General discussion



By Frank Krebs ·
I have a program that keeps trying to load, it's called KAVSVC, and from what I can find online it's Kaspersky Anti-Virus, but I never loaded the program on my computers, never even heard of it. I did find out that when an executabe shows up in msconfig, vnkail.exe, that when the KavSvc starts showing up. I've googled vnkail, but get no results. I did a search of the HD and found it in c:\windows\prefetch. I've run a full sweep of anti-spyware and anti-virus programs, including AdAware SE, SpyBot S&D, Hijack This, HSremove, CWShredder, AVG, TrendMicro online and Symantec Online. I've also run CCleaner. The OS is Windows XP Pro SP2. Any Help would be appreciate.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

by BFilmFan In reply to VNKAIL.EXE

the command line which starts Kasper-Sky should be:


That anti-virus program uses several tricks to protect itself. It is possible that the program was installed prior to you aquiring the system.

Is this a corporate PC?

Did you purchase it used or was it a demo?

Collapse -

by Frank Krebs In reply to

Poster rated this answer.

Collapse -

by Frank Krebs In reply to VNKAIL.EXE

The Kaspersky folder does not exist on my computer. This is my laptop, and I just completed a complete rebuild about three months ago. As far as I know, I never installed Kaspersky on this computer. I did purchase it used, but I did reformat the HD before rebuilding it.

Collapse -

by willcomp In reply to VNKAIL.EXE

Search the Registry for KAVSCV and VNKAIL. Once you have Registry locations that contain those strings, you have where they are loading from.

Proceed with caution when modifying Registry. Back it up before you proceed.

If you feel sporty, delete registry keys that contain strings and you should be rid of "problem."


Collapse -

by Frank Krebs In reply to

I've tried the registry hack and it still comes back. I'm beginning to suspect that it may have something to do with one of the IM programs my daughter uses. Has anyone heard anything that may relate to this? I appreciate the help, and your answer was a reasonable suggestion. Thanks to both of you who've replied so far.

Collapse -

by _Christian_ In reply to VNKAIL.EXE

I am not sure if it will help you, but check out this link ( and following links from this page.

All IM sofware are currently security loopholes, but I do not see how it could install those 2 processes, which are only currently known as legitimate, as far I could find (no know name hijacking).

Collapse -

by Elimist5000 In reply to VNKAIL.EXE
Collapse -

by The Grimm In reply to VNKAIL.EXE

Hi Frank,

Its possible that this was installed as part of another application... have you installed anything recently? If not, take a look at the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVErsion\Run and see what is set to run automatically. Or you could also look under C:\Documents and Settings\All Users\Start Menu\Programs\Startup to see if anything else might be set to start up that shouldn't. Either way let us know what you find in both.


Related Discussions

Related Forums