kaspersky rescue disk

I thought it was about time i ran a Kaspersky's rescue disk to check
for malware etc. I downloaded the latest rescue10 iso as usual, ran
rescue2usb.exe to write it onto my Kingston usb drive, as usual, and
it came up with an unspecified error while trying to write the iso to
the flash drive. I reformatted the Kingston, same thing. Tried my
second Kingston, same thing. Downloaded the iso again, same thing.
Tried another usb port for the Kingston, same thing.

I tried to dl another copy of rescue2usb.exe from the Kaspersky site
and encountered all kinds of problems trying to get it. Makes me
wonder if something has changed? and they don't want you to use that
method anymore? and they changed their iso so you can't?

I'm on XP. I've used this procedure many times in the past without
problems. Anybody know any explanation?

On Mon, 28 May 2018 10:09:20 -0400, John B. Smith
wrote:

I thought it was about time i ran a Kaspersky's rescue disk to check
for malware etc. I downloaded the latest rescue10 iso as usual, ran
rescue2usb.exe to write it onto my Kingston usb drive, as usual, and
it came up with an unspecified error while trying to write the iso to
the flash drive. I reformatted the Kingston, same thing. Tried my
second Kingston, same thing. Downloaded the iso again, same thing.
Tried another usb port for the Kingston, same thing.

I tried to dl another copy of rescue2usb.exe from the Kaspersky site
and encountered all kinds of problems trying to get it. Makes me
wonder if something has changed? and they don't want you to use that
method anymore? and they changed their iso so you can't?

I'm on XP. I've used this procedure many times in the past without
problems. Anybody know any explanation?

Forgot to mention I'm trying to use Kaspersky Rescue disk 10.

John B. Smith wrote:
On Mon, 28 May 2018 10:09:20 -0400, John B. Smith
wrote:

I thought it was about time i ran a Kaspersky's rescue disk to check
for malware etc. I downloaded the latest rescue10 iso as usual, ran
rescue2usb.exe to write it onto my Kingston usb drive, as usual, and
it came up with an unspecified error while trying to write the iso to
the flash drive. I reformatted the Kingston, same thing. Tried my
second Kingston, same thing. Downloaded the iso again, same thing.
Tried another usb port for the Kingston, same thing.

I tried to dl another copy of rescue2usb.exe from the Kaspersky site
and encountered all kinds of problems trying to get it. Makes me
wonder if something has changed? and they don't want you to use that
method anymore? and they changed their iso so you can't?

I'm on XP. I've used this procedure many times in the past without
problems. Anybody know any explanation?

Forgot to mention I'm trying to use Kaspersky Rescue disk 10.

You should be using a year-old image and try that instead.

I couldn't tell you what's going on with it, but I had
trouble with it too and I make CDs rather than rescue2usb.

I don't remember the symptoms, but I just used an older disc
and that fetched definitions. It'll take a while though, to
fetch 100MB of definitions at "5KB/sec" (the server download
rate was always quite variable). The advantage of
a fresh image used to be that the definition_delta was
smaller, so the update time was a lot shorter.

Since the updates are stored on "C:\Kaspersky Rescue Disk 10.0"
you're scanning, it doesn't have to download 100MB each time.

There are also some log files at the top level. This is
apparently the last time I used it, but using an older disc.
So I guess in fact, the disc I used might have been 1.5 to 2
years old :-) As the disc was likely older than this date.
The definition size here might have been this small, because
I was running it more than once in the same week (this is
back when I had bad RAM in the computer, and it took me a
while to figure out I had a hardware issue and not malware).
It was actually a Windows memory tester, that informed me
I had bad RAM, which was pretty funny at the time (you don't
usually expect much from that, but I guess they improved it).

