KVRT 2020 testing

Yury.Spravtsev

Hello!
<hr />
Beta testing of the KVRT 2020 utility is started.
<hr />
Build 20.0.5.0 is available at https://devbuilds.s.kaspersky-labs.com/kvrt/beta/20.0.5.0/kvrt.exe<a href="https://devbuilds.s.kaspersky-labs.com/kvrt/beta/20.0.3.0/kvrt.exe" target="_blank" rel="noopener"></a>
<hr />
<div>Notable changes in KVRT 2020 compared to KVRT 2015:</div>
<div></div>
1) Size of bases has been reduced.
2) Support for Microsoft Device Guard has been added.
3) System investigation log collection has been added similar to TDSSKiller ("Tools => System analyzer").
4) Bugfixes.
5) Only Win7, Win8, Win8.1, Win10 are supported. Windows Server 2008 R2, 2012, 2016, 2019.
<hr />
Traces enabled! They are located in the C:\KVRT2020_Data folder. Dumps also here. You can delete this folder after testing.
<hr />
What you should pay attention to when testing::
1) Crashes/freezes while scanning.
2) Crashes/freezes while system analyze the system.
3) Malware detection/cure.
4) Bugs in the interface.

If you find some bugs, please post bug description in this topic.
<hr />

Helios_07

Hi Yury,
System Analyze Scan and System full scan worked fine on my main system, no problems so far. Might run some more test later.

harlan4096

I also performed different KVRT scans in my system (with KTS2021MR2), working fine here...

I ran a System Scan but in Reports only appeared the time, no even inside, maybe by design...

Helios_07

Dump/crash during KVRT vs Malware.
I installed some malware, ran KVRT -> it wanted a reboot.
After the reboot i started the scan thats when KVRT crashed.
I restarted kvrt and it removed all Malware with a couple scans.
https://cloud.qainfo.ru/s/jRDRHkbMohqVE5c

Berny

KVRT 2020 running perfectly with KSCloud 21.2.16.590 (a) under W10.Can we download the latest KVRT 2020 version to obtain the latest Databases ?https://cloud.qainfo.ru/f/2878094

Yury.Spravtsev

@harlan4096 said in <a href="/post/11565" target="_blank" rel="noopener">KVRT 2020 testing</a>:
<blockquote>
I ran a System Scan but in Reports only appeared the time, no even inside, maybe by design...
</blockquote>
Report folder should open. There should be only one TXT file in the folder.

Yury.Spravtsev

@helios_07 said in <a href="/post/11569" target="_blank" rel="noopener">KVRT 2020 testing</a>:
<blockquote>I installed some malware, ran KVRT -> it wanted a reboot.</blockquote>
Please provide MD5 hashes of installed malware.

@helios_07 said in <a href="/post/11569" target="_blank" rel="noopener">KVRT 2020 testing</a>:
<blockquote>After the reboot i started the scan thats when KVRT crashed.</blockquote>
Malware injected to KVRT and crashed.

Berny

Hi Yuri,
No issues encountered with KVRT 2020

Yury.Spravtsev

Build updated!

Build 20.0.4.0 is available at <a href="https://devbuilds.s.kaspersky-labs.com/kvrt/beta/20.0.4.0/kvrt.exe" target="_blank" rel="noopener">https://devbuilds.s.kaspersky-labs.com/kvrt/beta/20.0.4.0/kvrt.exe</a>
<hr />
Please note that traces now located in C:\KVRT2020_Data\Traces folder.
<hr />

Virus_900 · KTS 21.2.16.590 with Patch B KVRT 20.0.4.0 Testing

Windows 10 Pro Build 19042 EN All update KVRT 20.0.4.0
Description:
Incorrect definition language product.
Reproduction steps:
<ol>
<li>Download KVRT.</li>
<li>Launched the product. </li>
</ol>
Actual result:
Language KVRT display to Russian and system to English.
Expected Result:
Language KVRT converge with system.

<img src="https://i.ibb.co/fFjkGXm/Screenshot-2020-12-30-202356.png" />

Trace to all
https://cloud.qainfo.ru/s/j8uUsG5Euiwvvwv

Yury.Spravtsev

@virus_900 said in <a href="/post/12068" target="_blank" rel="noopener">KVRT 2020 testing</a>:
<blockquote>
Windows 10 Pro Build 19042 EN All update KVRT 20.0.4.0
Description:
Incorrect definition language product.
Reproduction steps:
<ol>
<li>Download KVRT.</li>
<li>Launched the product. </li>
</ol>
Actual result:
Language KVRT display to Russian and system to English.
Expected Result:
Language KVRT converge with system.

