You can easily download and add the kav_rescue_10.iso or krd.iso file to your E2B drive easily. Just copy it to the \_ISO\MAINMENU folder.
(Note: if using krd.iso, do not use parentheses ( ) or any other strange characters in the .iso filename - esp. when using agFM - 'Kaspersky' option to boot it).
Download
here.
Note: When converting to .imgPTN file for UEFI+MBR booting (do not add rEFInd, say
No to prompt:
'Timeout in 10 seconds (default=N )... AUTO-CORRECT? (Y/N) : ' to not Auto-convert .cfg files).
See new
Kaspersky Forum if any queries and Forum post
here.
When you first run it, you will want to update the virus definitions. When you do so however, it will store the updates on an internal hard disk of the
system that you booted the E2B USB drive from, instead of storing them on the E2B USB drive. This means that when you boot on a different system, you will have to download the updates all over again (if the system has an internet connection).
IMPORTANT: The key to the whole procedure is to ensure that Kaspersky linux mounts all the storage devices as volumes by selecting a drive to scan FIRST. This will not be done if you do not select a drive to scan when prompted, or if you use the 'Skip' button when prompted if the volume is 'dirty'.
 |
Allow it to mount the disks...
|
Once all the volumes have been mounted, you should see the icons on the Desktop - if not then it won't find the Updates on the USB drive and you will have to reboot!
 |
| Make sure you see desktop icons for the USB drive (e.g. sdb1). |
MBR-booting from krd.iso with persistence
The instructions to get persistent updates to stay on the E2B USB drive are:
1. Download a recent ISO file from
http://support.kaspersky.com/viruses/rescuedisk#downloads - it should be under '
Distributive' and called kav_rescue_10.iso or krd.iso.
2. Copy it to a menu folder, e.g. \_ISO\MainMenu folder (or \_ISO\ANTIVIRUS or any other menu folder where you want it to be listed).
Create an empty folder called "\Kaspersky Rescue Disk 10.0" on the E2B USB drive now.
Note: For krd.iso 2018 versions, the folder name has changed to \KRD2018_Data. Use this exact name and exact capitalisation.
3. Boot from the ISO menu entry. Ensure that your USB drive (sdb1) volume has been mounted and appears as an icon on the Desktop as well as the C: drive icon (don't abort any dialogs!). If they are not there then reboot and try again.
On first boot to Kaspersky from E2B using this menu, download the updates (you will obviously need an internet connection). They will usually be automatically stored on internal Hard Disk C: by Kaspersky but if it finds the "\Kaspersky Rescue Disk 10.0" folder on the E2B drive, it may copy the updates there instead.
4. When the download of the updates have finished, if the USB \Kaspersky Rescue Disk 10.0 folder is empty,
copy the whole "\Kaspersky Rescue Disk 10.0" folder which now contains the updates from C: or sda1 (the internal HDD) to sd
x1 which is the USB drive partition 1 (if you only have one hard disk, the USB drive will be sdb1).
Now rename the "C:\Kaspersky Rescue Disk 10.0" folder on the hard disk to something else like 'Junk' to get rid of it.
IMPORTANT: Ensure the update folder \Kaspersky Rescue Disk 10.0 does NOT exist on the Target hard disk in
any volume. It must
only exist on the E2B USB drive, otherwise it may update the wrong folder.
5. On the next boot, the updates should be found to be already present on USB drive (check you can see the drive icon on the Desktop).
Checks
If you find that the Updates are old or not present...
1. Ensure you can see the
sdx1 icon on the Desktop to show it has been mounted as a volume by Kaspersky.
2.
Ensure any target system you test does not already have the \Kaspersky Rescue Disk 10.0 folder anywhere on any HDD in the system - if so delete it and reboot from USB.
Always shutdown Kaspersky linux nicely or updates may not be saved!
E2B USB Drive contents when it is all running smoothly are:
\_ISO\MAINMENU\kav_rescue_10.iso
\Kaspersky Rescue Disk 10.0 (or \KRD2018_Data) for 2018+ versions.
Kaspersky 2018 with UEFI (using a two-partition E2B drive)
Converting the ISO to a FAT32 .imgPTN file is easy, however the
\KRD2018_Data folder is not found by Kaspersky Rescue if it is in the boot partition, so we cannot simply create this folder inside the new .imgPTN partition (but see section below if you want to do this).
Create or use the second partition of the E2B drive which should have at least 1GB of
free space available or else it will not be used (exact size TBD - it works if 4.1 GB free on a 7GB volume).
Then simply create an empty
\KRD2018_Data folder on the 2nd partition of the E2B drive and use a .
imgPTN23 file extension for the krd imgptn file.
IMPORTANT: For UEFI booting press '
N' for No' when prompted by MakePartImage to AUTOCORRECT the .cfg files because the EFI boot files are signed.
Use Switch_E2B.exe to switch to the
krd2018.imgptn23 file
.
Edit the \menu.lst file (the large on inside the large .imgPTN file) to add these lines to the bottom of the file:
#use lang=ru for russian
title KAV 32-bit\nBoot to Kaspersky Rescue
kernel /boot/grub/k-x86 net.ifnames=0 lang=en dostartx backstore=alldev
initrd /boot/grub/initrd.xz
boot
title KAV 64-bit\nBoot to Kaspersky Rescue
kernel /boot/grub/k-x86_64 net.ifnames=0 lang=en dostartx backstore=alldev
initrd /boot/grub/initrd.xz
boot
The two partitions on the E2B drive should now be:
Partition 1: Contains a \boot folder and \System folder + other E2B files + \menu.lst (modified)
Partition 2: Contains empty \KRD2018_Data folder
Now you can UEFI or MBR boot (using the new menu entries) and ensure you have an internet connection so that it can download the latest updates. Check that there are now files in the \KRD2018_Data\Bases folder...