My Update Center: completed 1 minute ago, updates size: 529.3 KB (events: 53)
4/8/17 11:22 PM Task completed
4/8/17 11:22 PM File updated /var/kl/dskm_rd/upd-0607g.krg
4/8/17 11:22 PM File updated /var/kl/dskm_rd/upd-0607g.pbv
4/8/17 11:22 PM File installed /var/kl/bases_rd/upd-0607g.xml
4/8/17 11:22 PM File installed /var/kl/bases_rd/klp-0607g.xml
4/8/17 11:22 PM File updated /var/kl/dskm_rd/rms-0607g.krg
4/8/17 11:22 PM File updated /var/kl/dskm_rd/rms-0607g.pbv
4/8/17 11:22 PM File installed /var/kl/bases_rd/kavbase.rms
4/8/17 11:22 PM File installed /var/kl/bases_rd/mod-qscan-0607g.xml
4/8/17 11:22 PM File installed /var/kl/bases_rd/klavsys.mft
4/8/17 11:22 PM File installed /var/kl/bases_rd/klavsys.kdc
4/8/17 11:22 PM File updated /var/kl/bases_rd/startup.ini
4/8/17 11:22 PM File updated /var/kl/bases_rd/verdicts.ini
4/8/17 11:22 PM File updated /var/kl/bases_rd/kavbase.mft
4/8/17 11:22 PM File installed /var/kl/bases_rd/rms-0607g.xml
4/8/17 11:22 PM File installed /var/kl/bases_rd/qscan-0607g.xml
4/8/17 11:22 PM File updated /var/kl/data_rd/u0607g.xml

And this is how I can tell it's (kinda) scanning. It always
finds my EICAR sample.

Objects Scan: completed 1 minute ago (events: 12, objects: 572879, time: 00:14:02)
4/8/17 11:57 PM Task completed
4/8/17 11:57 PM Untreated: EICAR-test-file sdb1/Downloads/uk.co.extorian.EICARAntiVirusTest.apk/classes.dex
4/8/17 11:57 PM Detected: EICAR-test-file sdb1/Downloads/uk.co.extorian.EICARAntiVirusTest.apk/classes.dex
4/8/17 11:57 PM Untreated: EICAR-Test-File sdb1/Downloads/uk.co.extorian.EICARAntiVirusTest.apk/assets/EICARAntiVirusTestFile.com
4/8/17 11:55 PM Detected: EICAR-Test-File sdb1/Downloads/uk.co.extorian.EICARAntiVirusTest.apk/assets/EICARAntiVirusTestFile.com

Paul

On Mon, 28 May 2018 12:07:35 -0400, Paul
wrote:

John B. Smith wrote:
On Mon, 28 May 2018 10:09:20 -0400, John B. Smith
wrote:

I thought it was about time i ran a Kaspersky's rescue disk to check
for malware etc. I downloaded the latest rescue10 iso as usual, ran
rescue2usb.exe to write it onto my Kingston usb drive, as usual, and
it came up with an unspecified error while trying to write the iso to
the flash drive. I reformatted the Kingston, same thing. Tried my
second Kingston, same thing. Downloaded the iso again, same thing.
Tried another usb port for the Kingston, same thing.

I tried to dl another copy of rescue2usb.exe from the Kaspersky site
and encountered all kinds of problems trying to get it. Makes me
wonder if something has changed? and they don't want you to use that
method anymore? and they changed their iso so you can't?

I'm on XP. I've used this procedure many times in the past without
problems. Anybody know any explanation?

Forgot to mention I'm trying to use Kaspersky Rescue disk 10.

You should be using a year-old image and try that instead.

I couldn't tell you what's going on with it, but I had
trouble with it too and I make CDs rather than rescue2usb.

I don't remember the symptoms, but I just used an older disc
and that fetched definitions. It'll take a while though, to
fetch 100MB of definitions at "5KB/sec" (the server download
rate was always quite variable). The advantage of
a fresh image used to be that the definition_delta was
smaller, so the update time was a lot shorter.

Since the updates are stored on "C:\Kaspersky Rescue Disk 10.0"
you're scanning, it doesn't have to download 100MB each time.

There are also some log files at the top level. This is
apparently the last time I used it, but using an older disc.
So I guess in fact, the disc I used might have been 1.5 to 2
years old :-) As the disc was likely older than this date.
The definition size here might have been this small, because
I was running it more than once in the same week (this is
back when I had bad RAM in the computer, and it took me a
while to figure out I had a hardware issue and not malware).
It was actually a Windows memory tester, that informed me
I had bad RAM, which was pretty funny at the time (you don't
usually expect much from that, but I guess they improved it).

