Just noticed that on my system too.

Sadly i dont have any traces aviable, but if i can provide any helpfull information just say the word

Helios_07 -> Yes

Hi,

Tried to reproduce that, but got only a few connection timeouts during the test, after the test was finished the ping went back to normal levels.

Also when i tried to refresh the Beta Forum page it timed out, but the other sites i had open worked normaly.

I tried to get the route print thing when the connection to the beta forum timed out.

I am not sure if thats what you are looking for but  here are the traces

https://cloud.qainfo.ru/s/bLQRAzXCtLa7fLZ

Great work everyone

Looking forward to next testing season

Virtual PC:

VMWare Workstation 15 Player

Windows 7 x64

KIS 20.0.14.1085 de app + drv verifier disabled

Reproduction steps:

I infected a virtual windows 7 with malware(https://cloud.qainfo.ru/s/6yMeb3AsvvrHkwL password: infected) i double clicked all files starting 2-u(from top of the list down to the last file starting with u) and gave it a little time to install.

Rebooted the virtual system and installed KIS, i think when KIS started after the installation those dumps where created.

KIS started after a while and began to desinfect the system.

EDIT: Reproduction with traces: https://cloud.qainfo.ru/s/FvbwZ8Gpyj47MXG

@harlan4096

It was hardened alot over the last years and you have to keep in mind that a malicious program still would have to go through most layers of protection from kaspersky before it can start a kernel driver and kill avp.exe.

The point is that you need a kernel driver to bypass selfdefense.

Trusted application mode, using an account with lower rights, User access control from windows or whatever its called, those are all good additional layer of protection against that.

@harlan4096

Thats because Process Hacker starts a kernel driver(which requires administrator rights by the way), said driver gives it elevated rights and so makes it possible to terminate avp.exe.

Thats always been possible, you can also use for example gmer anti-rootkit.

If you start Process hacker without Admin rights you wont be able to kill avp.exe.

You cant really protect against that as far as i know because that happens on kernel level.

First impression, runs well, havent encountered any problems yet

Windows 10 x64 Version: 1809

KTS 20.0.12.993 de app + drv verifier enabled

Unknown exception - code 42bf0cb1

Reproduction steps:

I startet Command and Conquer: Zero Hour in WinXP Service Pack 3 compatibility mode, when this dump was created.

Actual result:

Dump was created, game started

Windows 10 x64 Version: 1809

KTS 20.0.12.993 de app + drv verifier enabled

um:invalid_pointer_read_avrf_c0000005_am_core.dll!ekacreateobject

Reproduction steps:

I started the TAM activate and analyse all programs scan, a few min after i started the scan KTS crashed. Reproducable for me so far.

The same thing happens when i just click activate.

Actual result:

KTS crashed and restarted, TAM scan got canceled.

Expected Result:

TAM scan completes without problem.