Dump/crash during KVRT vs Malware.

I installed some malware, ran KVRT -> it wanted a reboot.

After the reboot i started the scan thats when KVRT crashed.

I restarted kvrt and it removed all Malware with a couple scans.

https://cloud.qainfo.ru/s/jRDRHkbMohqVE5c

Hi Yury,

System Analyze Scan and System full scan worked fine on my main system, no problems so far. Might run some more test later.

Hi,

today i booted up and KTS reported damaged components.

I run an update, when th update finished, KTS crashed an rebooted.

I send the dump to the server.

VMWare Worktation 15 Player:

Windows 10 Enterprise 2004

19041.508

KES 11.5.0.536

APPLICATION_HANG_c0000194_avp.exe!mainEECStartup

Reproduction steps:

i set up KES vs Malware.

1. I turned off file threat protection and HIPS.
2. i unpacked the malware and started all malware files
3. during that the running KES parts started to detect several of the malware.
4. The virtual system started to slow and hang here and there i think thats when the dump was created
5. then it suddenly was running normal again i finished starting all malware files
6. i did the recommended disinfection process.

Actual result:

KES crashed and restarted and continued to process the malware it found

Expected Result:

no crash

VMWare Worktstation Player 15:

Windows 10 x64

KES 11.5.0.536 AES 256

Reproduction steps:

Settings -> Web Control -> Rules diagnostics

Try to change any rules or set any of them up. No changes will prompt a save changes-> I cant setup any rules.

Actual result:

no changes will be saved, no prompt to save changes will come up.

Expected Result:

Changes in settings will prompt me to click on save and confirm changes.

@jarvis

Hi, seems to be working correctly now with the new version. Issue can be closed.

VMWare Worktation 15 Player:

Windows 10 Pro 2004

19041.508

KES 11.5.0.491

APPLICATION_FAULT_42849fd0_traffic_processing.dll!Unknown

Reproduction steps:

every time i start KES in my virtual machine i get this dump

second example: https://cloud.qainfo.ru/s/qAOKuZ7LPfaf9Os

VMWare Worktation 15 Player:

Windows 10 Pro 2004

19041.508

KES 11.5.0.491

Reproduction steps:

sometimes when i changed settings, file threat protection and device control in my case the gui can freeze. I had two cases where the gui froze and i could kill the process because it wasnt responding.

Actual result:

GUI froze setting changes where saved

Expected Result:

setting changes where saved

second traces example: https://cloud.qainfo.ru/s/HbrA6NkrnJfdYFH

Hi,

Yes.

Webcontrol Rules diagnostics wont prompt a save and wont save either for example.

Do you need any traces? Or other kind of infos?

Real system:

Windows 10 x64 2004

Version: 19041.450

KES 11.5.0.373 (Windows)

APPLICATION_FAULT_42849fd0_app_core_legacy.dll!Unknown

Reproduction steps:

i exited KES over the symbol on the bottom right waited a minute or two then restarted KES and got the dump

I think the issue was that KES didnt properly stopped the running processes.

Actual result:

KES didnt close processes correctly -> didnt restart

Expected Result:

KES restarted