My Update Center: completed 1 minute ago, updates size: 529.3 KB (events: 53)
4/8/17 11:22 PM Task completed
4/8/17 11:22 PM File updated /var/kl/dskm_rd/upd-0607g.krg
4/8/17 11:22 PM File updated /var/kl/dskm_rd/upd-0607g.pbv
4/8/17 11:22 PM File installed /var/kl/bases_rd/upd-0607g.xml
4/8/17 11:22 PM File installed /var/kl/bases_rd/klp-0607g.xml
4/8/17 11:22 PM File updated /var/kl/dskm_rd/rms-0607g.krg
4/8/17 11:22 PM File updated /var/kl/dskm_rd/rms-0607g.pbv
4/8/17 11:22 PM File installed /var/kl/bases_rd/kavbase.rms
4/8/17 11:22 PM File installed /var/kl/bases_rd/mod-qscan-0607g.xml
4/8/17 11:22 PM File installed /var/kl/bases_rd/klavsys.mft
4/8/17 11:22 PM File installed /var/kl/bases_rd/klavsys.kdc
4/8/17 11:22 PM File updated /var/kl/bases_rd/startup.ini
4/8/17 11:22 PM File updated /var/kl/bases_rd/verdicts.ini
4/8/17 11:22 PM File updated /var/kl/bases_rd/kavbase.mft
4/8/17 11:22 PM File installed /var/kl/bases_rd/rms-0607g.xml
4/8/17 11:22 PM File installed /var/kl/bases_rd/qscan-0607g.xml
4/8/17 11:22 PM File updated /var/kl/data_rd/u0607g.xml

And this is how I can tell it's (kinda) scanning. It always
finds my EICAR sample.

Objects Scan: completed 1 minute ago (events: 12, objects: 572879, time: 00:14:02)
4/8/17 11:57 PM Task completed
4/8/17 11:57 PM Untreated: EICAR-test-file sdb1/Downloads/uk.co.extorian.EICARAntiVirusTest.apk/classes.dex
4/8/17 11:57 PM Detected: EICAR-test-file sdb1/Downloads/uk.co.extorian.EICARAntiVirusTest.apk/classes.dex
4/8/17 11:57 PM Untreated: EICAR-Test-File sdb1/Downloads/uk.co.extorian.EICARAntiVirusTest.apk/assets/EICARAntiVirusTestFile.com
4/8/17 11:55 PM Detected: EICAR-Test-File sdb1/Downloads/uk.co.extorian.EICARAntiVirusTest.apk/assets/EICARAntiVirusTestFile.com

Paul

No possibility of going back to last year's image as when I redo my
flashdrive to get the latest defs I write over the .iso that I used
last.
So, looking around I found Kaspersky 2018 rescue disk. It's krd.iso.
They recommend you write the flash drive with Rufus, which I'd never
heard of. D/L'd it. They say make the flashdrive in iso mode which
sounded right. Takes forever to write it. When I turn the pc on with
that drive plugged into a usb port my machine freezes. Scary. They
said if there were 'booting problems' to try the 'dd' mode instead of
iso. Makeing the flashdrive that way it booted. The scan takes about a
minute for both OSs, so not as comprehensive as Rescue 10. Didn't find
anything. For that matter Rescue 10 didn't the last few times I ran
it. Looks like 2018 is a tool that is supposed to eeeeverything. Not
real impressed. What is dd?

John B. Smith wrote:


No possibility of going back to last year's image as when I redo my
flashdrive to get the latest defs I write over the .iso that I used
last.
So, looking around I found Kaspersky 2018 rescue disk. It's krd.iso.
They recommend you write the flash drive with Rufus, which I'd never
heard of. D/L'd it. They say make the flashdrive in iso mode which
sounded right. Takes forever to write it. When I turn the pc on with
that drive plugged into a usb port my machine freezes. Scary. They
said if there were 'booting problems' to try the 'dd' mode instead of
iso. Makeing the flashdrive that way it booted. The scan takes about a
minute for both OSs, so not as comprehensive as Rescue 10. Didn't find
anything. For that matter Rescue 10 didn't the last few times I ran
it. Looks like 2018 is a tool that is supposed to eeeeverything. Not
real impressed. What is dd?

dd is Disk Dump.

