANX

Now I need someone to test the Dynamic version.

I tried dynamic this morning.
When I "refreshed" there was nothing new? Is there supposed to be something new in the list?
I also received a build error. It could not find Program Files\Kaspersky Labs\Kaspersky Anti-Virus 6.0. Probably because mine is located in Program Files\Kaspersky Anti-Virus 6.0.

NO, the script re-writes the inf file & enables it at the same time.

Did YOU change the instalation directory when installing the program or do I need to allow for another path? I will add an option to change the path to a variable latter tonight or tomarrow.

Yeah, I don't like extra folders that aren't necessary. I'm annoyed by programs that want to install their files 3-6 folder deep, it's not necessary!

I thought that you were setting up a variable to take care of that. Once you have a new version I'll check it out and make sure it works.

OK, Updated script is now uploaded & should compensate for people who feel the need to modify the instalation directory of the programs they install.

Has anyone outside the ubcd4win development team tried this plugin yet?

Does it work? Are there any errors? Any Comments? Sugestions? Anything??

From the lack of any response in this thread I can either assume that...

• A - It works perfectly for everyone that has tried it.
• B - No one has tried it & I wasted my time writing it.

Which statement is true?

PS:
As I stated above I do not use this program & really cannot fully test it.
This plugin was created on the basis of it being one of the most requested plugins that was not alailble yet.

Please let me know if it it working or any sugestions on how to make it better.

"mode" is not recognized as a command......blah blah, blah, whatever it says....

Anyways, that is listed and then it says it's copying files.....moments later Kaspersky does come up. It appears to be functional. I am scanning my hard drive right now. More testing probably needs to be done, but I think this is working pretty well so far.......let's see if my main system has any viruses!!

I'm psychotic, not psychic.

When are you getting that error? during plugin generation or at run time?

OK, mode.com is not in the default build, so that explains the error.



Simply comment out the mode statement in the startup file, or add mode.com=2,,1 to the files section of the plugin.

Evidently you reread my post and figured it out. I wasn't completely clear, but enough for you to figure out.

I've installed Kaspersky 6.0 in "D:\Kaspersky" folder.When i run the batch file "CONFIG_AVP6" i get a message
saying "Please verify whether Kaspersky AV is Installed".I guessed from your previous discussions that this might be due to the installation in a different dir.Though i would not mind reinstalling it in the default directory "c:\Program Files\Kaspersky Labs\Kaspersky Anti-Virus 6.0.", But the problem is I updated my Kaspersky AV for nearly an hour through my snail paced "Dial-Up" connection.Can you pls help me out.

New version is uploaded. Now using reg.exe to get program location from the registry.



Please re-download the plugin and try again. Let me know if this sovles the problem.

@ALL
This plugin has been posted for 6 week with over 950 views.
I do not have a download counter for the file, but would imagine that someone has used it by now.

Can anyone outside of the UBCD4WIN development team verify that this plugin is working?

Most of the time, NO FEEDBACK is a good sign that either the plugin is working perfectly or no one is using it. Which one is true?

I do not use Kaspersky, but took the time to write this plugin based on user request so if you are using this plugin please post any sugestions on how to make it better or at least let me know it is being used.


THANX

I have the CD direct from Kaspersky because we're a partner. I was interested in putting this on my own UBCD4WIN install so I grabbed the latest release and used this plugin.

I've used the Dymanic settings so they grab the files from my laptop and used it in a VMware environment with perfect results.

I will be using this CD in about 2 hours to clean off some bad files from a friend's PC with this plug-in and I'll report back on the progress. So far so good though, so thanks so much for you efforts!

I'll keep you posted!

I don't think your post was clear? It doesn't really matter but I was just wondering if you downloaded the latest version and then added this plugin from hilander? Wondering because this plugin is now included in the project so you do not have to go through the extra download and steps.

I own Kaspersky on both of my systems and finally included it in one of my recent builds. I've cleaned up a few computers with this CD and gotta say that Kasp. kicks some butt! I was very happy to see it catch some spyware. I guess I've never realized the actual "power" of Kasp. because I am extremely careful with my systems. Since the project is distributed from my systems I have to make sure they are clean. If either of my systems were comprimised and real spyware was accidentally included in the project......that would really mess things up!! I don't know if we could ever recover from a disaster like that? With how bad people freak out because of "false positives", I dunno if we could ever really regain everyone's trust no matter how many times we apologized.

Anyways, Kaspersky kicks ass!!!

Thank you for taking the time to respond. Feedback is nice and your the first to post any real feedback outside of our development team.

Let me know how it works and if you have any sugestions on what might need to be tweaked.