</blockquote>
Please check your system locale. Seems it's "Russia".

Virus_900 · KTS 21.2.16.590 with Patch B KVRT 20.0.4.0 Testing

@yury-spravtsev said in <a href="/post/12100" target="_blank" rel="noopener">KVRT 2020 testing</a>:
<blockquote>
@virus_900 said in <a href="/post/12068" target="_blank" rel="noopener">KVRT 2020 testing</a>:
<blockquote>
Windows 10 Pro Build 19042 EN All update KVRT 20.0.4.0
Description:
Incorrect definition language product.
Reproduction steps:
<ol>
<li>Download KVRT.</li>
<li>Launched the product. </li>
</ol>
Actual result:
Language KVRT display to Russian and system to English.
Expected Result:
Language KVRT converge with system.

</blockquote>
Please check your system locale. Seems it's "Russia".
</blockquote>
Yes system locale install Russia thank you for help. :)

Yury.Spravtsev

Release Candidate available!
<hr />
Build 20.0.5.0 is available at https://devbuilds.s.kaspersky-labs.com/kvrt/beta/20.0.5.0/kvrt.exe
<hr />
Please note that traces disabled. Use "-trace" parameter for enable traces.

herbsandhealthy

Windows 10 Pro Build 19042 EN All update KVRT 20.0.4.0
Description:
Incorrect definition language product.
Reproduction steps:
<ol>
<li>Download KVRT.</li>
<li>Launched the <a href="https://herbsandhealthyproducts.com/" target="_blank" rel="noopener">product</a></li>
</ol>

murat5038

<a href="https://cloud.qainfo.ru/s/ykCSbld81Iy882B" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/ykCSbld81Iy882B</a>
The working file name appears to be incorrect. The wrong file is running.
<a href="https://cloud.qainfo.ru/s/ZODFYHy41OaUlWn" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/ZODFYHy41OaUlWn</a>
File description appears in task manager who worked as administrator.
<a href="https://cloud.qainfo.ru/s/v0sBxL9aqIw6VSg" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/v0sBxL9aqIw6VSg</a>
Running file name does not appear in the marked section.
<a href="https://cloud.qainfo.ru/s/hQb3ysNVHAxWHle" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/hQb3ysNVHAxWHle</a>
Folder image of the incorrectly running file.
<a href="https://cloud.qainfo.ru/s/91t0OmTUwTadwYt" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/91t0OmTUwTadwYt</a>
Although the given beta is up to date, it warns that "update now".
(It probably could be because it's beta.)

Yury.Spravtsev

@murat5038 said in <a href="/post/12536" target="_blank" rel="noopener">KVRT 2020 testing</a>:
<blockquote>
<a href="https://cloud.qainfo.ru/s/ykCSbld81Iy882B" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/ykCSbld81Iy882B</a>
The working file name appears to be incorrect. The wrong file is running.
<a href="https://cloud.qainfo.ru/s/ZODFYHy41OaUlWn" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/ZODFYHy41OaUlWn</a>
File description appears in task manager who worked as administrator.
<a href="https://cloud.qainfo.ru/s/v0sBxL9aqIw6VSg" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/v0sBxL9aqIw6VSg</a>
Running file name does not appear in the marked section.
<a href="https://cloud.qainfo.ru/s/hQb3ysNVHAxWHle" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/hQb3ysNVHAxWHle</a>
Folder image of the incorrectly running file.
</blockquote>
It's by design.

@murat5038 said in <a href="/post/12536" target="_blank" rel="noopener">KVRT 2020 testing</a>:
<blockquote>
<a href="https://cloud.qainfo.ru/s/91t0OmTUwTadwYt" target="_blank" rel="noopener">https://cloud.qainfo.ru/s/91t0OmTUwTadwYt</a>
Although the given beta is up to date, it warns that "update now".
(It probably could be because it's beta.)
</blockquote>
Fixed in release.

Yury.Spravtsev

KVRT 2020 was published! Build 20.0.6.0
<hr />
Documentation <a href="https://support.kaspersky.com/kvrt2020" target="_blank" rel="noopener">https://support.kaspersky.com/kvrt2020</a>
<hr />
Thank you all for participating!

Kaspersky EAP

KVRT 2020 testing