When a supplier makes a "Hybrid ISO", you can
do a sector-by-sector copy of it to a USB stick
and it will boot. A caring supplier will round the
size of the ISO to a multiple of 1048576, to make
it easier to copy.

dd if=new.iso of=/dev/sdc bs=1048576 count=300

That would copy a source file which was 314,572,800 bytes
to a USB stick. The USB stick is the /dev/sdc thing and
starts at sector 0 of the USB key.

In windows country, we've got this one, a "dd.exe".

http://www.chrysocome.net/dd

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

dd --list

\\?\Device\Harddisk1\Partition0
link to \\?\Device\Harddisk1\DR2
Removable media other than floppy. Block size = 512

Normally there is also a size parameter, so you know
how big the device is.

"Partition0" is a pointer to sector 0 and allows
writing the entire device from end to end.

"Partition1" is the area defined by the first
partition you created on the device. If you simply
wanted to zero out the first partition, that pointer
is the way to do it.

To transfer our new.iso to the USB key, assuming the USB
key is listed as Harddisk1, we would use:

dd.exe if=new.iso of=\\?\Device\Harddisk1\Partition0 bs=1048576 count=300

And that would transfer the 314,572,800 byte ISO to the key.

The Block_Size argument is normally some mulltiple
of a 512 byte sector, but there are other possibilities.

In Linux, programs like gddrescue ("ddrescue"), they
have a max_block_size, and the program "auto-adjusts"
to copy the entire source item as efficiently as possible.

Whereas the earlier versions of "dd", the user is
expected to do some math.

You might ask, why not do it this way ?

dd.exe if=new.iso of=\\?\Device\Harddisk1\Partition0 bs=512

Yes, the "dd" program can detect the end of storage media.
It doesn't need a count. However, the dd.exe version has
a small bug, where it can't detect the end of USB sticks
(at least, as a source device). I don't know if the USB key
as destination is detectable or not.

The choice of bs=512, makes the program go no faster than
13MB/sec. If you use bs=1048576, for a lot of storage
devices it can go faster. The break point for a number
of modern hard drives, is bs=8192, which means the hard
drive cache works well enough, that a block size that
small will allow the entire available disk bandwidth
to be used. But a block size of 512 causes indigestion
for most modern devices.

The default bs is 512. So this is the same as the previous command.

dd.exe if=new.iso of=\\?\Device\Harddisk1\Partition0

I use the Linux "factor" program, if I have a storage
device size on hand, and I want to see which power-of-two
numbers might divide into the device size.

The main web page for dd.exe, covers "seek" and "skip". The units
of seek and skip are "block size" chunks, so some compromises
may be needed, to seek/skip to just the right offset, as well
as select an efficient transfer size. The seek and skip
are functions you don't need today, but with those, you can
do a kind of cheesy "partition management", and build your
own disk images, a partition at a time.

You need a good head for math. And a copy of ptedit32 wouldn't
hurt either, if doing partition management in hand-to-hand
combat is your thing.

If you have Windows 10, you can run the Bash shell, and
a copy of "factor" will be available in there. To help with
some of the math.

The Bash shell in Windows 10 has "dd", but the Bash shell
doesn't allow lowest level access to disks, so you cannot
target /dev/sdc like targets from there. That won't work.
The chrysocome version of dd.exe is the one to get. The
syntax is ugly, but "dd --list" will show prototypes
of disk identifiers for you to copy.

