[Topic 270118]

Kaspersky Virus Removal Tool Help

Getting started

Run the application without installing.

Hardware and software requirements

Check supported operating systems.

Quarantine

The application places detected objects in isolated storage.

Monitoring and reports

• Application performance report.
• System report.
• Traces and dumps.
  
  

Command line

Manage the application from the command line.

[Topic 269439]

About

Main functionality of Kaspersky Virus Removal Tool:

[Topic 269440]

Hardware and software requirements

You can use Kaspersky Virus Removal Tool on a computer that satisfies the following requirements:

Minimum hardware requirements

• Hard drive: 1 GB of free space
• CPU: Intel Pentium 1 GHz or higher
• RAM: 1 GB
• Internet connection

Minimum software requirements

The application supports the following 64-bit operating systems for the x86_64 architecture:

• AlmaLinux OS 8 or later
• AlterOS 7.5 or later
• Astra Linux Common Edition 2.12 or later
• CentOS 6.7 or later
• Debian GNU/Linux 10.0 or later
• EulerOS 2.0 or later
• Linux Mint 19.2 or later
• openSUSE Leap 15.0 or later
• Oracle Linux 7.3 or later
• Red Hat Enterprise Linux 6.7 or later
• Rocky Linux 8.5 or later
• SUSE Linux Enterprise Server 12.5 or later
• Ubuntu 12.04 or later
• Uncom OS Home / Business / Education / Enterprise 2.2 or later
• ALT Linux Workstaton / Workstation K / Server / Education 8 or later
• ROSA Linux Workstation / Server 12 or later
• RED OS 7.3 and later

[Topic 271278]

Permissions for running the application

You can run Kaspersky Virus Removal Tool as superuser (root) or as a regular user. To use the application as a regular user, you must run the application on the command line with the --allowuser option.

When running the application as a regular user, Kaspersky Virus Removal Tool works in a limited mode. In limited mode, Kaspersky Virus Removal Tool may lack access rights to system memory, boot sectors, and other important areas. Kaspersky Virus Removal Tool may also lack write permissions to disinfect or delete detected objects. Disinfecting or deleting such objects will cause an error. Therefore, for a high level of protection, run the application as superuser (root). You can use a regular user account to scan, for example, individual user-owned directories or connected USB drives.

Limited mode

[Topic 269465]

Running the application

Kaspersky Virus Removal Tool does not require installation. We recommend quitting all active applications before running Kaspersky Virus Removal Tool.

Running the application involves the following steps:

1 Downloading the application file

Download the application file from the Kaspersky official website and save the file on your local disk, for example, in the ~/Downloads directory.

2 Granting the execute permission

To make the application file executable using the graphical user interface:

1. Run your file manager and change to the directory with the kvrt.run application file.
2. Right-click the file to display the context menu and go to file properties.

   

   Context menu of the file

3. In file properties, select the access permissions section. Depending on your operating system, this section can have different names, such as Permissions, Access rights, Discretionary attributes, etc.
4. Allow running the file as an application. Depending on your operating system, this setting can have different names, such as Allow executing file as program, Executable as program, Execute, etc.

   

   File properties

If you cannot make the file executable using the GUI, you can use the command line.

To make the application file executable using the command line:

1. Run the Terminal application or its equivalent.
2. Change to the directory with the kvrt.run application file:

   cd ~/Downloads

3. Run the following command to grant the execute permission:

   chmod +x kvrt.run

3 Running the application file

To run the application file using the graphical user interface:

1. Right-click the file to display the context menu and select the command to run the file as an application. Depending on your operating system, this menu item can be named, for example, Run as a program, etc.

   

   Context menu of the file

2. If you cannot run the file as an application, try running the application by double-clicking the file icon. The operating system may prompt you to confirm the execution of the file. In some operating systems, double-clicking the file icon opens the text editor instead of running the application.

If you cannot run the application file using the GUI, you can use the command line.

To run the application file using the command line:

1. Change to the directory with the kvrt.run application file:

   cd ~/Downloads

2. Run the application file:

   ./kvrt.run

   

   Running the application in Terminal

The application prompts you to enter your password to run the application as superuser (root).

Superuser password prompt

The application unpacks the necessary files into a temporary directory at /tmp/<random_character_sequence>. When the application is closed, the temporary directory is deleted. If you terminate the process of the application, the temporary directory is deleted when the computer is restarted. You can specify a different directory for saving temporary files on the command line (--target <directory_path>).

The application displays the End User License Agreement, the Privacy Policy, and the KSN Statement. Kaspersky Security Network (KSN) is an infrastructure of cloud services providing access to the online Kaspersky Knowledge Base that contains information about the reputation of files, web resources, and software. KSN participants receive information from Kaspersky and send Kaspersky information about objects detected on the user's computer to be analyzed additionally by Kaspersky analysts and to be included in the reputation and statistical databases.