THANX

Sorry for the confusion on that Here's the scoop:

I have the latest version of Kaspersky as of my posting. The engine version is 6.0.1.411
I downloaded the latest version of UBCD4WIN since I saw you guys had updated it as of the 4th, I believe.
I enabled the Kaspersky plugin that was present and did not download one from here. It looked like this plugin in specific was identical to the one that was put on the pebuilder interface.
Configured the plugin with Dynamic settings (which, I'm assuming uses files direct from my build and system instead of set files and/or settings that the plugin has programmed to use.) and Refreshed to make sure it was enabled.

And yes, Kaspersky definitely kicks ass!


Superb job on this! I had previously scanned the system with NOD32 and Avast (separately) because I had a Trojan on a remote machine that I could not clean out. So...I took the CD that I physically downloaded from Kaspersky's Reseller site and booted it up. Problem is that the SATA support just wasn't there...couldn't see any of my drives.

Of course, I bust out the UBCD4WIN and start rockin'. Detects all drives and Kaspersky lights up and starts running upon my request.

Scanned and found 5 trojans total (4 more than Avast and NOD32 found, mind you) and Kaspersky cleaned all of them out. Infected my userinit.exe so I had to grab it from a different folder (it was in the dllcache as well as in \windows\system\. So...used UBCD4WIN to copy the file back into \windows\system32\ and everything worked perfect.

The plug-in was absolutely flawless. Can you explain what the real differences are between static and dynamic though? I'm not 100% clear on it, as I was only making assumptions.

The "Dynamic" setup uses files directly from your running system and does not copy anything to the plugin's files folder. Static on the other hand copies the current files from your system at the time the config script was run and keeps them in the plugin's files folder. This is mainly for users like me that do not have Kaspersky running on there main/building system. The downside is that the program and virus definations do not stay up to date like the dynamic version so it kinda freezes it in time to when you ran the script.

You can always run the script again to update the plugin to the current version, but the Dynamic plugin is a much better way to make sure you are always building with the current version of Kaspersky.

Thanks for the feedback.

This plugin has been/will be used as a "Road-map" for many other AV application plugins concidering that it seems to do the job nicely.

Static, is similar to the plugin that Kaspersky itself creates for a BartPE enviroment.. the differences being that the menu structure is taken into account. This basically creates a stand-alone plugin which includes all files needed from an installed version of The advantage that a static has over the dynamic is that if the system were to get infected with malware and the malware had damaged the actual installation of Kaspersky... the static files are less prone to having also been attacked since they will be in a non-standard location. If the malware actually performs a search instead of just looking in the standard location.. this advantage no longer exists as both copies would likely be attacked.

Dynamic is what you described... instead of copying the files to the plugin folder as with the static version.. it actually pulls them from the installed Kaspersky program directly. This method has the advantage of being as up-to-date as what is currently installed... the static version would require that you re-create ( ie run the Config again ) it again to update it.

---------------

I just downloaded the plugin yesterday and set it up. Haven't had time for extensive testing yet but the build worked fine and it runs. I'm using Bart's PE Builder and Sherpa's XPE plugin. The only thing I could see is that when I ran it and went to the services tab in the Antivirus, it didn't show any of the normal program information - I'm a licensed user but it showed unknown license for 0 computers and said the definition files were corrupted but I know they're good on the HD I'm building from.

Any thoughts on that one? I'm guessing there's some registry entries that aren't getting carried over but haven't the foggiest which ones. I'm using version 6.0.1.411

Thanks for taking the time to write it (especially for a program you don't use! <G>)

Tepin

Theres been no testing with XPE so I'm not sure. None of the normal "Services" are running when loaded this way but everything should work as normall when scaning for viruses. Have you tried to update the defs while booted in PE? & are you using any of the FBWF plugins with your build?

I do know that using FBWF with this plugin will stop it from functioning as the program checks for a read only media to determine what mode the license check is using and will fail to work if it detects a real os install (Meaning a writeable system drive).

Wow...that was a quick response!

I'm not sure if we're talking of the same 'services'...the ones I'm talking about aren't windows services. It's what I see when I run KAV and click on the 'services' tab on the middle right of the screen (I'm at work so I can't actually run it to see what I get) From memory, it will show the status of the program over on the right - things like registered name, registration status, expiry, program version, updates, etc. None of those look like they do when I run the reg'd version on my system. If I get a chance tonight, I'll fire both up and grab a screenshot of each & post them here.

Yes I can update the defs in PE so all is good that way other than I'm guessing it shouldn't take as long to update defs that are a couple of days/weeks old as it does to update from scratch. I usually do an update/rebuild/reburn with the new data files of most of my utils (spybot, ad-aware, kapersky, etc) every few weeks.

