#2272 Kaspersky cannot start if modified windows dll is placed under Product installation folder
-
Rejected
Reproduction steps:
1 disable selfprotect and turn on traces
2 find version.dll under %sys64wow% and use a special tool to modify its MD5, the dll file lost its digital signature but still functional
3 place the modified dll under K's program folder and try run the product
Actual result:
product will not start using any method, starting service or avpui.
Expected Result:
product will detect the fact that the modified dll has no digital signature and:
go to %syswow64% to find another dll, than load the dll so that the product start up properly
OR
popup message that telling user that certain file is missing or corrupted. Alert the user that reinstallation is required.
I uploaded traces and video
System Settings
Operating system: Win 10, x64
System: DELL XPS13 9380
Product: KIS
Product Version: 21.0.44.1537
Language: zh-CN
Product Logs: https://cloud.qainfo.ru/s/y46vOZ1aDQfxIXt
-
I have conduct more tests and find that the product still can not load even if the dll file I placed under its program folder never modified.
Reproduce steps:
1. stop selfprotect and place the Unmodified dll file under K's program folder
2. re-enable selfprotect than exit and restart the product
Actual result:
the product will not start up by double click avpui.exe and desktop shortcut;
only avp.exe can be start up by starting the Kaspersky antivirus service manually in computer management console.
It is no different whether you have re enable selfprotect or not. In traces, I tried both situation and found it out.
Expected result:
by double click desktop shortcut, the product should load the unmodified dll in its program folder and successfully start up its GUI and service.
traces:
https://cloud.qainfo.ru/s/WynbDMIN0bPt3vd
-
As shown below and my test in the topic
cyber criminal may hijack a ARK tool to drop modified windows file into Kaspersky's program folder easily, with self defense still on.
after user's device restarted, kaspersky cannot start up at all.
-
Hi, sir! This is not bug for beta forum. I sent your information to my colleagues who work with our protection system. 1) about your scenario - when you start with "turn off self defense" it is not proper scenario. We don't provide defence for users who switch off main functions. 2) about file shredder - it works through drivers and nothing can block it =(
-