Carefully read the terms and conditions of the agreements before you accept them.

After completing the initialization, the application displays the main window of Kaspersky Virus Removal Tool. The application may then request proxy server credentials to connect to the internet. Internet access is required to connect to the KSN and update anti-virus databases.

The application creates a directory in which it places its working files:

• /var/opt/KVRT2024_Data if the application was run by the superuser (root).
• /home/<user_name>/KVRT2024_Data if the application was run by an ordinary user.

If Kaspersky Virus Removal Tool fails to run, you can scan your computer using the Kaspersky Rescue Disk. Kaspersky Rescue Disk is an application that allows scanning your computer without booting an operating system. To use it, you must create a bootable USB drive or CD/DVD disk and boot your computer from the external media. Kaspersky Rescue Disk can be managed in the same way as Kaspersky Virus Removal Tool.

Main application window

[Topic 269444]

Scanning the computer

Kaspersky Virus Removal Tool can perform a standard scan of your computer. As part of this scan, the application scans system memory, startup objects, and boot sectors of your computer for viruses and other malware. Kaspersky Virus Removal Tool scans files of all formats, including the contents of archives. You can only run the scan manually. You cannot schedule the scan.

To scan your computer:

1. Run Kaspersky Virus Removal Tool.
2. Click Start scan.

   If necessary, edit the scan scope.

Kaspersky Virus Removal Tool scans your computer. When the scan is complete, Kaspersky Virus Removal Tool displays the results of the scan. The application also generates an application performance report.

Main application window

[Topic 270032]

No threats detected

If the scan does not detect infected or probably infected objects, the application displays scan results with general information.

Computer scan results

You can then click Details to see detailed scan results. By default, the application displays only warning and error events. To view the list of scanned files, select the Show informational messages check box.

Infected or probably infected objects not detected

[Topic 270033]

Object detected

If the scan detects infected or probably infected objects, the application displays information about such objects (see figure below):

• Object name
• File location
• Type of the detected object (for example, a virus)
• Threat level in accordance with the Kaspersky classification (high threat level highlighted in red, medium level in amber, and low in green)
• MD5 and SHA256 hashes (click ).

  

  Information about the detected object

Kaspersky Virus Removal Tool suggests an action to take on the infected or probably infected object:

• Skip.
• Copy to quarantine. Kaspersky Virus Removal Tool copies the object to quarantine. The original object is left in place and is not modified.

  Files in quarantine are archived in a way that prevents them from causing harm to the computer. After a file is quarantined, you can permanently delete or restore it.

• Disinfect. Kaspersky Virus Removal Tool attempts to disinfect the object. If the object cannot be disinfected, the application saves a copy in quarantine and deletes the object.
• Delete. Kaspersky Virus Removal Tool saves a copy in quarantine and deletes the object.
• Restore. Kaspersky Virus Removal Tool attempts to restore the object from backup.

You can select an action for each individual object or for all objects at the same time. For all objects, the application lets you perform neutralization. Neutralization involves applying actions in the following order:

1. Disinfection.
2. If the object cannot be disinfected, the application attempts to restore the object from backup.
3. If the object cannot be restored, the application deletes the object.

After processing the detected object, you can click Details to see detailed scan results. By default, the application displays only critical and important events. To view the list of scanned files, select the Show informational messages check box.

Computer scan details

[Topic 270034]

Active infection found

If the scan finds an active infection, the application displays a notification (see figure below). The application also starts a countdown for a decision to be made (120 seconds). After completing the decision countdown, Kaspersky Virus Removal Tool automatically attempts Advanced Disinfection. After completing Advanced Disinfection, Kaspersky Virus Removal Tool restarts the computer. You can try disinfecting the object without a restart. To do so, click Try to disinfect without computer reboot while the countdown is active.

For disinfecting an active threat, we recommend selecting disinfection with a computer restart. After restarting the computer, we recommend running the scan again.

Before Advanced Disinfection with a restart, you must close all applications to save your data and then click Disinfect and reboot the computer. If you need more time to close all applications and save your data, click the countdown counter. This pauses the countdown. Then you must select the Advanced Disinfection method: with or without a restart.

Notification about an active infection

[Topic 269992]

Custom scan

By default, the application scans system memory, startup objects, and boot sectors of the computer, that is, a Quick Scan is performed. You can define your own scan scope and, for example, perform a Full Scan or scan individual custom directories.

To define a custom scan scope and run the scan:

1. Run Kaspersky Virus Removal Tool.
2. Click Change settings.
3. Select check boxes next to objects you want to scan (see figure below):
   • System volumes — list of mount points recommended for scanning (for example, Downloads, Documents, Temporary files, etc).
   • All volumes — all mount points except service and network mount points. Service mount points include Pseudo File Systems such as sysfs, procfs and others.