Had to do a quick search - wasn't sure what a FBWF was but thanks to Yahoo, now I know & I can tell you I'm not using it. <G>

I've got a second (different) Kapersky 6 plugin that I haven't tried that has spots in the .inf for me to manually enter my registration data from various spots in the registry. I'll also give it a shot either tonight or tomorrow and see how it goes.

Take care...Tepin

I've seen the 3 other plugins which is why I wrote this one. There is no need for the registration in this version of the plugin because it is designed to run in PE with a lower footprint to reduce system requirements and ensure that it will work as fast as possable. The other plugins have had several problems posted with little or no real answers and are designed to be a full install of the product just like your real windows setup. If & only IF you are using PE to replace your windows is the only real need for anything like that so the choice is yours on which plugin you use and thanks for posting feedback either way, it is appreciated.

Ok...that makes perfect sense. I tried the other plugin and as you said, there's a few problems with it. As long as yours won't expire on me and it can update then it doesn't really matter if the reg. info shows or not. I did get one of the other plugins working a bit better than it was (it now knows that defs have been downloaded recently) but still complains that they're corrupted. The total of your plugin is about 4MB less than the other plugin so there's a definate space saving. I'll likely go with your plugin over the other one just for the ease of setup.

Thanks again for the plugin and followup!

Tepin

Hi!

Thanks Hilander999! Greate work.

I have tested the plugin with bart pebuilder (german PCWelt-Edition).

One problem was, that the environmentvariable %AppData% is not defined in this package.
To solve this problem, I inserted one line in avp6_startup.txt:
set AppData=B:\Programs

Now the plugin works fine. Even the update of the signatures seems to work properly. No errormessage appears.
But:
I can get no green OK-Sign on the main screen for uptodate signatures.

Anyone, who has this problem too?

Bart's Pebuilder does not creat a full working set of environment variables, so this is no big suprise.

Thanks for reporting the issue though.

akami/Hilander99:

I am having some trouble getting this plugin to work. Since Akami has it working in plain
BartPE, I'm assuming I should be able to do the same (with a little help from you kind folks.)
I'm using XP SP2, BartPE 3.1.10 (with nu2menu only) and KAV 6.0.1.411 .

The real-time services appear to load at boot, and the GUI program runs,
but it reports the "threat signatures are corrupted." When I try to do
an update from local files (.e.g on a USB flash drive), it fails, saying
"Updated failed: object not found or update source unavailable".

If it try to do an update via the Internet, it take forever, and never seems to finish,
or finishes, and still reports the "threat signatures are corrupted".

I noticed the same thing that Akami did-there is no "%appdata%" variable in plain
BartPE.

Do you have any idea how I can fix this? Do I just need to add %appdata% somewhere,
or is something screwed up. I'm not much of a progamming type, as you can tell.

Oh, and I'm still a little confused over Static versus Dynamic installations.
I can still update the signatures with the static version, right? The word static just gets
me a bit confused, since updating to me seems like it would be a "dynamic" feature.


Thanks for any help, and a big thanks for your plugin!


Shplad

OK, this post has more information then the one at 911.

I wrote this for ubcd4win which has a good environment profile setup, the bartpe profile is not complete and is partly broken.

If you look at avp6.dat in the plugin, line #26 has...


0x1,"KasperskyLab\avp6\environment","DataRoot","%AppData%\avp6"

All the other program variables are based off of this one, so you must define dataroot with a variable that does exist in normal bartpe.

THIS MIGHT WORK....
0x1,"KasperskyLab\avp6\environment","DataRoot","%RAMDRIV%\avp6"

At the same time you will have to change avp6_startup.txt to match your new location.
Change all instances of %appdata% to %RAMDRIV%

hope this helps.

The only time I've seen this issue is when the ramdrive is full or isn't big enough.

This post deals with OUR plugin that is designed FOR UBCD4Win, so if you need assistance with your own work or customizations, I suggest you create a new post for that.

It's ok, really. His only problem is a missing environment variable that the program relies on.

He should be able to fix it with my directions, or he needs to just switch to a propper environment plugin.

Yes it was written to support our users, but I try hard to make everything backwards-compatable with a plain bartpe also, but you will always find dependancies once your build gets large enough and you start using advanced features.

I really do not understand why I never saw his post here last month, so sorry for that.

Don't forget the .inf, around line 50...

---

NO NO NO....

The file he wants to edit is the DAT file because this is the file that generated the INF when you run the setup script.

hilander:

Thanks for helping me out with this. I'm not suggesting everyone has to share
their plugin expertise with plain BartPE users, but it sure is nice/helpful when people do.

Does that include changing the line


at all? If so, how?


Again, thanks. You have no idea how long I've waited to have this plugin work properly.


Shplad

avp6.dat line #26
change this...


to that...


open avp6_startup.txt in a text editor.

