Great work everyone

Looking forward to next testing season

Virtual PC:

VMWare Workstation 15 Player

Windows 7 x64

KIS 20.0.14.1085 de app + drv verifier disabled

Reproduction steps:

I infected a virtual windows 7 with malware(https://cloud.qainfo.ru/s/6yMeb3AsvvrHkwL password: infected) i double clicked all files starting 2-u(from top of the list down to the last file starting with u) and gave it a little time to install.

Rebooted the virtual system and installed KIS, i think when KIS started after the installation those dumps where created.

KIS started after a while and began to desinfect the system.

EDIT: Reproduction with traces: https://cloud.qainfo.ru/s/FvbwZ8Gpyj47MXG

@harlan4096

It was hardened alot over the last years and you have to keep in mind that a malicious program still would have to go through most layers of protection from kaspersky before it can start a kernel driver and kill avp.exe.

The point is that you need a kernel driver to bypass selfdefense.

Trusted application mode, using an account with lower rights, User access control from windows or whatever its called, those are all good additional layer of protection against that.

@harlan4096

Thats because Process Hacker starts a kernel driver(which requires administrator rights by the way), said driver gives it elevated rights and so makes it possible to terminate avp.exe.

Thats always been possible, you can also use for example gmer anti-rootkit.

If you start Process hacker without Admin rights you wont be able to kill avp.exe.

You cant really protect against that as far as i know because that happens on kernel level.

First impression, runs well, havent encountered any problems yet

Windows 10 x64 Version: 1809

KTS 20.0.12.993 de app + drv verifier enabled

Unknown exception - code 42bf0cb1

Reproduction steps:

I startet Command and Conquer: Zero Hour in WinXP Service Pack 3 compatibility mode, when this dump was created.

Actual result:

Dump was created, game started

Windows 10 x64 Version: 1809

KTS 20.0.12.993 de app + drv verifier enabled

um:invalid_pointer_read_avrf_c0000005_am_core.dll!ekacreateobject

Reproduction steps:

I started the TAM activate and analyse all programs scan, a few min after i started the scan KTS crashed. Reproducable for me so far.

The same thing happens when i just click activate.

Actual result:

KTS crashed and restarted, TAM scan got canceled.

Expected Result:

TAM scan completes without problem.

Real PC:

Windows 10 x64 Version: 1809

KTS 20.0.10.954 de app + drv verifier enabled

User Mode Write AV starting at crypto_ssl_1_1!OPENSSL_cleanse+0x0000000000000049

Reproduction steps:

I was playing a Starcraft 2 custom game, online against others, when the game lost connection.

After i closed the game i saw that KTS was crashing.

Firefox was running too, so not sure what the cause was.

When i tried to restart KTS, it crashed with same dumps.

EDIT: KTS wont start correctly anymore, it keeps crashing with those dumps. Will reinstall later today and see if that helps.

EDIT2: Managed to change traces to recommended before it crashed, so here are better traces from when i try to start KTS and it crashes again: https://cloud.qainfo.ru/s/weQE2MrYLQLIuDi

Real PC:

Windows 10 x64 Version: 1809

KTS 20.0.10.954 de app + drv verifier disabled

C++ EH exception - code e06d7363

Reproduction steps:

Not sure when this dump was created, i think it was around the time i canceled the activate and analyse all programms for TAM.

I think the dump is related to the TAM all programm analysis, during one analysis i got this dump again.