   

   Editing the scan scope

4. Click Add object to manually add a directory to the scan scope.

   The application does not support masks.

5. Save the edited settings.

You can also start a custom scan on command line.

[Topic 270048]

Updating application anti-virus databases

If the anti-virus databases of the application are out of date, Kaspersky Virus Removal Tool displays a notification. To update application anti-virus databases, click Update now. The application starts your browser and begins downloading a new version of the application with the latest anti-virus database updates. Quit the previous version of the application and run the new version.

Notification about out-of-date anti-virus databases

The application displays the database release date in the About window.

Database release date

[Topic 270091]

Managing quarantine

Copies of deleted or disinfected files are placed in a special directory on your computer that is known as quarantine. Copies of files are stored in a special format that is not dangerous to your computer. You can restore a deleted or disinfected file from the backup copy stored in quarantine.

By default, the application uses the following quarantine directory:

• /var/opt/KVRT2024_Data/Quarantine if the application was run by the superuser (root).
• /home/<user_name>/KVRT2024_Data/Quarantine if the application was run by an ordinary user.

Files are stored in an encrypted form. File names have the kvrt*.klq format. Only the user that ran the application can access the files.

Quarantine

[Topic 269476]

Restoring an object that was deleted by a scan

If the application, when scanning your computer, deleted a file and you still need it, you can restore the file.

We recommend that you avoid restoring deleted or disinfected files because they may cause harm to your computer.

To restore an object from quarantine:

1. After the scan finishes, select the Quarantine tab.

   Kaspersky Virus Removal Tool displays a list of quarantined files.

2. Select the file that you want to restore.
3. Click Restore.

   

   Quarantine

[Topic 270014]

Clearing quarantine

To delete an object from quarantine:

1. After the scan finishes, select the Quarantine tab.

   Kaspersky Virus Removal Tool displays a list of quarantined files.

2. Select the object that you want to delete.
3. Click Delete.

   

   Quarantine

[Topic 270100]

Monitoring the application

Kaspersky Virus Removal Tool provides the following monitoring functionality:

• Application performance report.

  Kaspersky Virus Removal Tool constantly generates reports about its performance. Reports are available in the user interface of the application and as files in the application directory.

• System report.

  You may need the system report when contacting the virus laboratory of Kaspersky. You can generate this report using the System Analyzer utility.

• Application traces and dumps.

  You may need traces and dumps when contacting Kaspersky Technical Support.

[Topic 270026]

Application performance report

Kaspersky Virus Removal Tool generates reports of the following types:

• Standard report.

  A standard report includes warning and error events. This report is available in the user interface of the application. The application also creates report files in the directory of the application. For example, a report may contain information about starting and finishing a computer scan, actions that the application takes on detected objects, and so on.

• Detailed report.

  This report is only available as a file in the directory of the application. To enable detailed report generation, you must run a special command. The detailed report reflects all application events.

To enable the generation of detailed reports, run the following command:

./kvrt.run -- -details

To open the standard application performance report:

1. Run Kaspersky Virus Removal Tool.
2. Select the Reports tab.

The application displays reports grouped by date. The application also generates reports in the following directory:

• /var/opt/KVRT2024_Data/Reports if the application was run by the superuser (root).
• /home/<user_name>/KVRT2024_Data/Reports if the application was run by an ordinary user.

Files are stored in an encrypted form. You can view reports in the application interface only. To view reports in a text editor, you must run the application from the command line with the -dontencrypt option.

Standard report file names have the report_<date>_*.klr.enc1 format. Detailed report file names have the details_<date>_*.klr.enc1 format. The files are accessible to all users.

Application performance report

[Topic 269478]

System report

You can generate a system report using the System Analyzer utility. Information in the report is intended for Kaspersky virus analysts. If you suspect that your computer might be infected, this report may be necessary for analysis.

Utilities

To create a system report:

1. Run Kaspersky Virus Removal Tool.
2. Select the Utilities tab.
3. Double-click the System Analyzer icon.

   The application runs the System Analyzer utility.

4. Click Start scan.

As a result, the utility generates a system report in the following directory:

• /var/opt/KVRT2024_Data/Anomalies if the application was run by the superuser (root).
• /home/<user_name>/KVRT2024_Data/Anomalies if the application was run by an ordinary user.

File names have the *.txt format. Only the user that ran the application can access the files.