Change all instances of %appdata% to %RAMDRIV%
This means ctrl-g in notepad, search and replace all instances of %appdata%
and change them to %RAMDRIV%

save both files.
Re-run the config script so that your plugin.inf will be changed to the new version since we edited avp6.dat (the base plugin).

Thats all you should have to do, but double check the filecase of %appdata% & %Ramdriv% and match what you are using in your build of the variable still wont work because they are case-sensative.

Hilander:
Sorry, I was clued out and didn't notice you wrote "%RAMDRIVE%" there, and not just "RAMDRIVE".

I booted my BartPE CD and typed "env" at a DOS prompt. What spit out was "ramdrv=B:"
So I did the replacements you mentioned with "%ramdrv%". Does that sound okay?

I've made the changes, as you described. There is no semblance of %appdata% in vanilla BartPE, so I'm assuming I can just use the same thing you've written in your plugin ("%AppData%") in mixed case and declare this variable for the first time?

Should I rerun the CONFIG_AVP6.CMD?



Shplad

yes, I had you edit the dat file which is used by config.cmd to generate the plugin based on the option you choose.

From bartpe, type SET from the cmdline to see all variables.
The changes I asked you to make are removing the %AppData% variable all-together so it will work without a full environment setup.

I added this plugin to a vanilla build of UBCD4WIN 3.4, but I'm having a problem that I don't think has anything to do with the ramdrive.
Any scan I do appears to complete without a problem, however on closer inspection the events log has all sorts of processing errors. Basically any DLL, EXE, SYS file. Other files like GIF and TXT Kaspersky has no problem with.
Could someone here please try: a scan on X: drive.
After the scan is complete it will look like it has scanned everything but click the events tab and see if you see "processing error" on any files. Like this here.

@cornflake

Try something... but use your installed KAV instead of one in UBCD4Win.... take any program CD that has a lot of SYS, EXE and other executable files.... see if the same errors happen.

I can certainly think of a way that this type of issue could happen. When programs open a file to be read, like an antivirus must do, they will create a temp file to do the testing with... if KAV is doing this ( making the temp file ) in the same location as the original file is located... then obviously an error would be what would happen.

@hilander999

I've installed and used the plugin. It works and updates perfectly. Thanks for your efforts. I guess in your case no news is good news

Cheers

Thanks but I can't use my installed KAV when I'm running UBCD4WIN. I just tried KAV from UBCD4WIN today in a VM and now Kaspersky is saying that my signatures are corrupted and the scan fails entirely. The physical computer I was using passed stress tests, so I don't think memory or anything caused the corruption. Also I don't think it's the UBCD4WIN ramdrive because there is plenty of space free should a temporary space be needed(16mb). The only thing I can think of is an archive that has to be decompressed to be scanned, but that doesn't explain the EXE/SYS/etc.

Anyway it's probably me. Maybe I missed a step copying at some point. I'll try again from scratch another time.

I didn't say use your installed KAV from UBCD4Win... geez.... I meant from your installed Windows.

The whole point to the suggested test was to see if KAV ( when run from Windows ) also produced the same errors.... I suspect that KAV is trying to place its temp files that it must create to test a file with.. in the same location as the files or somewhere on the system drive... if you get errors from the installed version of KAV... then its trying to place them on the location of the original files.. if not.. then its using a system drive.. either way we get some info... This doesn't mean that we can correct this issue since none of the Dev Team owns a copy to be able to diagnose it with.. but without the info we certainly can't address it.

I use it all the time in Vista without a problem, scanning CDs and just about everything.

What I did was copy my files from my Vista Kaspersky dir to my UBCD4WIN KAV plugin dir... and my UBCD4WIN is based on XP SP2.. so maybe there's a problem there, or maybe I just screwed something up copying? I don't know.

So then your problem isn't with the Kaspersky plugin that was provided, you created your own plugin from an included one and possibly from a version of Kaspersky that is unknown if it works with UBCD4Win or not.. its very possible that the Vista files that Kaskpersky uses are different from ones used on XP which is what the plugin was made for.

Well, not exactly. I sometimes post when I'm tired and I guess I didn't recall what I was doing. I have two separate builds, one with the NOD32 plugin and one with Kaspersky. The NOD32 plugin is where I was copying files over to the plugin directory. The Kaspersky plugin, the one included with UBCD4WIN 3.4 (and at the beginning of this post) is one where I was prompted with the type of installation ( I chose static ) and the config script automatically copied the files over.

I did solve the problem, it appears I didn't have enough memory. I found this out because when I was trying to diagnose what was happening, I couldn't launch taskmgr or any other application to monitor the system. I had initially confused Kaspersky for what I did with NOD32. And because of the "%ProductStatus%" appended to the Kaspersky main window, I figured I missed copying a file or changing a registry entry, or something.

Anyway, solved, thanks for your input