If updates do not appear to be persistent, delete any folder on any drive named
\KRD2018_Data except for the folder on the second partition of the E2B USB drive.
You can use the terminal command:
find / -name 'KRD2018_Data'
to find where the data files are located after updating/downloading the updates.
UEFI boot files
Recent Kaspersky 18 UEFI boot files and menus in the ISO are signed and checked (they have .sig files). If you modify the .cfg menu files then it will not UEFI boot. For this reason choose N = for do not AutoCorrect when prompted by MakePartImage when you make the .imgPTN file.
For E2B Fixed-disk USB drives only...
If your USB drive is a hard drive/fixed disk type, you will need to modify the kav-menu.cfg file for persistence, so to work around the signed file issue, find a Ubuntu 64-bit ISO and copy the files from the \EFI\BOOT folder to the same folder on the E2B drive thus overwriting \EFI\BOOT\bootx64.efi on the FAT32 partition. Just Ubuntu's bootx64.efi and grubx64.efi are required for UEFI64 booting.
You will need to modify \boot\grub\x86_64-efi\cfg\kav-menu.cfg to add the backstore=alldev cheat code for persistence to work if you are booting from a USB hard disk
kav-menu.cfg
menuentry "${kav}" {
linux /boot/grub/k-x86_64 net.ifnames=0 lang=${lang} dostartx backstore=alldev
initrd /boot/grub/initrd.xz
}
menuentry "${kav_nomodeset}" {
linux /boot/grub/k-x86_64 net.ifnames=0 nomodeset xforcevesa lang=${lang} dostartx backstore=alldev
initrd /boot/grub/initrd.xz
}
#menuentry "${kav_rescue_text}" {
# linux /boot/grub/k-x86_64 net.ifnames=0 lang=${lang} nox nomodeset
# initrd /boot/grub/initrd.xz
#}
menuentry "${hardware_info}" {
linux /boot/grub/k-x86_64 net.ifnames=0 lang=${lang} docache loadsrm=000-core.srm,003-kl.srm nox hwinfo docheck
initrd /boot/grub/initrd.xz
}
source /boot/grub/${grub_cpu}-${grub_platform}/cfg/boot_from_hard.cfg
Kaspersky 2018 UEFI & MBR + persistence
As found by Ahmed (see comments), if your E2B USB drive is of the
Removable type, you can create a persistent backup store using the Kaspersky linux script in the KRD Desktop Start Menu - System menu, but this does not work when booting from Fixed-disk USB drives (e.g. Corsair GTX, SilverStone M.2 or when using a VM under VirtualBox\QEMU where the USB drive appears as a Fixed-disk).
For persistence to work, you must use a Removable-type USB flash drive
unless you modify the .cfg menus...
Note: Only recent versions of KRD2018 include the 'Create persistent volume' menu feature.
1. Drag-and-drop the latest version of KRD2018 onto the MPI_FAT32 Desktop shortcut to create a
large .imgPTN file. I chose a size of
2200MB (or 3GB for safety) and a name of KRD2018_2019_08.imgPTNAUTO. You must allow enough free space for the updates (I found that 2000MB was not quite enough by about 16MB!).
Do NOT AUTO-CORRECT the configuration files when prompted by MakePartImage as this makes them unsigned.
2. Copy the krd.imgPTN23 file to your E2B \_ISO\ANTIVIRUS folder, make it contiguous and use SWITCH_E2B.exe to switch in the new partition.
If using a Fixed-disk E2B USB drive then do not use the CSM '1 Boot from this drive (MBR mode)' boot menu entry if you need persistence because it will not use the backstore=alldev cheat code and you will not get persistence if using a fixed-disk USB drive.
Instead, add the two new menu entries shown above to the E2B CSM \menu.lst file and the kav-menu.cfg file.
3. Now MBR-boot on a real system to the E2B Removable drive (do not use a VM unless you have the backstore=alldev cheat code in the menu).
4. Accept the licence agreements and perform an update if prompted.
5. Quit the AV scan.
6. Run
System - Create persistent volume from the Start Menu and create a krd.bs file of the suggested size - just follow the prompts (do not create a Backup as this will use up all the free space!).
There seems to be a problem with the suggested min and max sizes, so choose a size somewhere between the two limits suggested by the script.
7. You should be prompted to reboot - so do so.
8. You may see this message if the updates are not stored on a disk :-( ...
Now use the Terminal, you should see that the
mount command shows
/livemnt/boot is on your E2B USB drive...
and the backstore folder should be apparent...
UEFI-boot error when using Virtual Box?
Note: if testing using a Virtual Machine you may need to remove or rename the \System folder because some VMs UEFI-boot from this MAC UEFI boot folder instead of from the \EFI\boot folder.
This message can also indicate that you need to update the \EFI\boot folder with the Ubuntu EFI boot files as described above because one or more the .cfg files are not original (e.g. they have been edited or altered) and their signatures will no longer match.
KRD.ISO UEFI booting
From a fresh boot to agFM/grubfm/Ventoy or any grub2-based menu system - press TAB key and then c and type set check_signatures=no and then press ESC key and then select and load krd.iso.
Kaspersky signed files
If you are interested in why Kaspersky has added signed file checking (.sig files) for .cfg files, even for UEFI
unsecure booting, see
here.