System Analyzer utility

[Topic 269479]

Collecting traces and dumps

If you have not found a solution to your problem in the application documentation, we recommend visiting our forum. After you explain your problem to Kaspersky experts, they may ask you to create a trace file and a dump file. The trace file allows tracing the process of performing application commands step by step and determining the stage of application operation at which an error occurs. A dump file contains all information about the working memory of Kaspersky Virus Removal Tool processes at the moment when the dump file was created. Kaspersky Virus Removal Tool creates dumps when the application quits unexpectedly.

To enable trace file collection, run the following command:

./kvrt.run -- -trace

You can also configure the trace level using the -tracelevel <level> option.

Next, you must reproduce the actions that led to the issue. As a result, Kaspersky Virus Removal Tool creates trace and dump files in the following directory:

• /var/opt/KVRT2024_Data/Traces if the application was run by the superuser (root).
• /home/<user_name>/KVRT2024_Data/Traces if the application was run by an ordinary user.

Files are stored in an encrypted form. Trace file names have the KVRT.<application_version>_<date>_<time>_*.log.enc1 format. Dump file names have the *.dmp.enc1 format. Only the user that ran the application can access the files.

[Topic 270485]

Managing the application from the command line

You can manage Kaspersky Virus Removal Tool from the command line.

[Topic 270483]

Managing the unpacker from the command line

The unpacker of Kaspersky Virus Removal Tool supports the following commands.

Command line options

[Topic 269475]

Managing the application from the command line

Kaspersky Virus Removal Tool supports the following management commands:

Command line options

[Topic 271028]

Requirements for the proxy server configuration file

Kaspersky Virus Removal Tool can automatically determine proxy server connection settings. If the application cannot connect to the proxy server automatically, you can specify connection settings using a configuration file. To do so, you must run the application on the command line with the -proxyconfig <file_path> option.

Configuration file requirements:

• File name — proxy.dat
• Encoding — UTF8 without BOM

  Syntax: server=<proxy_server_address> #For example, server=myproxy.com   port=<port> #For example, port=1122   username=<user_name> #For example, username=Fred   password=<password> #For example, password=1234

[Topic 269477]

Application data storage

After you quit the application, the KVRT2024_Data directory remains on your computer. By default, the application saves files in the following directory:

• /var/opt/KVRT2024_Data if the application was run by the superuser (root).
• /home/<user_name>/KVRT2024_Data if the application was run by an ordinary user.

The user is responsible for ensuring the security and controlling and restricting access to the information that is stored on the computer.

The KVRT2024_Data directory contains the following:

• The Quarantine directory contains quarantined files.

  Files can contain the following user data:

  • Object name
  • File location
  • Name of the user that ran the application

  Files are stored in an encrypted form. File names have the kvrt*.klq format. Only the user that ran the application can access the files.

• The Report directory contains application performance report files.

  Files can contain the following user data:

  • Locations of scanned files
  • Web page addresses that were found in scanned objects
  • Name of the user that ran the application

  Files are stored in an encrypted form. Standard report file names have the report_<date>_*.klr.enc1 format. Detailed report file names have the details_<date>_*.klr.enc1 format. Only the user that ran the application can access the files.

• The Traces directory contains trace and dump files.

  Trace files can contain the following general data:

  • Event time
  • Number of the execution thread
  • Application component that caused the event
  • Event severity (information, warning, critical, error)
  • A description of the application component command execution event and the result of the command

  In addition to general data, trace files may contain user data:

  • Personal information including the full name of the individual if such information is part of a path to a file on the computer
  • User account name if the user account name is part of a file name
  • Email address or web address containing a user account name and password if these are part of the name of a detected object
  • Remote IP addresses with which the computer established connections
  • Web addresses that are part of names of scanned objects

  If the application uses a proxy server, the trace files may contain the following data:

  • Proxy server address
  • Computer name
  • IP address and port of the computer
  • User name used to authorize at the proxy server

  Dumps store information about the working memory of processes at the moment the process crashes, and they may also contain personal information.

  Files are stored in an encrypted form. Trace file names have the KVRT.<application_version>_<date>_<time>_*.log.enc1 format. Dump file names have the *.dmp.enc1 format. Only the user that ran the application can access the files.

[Topic 272419]

Sources of information about the application

If you have questions about the application, you can discuss it with Kaspersky experts and fellow users on our forum.

On the user forum, you can read threads, post comments, and create new threads.

[Topic 270110]

Information about third-party code

Information about third-party code is contained in the legal_notices.txt file located in the KVRT2024_Data directory. The application creates a directory in which it places its working files:

• /var/opt/KVRT2024_Data if the application was run by the superuser (root).
• /home/<user_name>/KVRT2024_Data if the application was run by an ordinary user.

[Topic 269483]

Trademark notices

Registered trademarks and service marks are the property of their respective owners.

Pentium is a registered trademark of Intel Corporation in the U.S. and/or other countries.

Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.