Paul

On Mon, 28 May 2018 16:57:17 -0400, Paul
wrote:

John B. Smith wrote:


No possibility of going back to last year's image as when I redo my
flashdrive to get the latest defs I write over the .iso that I used
last.
So, looking around I found Kaspersky 2018 rescue disk. It's krd.iso.
They recommend you write the flash drive with Rufus, which I'd never
heard of. D/L'd it. They say make the flashdrive in iso mode which
sounded right. Takes forever to write it. When I turn the pc on with
that drive plugged into a usb port my machine freezes. Scary. They
said if there were 'booting problems' to try the 'dd' mode instead of
iso. Makeing the flashdrive that way it booted. The scan takes about a
minute for both OSs, so not as comprehensive as Rescue 10. Didn't find
anything. For that matter Rescue 10 didn't the last few times I ran
it. Looks like 2018 is a tool that is supposed to eeeeverything. Not
real impressed. What is dd?

dd is Disk Dump.

When a supplier makes a "Hybrid ISO", you can
do a sector-by-sector copy of it to a USB stick
and it will boot. A caring supplier will round the
size of the ISO to a multiple of 1048576, to make
it easier to copy.

dd if=new.iso of=/dev/sdc bs=1048576 count=300

That would copy a source file which was 314,572,800 bytes
to a USB stick. The USB stick is the /dev/sdc thing and
starts at sector 0 of the USB key.

In windows country, we've got this one, a "dd.exe".

http://www.chrysocome.net/dd

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

dd --list

\\?\Device\Harddisk1\Partition0
link to \\?\Device\Harddisk1\DR2
Removable media other than floppy. Block size = 512

Normally there is also a size parameter, so you know
how big the device is.

"Partition0" is a pointer to sector 0 and allows
writing the entire device from end to end.

"Partition1" is the area defined by the first
partition you created on the device. If you simply
wanted to zero out the first partition, that pointer
is the way to do it.

To transfer our new.iso to the USB key, assuming the USB
key is listed as Harddisk1, we would use:

dd.exe if=new.iso of=\\?\Device\Harddisk1\Partition0 bs=1048576 count=300

And that would transfer the 314,572,800 byte ISO to the key.

The Block_Size argument is normally some mulltiple
of a 512 byte sector, but there are other possibilities.

In Linux, programs like gddrescue ("ddrescue"), they
have a max_block_size, and the program "auto-adjusts"
to copy the entire source item as efficiently as possible.

Whereas the earlier versions of "dd", the user is
expected to do some math.

You might ask, why not do it this way ?

dd.exe if=new.iso of=\\?\Device\Harddisk1\Partition0 bs=512

Yes, the "dd" program can detect the end of storage media.
It doesn't need a count. However, the dd.exe version has
a small bug, where it can't detect the end of USB sticks
(at least, as a source device). I don't know if the USB key
as destination is detectable or not.

The choice of bs=512, makes the program go no faster than
13MB/sec. If you use bs=1048576, for a lot of storage
devices it can go faster. The break point for a number
of modern hard drives, is bs=8192, which means the hard
drive cache works well enough, that a block size that
small will allow the entire available disk bandwidth
to be used. But a block size of 512 causes indigestion
for most modern devices.

The default bs is 512. So this is the same as the previous command.

dd.exe if=new.iso of=\\?\Device\Harddisk1\Partition0

I use the Linux "factor" program, if I have a storage
device size on hand, and I want to see which power-of-two
numbers might divide into the device size.

The main web page for dd.exe, covers "seek" and "skip". The units
of seek and skip are "block size" chunks, so some compromises
may be needed, to seek/skip to just the right offset, as well
as select an efficient transfer size. The seek and skip
are functions you don't need today, but with those, you can
do a kind of cheesy "partition management", and build your
own disk images, a partition at a time.

You need a good head for math. And a copy of ptedit32 wouldn't
hurt either, if doing partition management in hand-to-hand
combat is your thing.

If you have Windows 10, you can run the Bash shell, and
a copy of "factor" will be available in there. To help with
some of the math.

The Bash shell in Windows 10 has "dd", but the Bash shell
doesn't allow lowest level access to disks, so you cannot
target /dev/sdc like targets from there. That won't work.
The chrysocome version of dd.exe is the one to get. The
syntax is ugly, but "dd --list" will show prototypes
of disk identifiers for you to copy.

