Are those executables still in place and running in the background, or are they just ghost taskbar entries?
Just Ghost's. Removing the IconSream and PastIconStream values from:
- HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify
resolves the aforementioned footprint.
Apart from that, removing around 50 registry entries manually which Kaspersky creates does the last bit of cleaning.
The removal tool works best if you exit the running processes hidden in your Taskbar.
You have to remove the Total Security first, then after rebooting machine, run the removal tool a second time to remove the Secure Connection.
Something else I discovered was its rootkit tool corrupts the Restore Points, and prevents you creating a new restore point. Even attempting to restore via the Recovery Console fails. The logs mention it was unable to locate X file from D: - which is odd given in my case D partition is a HP Recovery Partition.
To be fair though I also updated Creator today thanks to the KB release in last 24 hours, so that combined with Kaspersky may have corrupted the Restore points, rather than just Kaspersky.
Interestingly, running an in-place upgrade still did not remove Kaspersky and the aforementioned footprint.
Everything had to be done manually within the Registry Editor.