Paul

I tried writing the iso I downloaded for the latest Rescue 10 with
Rufus, using the dd mode. This does at least complete without
objection. When I tried booting the flashdrive it started then hung up
after I chose Graphic mode. Maybe the math you talked about was wrong,
maybe there was something wrong with the Rescue 10 iso I downloaded
twice. I'll try downloading it again in a week or so, see if anything
has improved.

On Mon, 28 May 2018 19:57:39 -0400, John B. Smith
wrote:

maybe there was something wrong with the Rescue 10 iso I downloaded
twice. I'll try downloading it again in a week or so, see if anything
has improved.

Check the MD5 after downloading. Though MD5 is relatively easy
to forge:

https://support.kaspersky.com/4162

They ought to supply SHA 256 or SHA512 as well as the MD5.
Strange for a firm that is supposed to be proficient in security.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012

On Tue, 29 May 2018 16:25:54 -0300, Shadow wrote:

On Mon, 28 May 2018 19:57:39 -0400, John B. Smith
wrote:

maybe there was something wrong with the Rescue 10 iso I downloaded
twice. I'll try downloading it again in a week or so, see if anything
has improved.

Check the MD5 after downloading. Though MD5 is relatively easy
to forge:

https://support.kaspersky.com/4162

They ought to supply SHA 256 or SHA512 as well as the MD5.
Strange for a firm that is supposed to be proficient in security.


Hum, the MD5 link came up 404. Never done that before.

Weird.
The last ISO I downloaded (a couple of days ago) has the
following checksums:

MD5: 9F617FD4573CAAC2DEFC69017DB4234C
SHA-1: D7B6B15E1DBA821E89A439B962357214DADF0995
SHA-256:
DBDA178E1CD89DBC47E8B7304A1AF5B9F52B7D8BC8DA7DD25F AC080E8C60E4CE

Anyone confirm those numbers ?

Opening the ISO with 7-Zip:

krd_bases_timestamp.txt is 201805170648

Which is strange, because the previous version always had the
latest signatures. This one apparently needs updating before use.
[]'s

PS alt.comp.anti-virus added, where it's more appropriate.



--
Don't be evil - Google 2004
We have a new policy - Google 2012

On Tue, 29 May 2018 16:25:54 -0300, Shadow wrote:

On Mon, 28 May 2018 19:57:39 -0400, John B. Smith
wrote:

maybe there was something wrong with the Rescue 10 iso I downloaded
twice. I'll try downloading it again in a week or so, see if anything
has improved.

Check the MD5 after downloading. Though MD5 is relatively easy
to forge:

https://support.kaspersky.com/4162

They ought to supply SHA 256 or SHA512 as well as the MD5.
Strange for a firm that is supposed to be proficient in security.
[]'s
thanks for that link it says
"Kaspersky Rescue Disk 10 is no longer supported. use Kaspersky2018."
The 2018 version scans the OS so fast I wonder if the definitions are
even included with it. I can't see any place to download them once you
boot the disk.

On Wed, 30 May 2018 18:54:51 -0400, John B. Smith
wrote:

On Tue, 29 May 2018 16:25:54 -0300, Shadow wrote:

On Mon, 28 May 2018 19:57:39 -0400, John B. Smith
wrote:

maybe there was something wrong with the Rescue 10 iso I downloaded
twice. I'll try downloading it again in a week or so, see if anything
has improved.

Check the MD5 after downloading. Though MD5 is relatively easy
to forge:

https://support.kaspersky.com/4162

They ought to supply SHA 256 or SHA512 as well as the MD5.
Strange for a firm that is supposed to be proficient in security.
[]'s
thanks for that link it says
"Kaspersky Rescue Disk 10 is no longer supported. use Kaspersky2018."
The 2018 version scans the OS so fast I wonder if the definitions are
even included with it. I can't see any place to download them once you
boot the disk.

Yes, they changed it after I last accessed it.
It now points to:

https://support.kaspersky.com/14221

And although it says you can boot it from a USB (in system
requirements), they don't tell you how to.
The old link to the Rescue2usb utility has been removed.
Sh*tty support ....
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012