Posts made by Wesly.Zhang

Wow... Congratulations and see me in K 2021 testing!

Reproduction steps:

1. Right-click the product tray icon.
2. Tools --> Application Activity
3. Right-click any process to choose "Run sequence".
4. No "Run sequence" information display. 

Also, this behavior happened in HIPS popup window in "Run sequence" item.

Actual result:

There isn't display any information about  "Run sequence" of process.

Expected Result:

It should display "Run sequence" of process information correctly, or delete this item in GUI.

Password for access share: 35Hg

Repeat submission of the same problem. Close 

Reproduction steps:

1. collect traces or dumps.
2. Support --> Support Tools --> Send report to Technical Support.
3. confirm uncheck Operation system information, check Data received for analysis.
4. Select Save report to your computer. I choose to save the report to the Desktop.
5. Wait for processing to the end.

Actual result:

You find the zip file was been created in Desktop. But Suddenly disappeared after the process of saving report finished.

Expected Result:

zip file should be created correctly, could not be delete.

Here is the screen record video: https://cloud.qainfo.ru/s/2clvRhfDRrxmrhA    Access Password: Nw2m

Traces for access password: Wv28

@xzz123 said in [Web\_Antivirus\_give\_incorrect\_report\_'Clean Object Move to Quarantine'](/post/764): >

This problem also reproduce with 2019 patch(b)

Really? Oops...

Reproduction steps:  Two dumps after OS waking up

Dumps: https://cloud.qainfo.ru/s/Q9jeqEVdVUlIL6u       Access Password: C5q9

@helios_07

Yes, You are right, Me too, now. 

@xzz123

Yeah~ I see now. Sorry for my mistake. This issue happen on "Detected object" in Detail report. Ya... It seems AVP do not deal with some item and filter it.

When a threat local in the zip,rar,7zip or some compressed package (parent directory ), AVP don't process its log to filter/hide or improve the log event about the processing state of the thread in compressed package to list in Detected Object window. Maybe It is a beta version, So they haven't dealt with it yet.

15:08:09.326	0xa50	INF	SqliteDataDb	sqlite query processed: 'select "value","expirationTime","insertionTime" from "Data"  where "key" = x'010000008cb9fed65c02';'
15:08:09.326	0xa50	INF	SqliteCache	Value not found in cache
15:08:09.326	0xa50	ERR	amfcd	RollbackInfoManager::GetRollbackInfo: Unable to retrieve object from storage. Error code: 0x8000004c
15:08:09.326	0xa50	INF	amfcd	ThreatsManagement::GetThreatsByIDs: Threat: https://development56.baidupan.com/2018063016bb/2018/06/30/a1130b5f1df6829365e96162d69cace9.zip?st=XyfWJl_YHSw8cbaBzqQMnA&q=MEMZ.zip&e=1530349352&ip=124.79.173.114&fi=3943706&up= detect:  status: Clear object type: 0x0 rollback made: 0x0 couldBeRestored: 0x0, object size: 0x0, parent: 0x0
15:08:09.326	0xa50	INF	amfcd	RollbackInfoProvider::GetRollbackInfo: Enter. Threat 0x3
15:08:09.326	0xa50	INF	SqliteDataDb	sqlite query processed: 'select "value","expirationTime","insertionTime" from "Data"  where "key" = x'010000008cb9fed65c03';'
15:08:09.326	0xa50	INF	SqliteCache	Value not found in cache
15:08:09.326	0xa50	ERR	amfcd	RollbackInfoManager::GetRollbackInfo: Unable to retrieve object from storage. Error code: 0x8000004c
15:08:09.326	0xa50	INF	amfcd	ThreatsManagement::GetThreatsByIDs: Threat: https://development56.baidupan.com/2018063016bb/2018/06/30/a1130b5f1df6829365e96162d69cace9.zip?st=XyfWJl_YHSw8cbaBzqQMnA&q=MEMZ.zip&e=1530349352&ip=124.79.173.114&fi=3943706&up=//MEMZ/Geometry dash auto speedhack.bat detect: Trojan.BAT.Memz.b status: Untreatable object type: 0x0 rollback made: 0x0 couldBeRestored: 0x0, object size: 0x0, parent: 0x2
15:08:09.326	0xa50	INF	amfcd	RollbackInfoProvider::GetRollbackInfo: Enter. Threat 0x4

@xzz123

According to the traces, AVP collectly detected "http://bbs.huorong.cn/forum.php?mod=attachment&aid=MzIwNDF8YjZiMmFmN2J8MTUzMDI4MDQzMnwyNzA0N3w0NzcyMA%3D%3D//mv_sophia_docs/mv_sophia_docs.exe" as "Backdoor.Win32.Androm.qbms", But failed to deal with it. Does this issue only happened in "360Chrome/ 360极速浏览器" browsers?

21:54:34.677 0x8 INF aveng asl_trace: leave DetectReportPost Backdoor.Win32.Androm.qbms

21:54:34.677 0x8 INF aveng asl_trace: enter DetectProcessDone Backdoor.Win32.Androm.qbms

21:54:34.677 0x8 INF aveng asl_link: objId:0190a918

21:54:34.677 0x8 INF aveng asl_trace: leave DetectProcessDone Backdoor.Win32.Androm.qbms

21:54:34.677 0x8 INF aveng AVP !EMU (DT)

21:54:34.677 0x8 INF avs aveng Cancel (req) : 0x80000051

21:54:34.677 0x8 INF aveng USR CANCEL 0x80000051

21:54:34.677 0x8 WRN aveng PROC CANCEL: Usr

21:54:34.677 0x8 WRN aveng PROC EF:0x10000 Cnc

21:54:34.677 0x8 WRN aveng PROC ST:0x80000051

21:54:34.677 0x8 WRN aveng AM PROCESS_FINISH #0 !ERR:0x80000051

21:54:34.677 0x8 WRN aveng AM PROCESS_OBJECT_END #0 !ERR:0x80000051

21:54:34.677 0x8 WRN aveng AVP CANCELED

21:54:34.677 0x8 INF aveng AVP LEAVE http://bbs.huorong.cn/forum.php?mod=attachment&aid=MzIwNDF8YjZiMmFmN2J8MTUzMDI4MDQzMnwyNzA0N3w0NzcyMA%3D%3D//mv_sophia_docs/mv_sophia_docs.exe

Do you set some ignored message in KL Product settings? Restore all notification message in KL Settings and use IE browser to check this issue again.

Hello,

If you encounter a crash and bsod problem. you need provide Full memory dump file for bsod issue or crash process dump file for application crash issue even if problem that seems to be the the same as someone else described. This could let KL confirm the crash reason to improve its product. 

Else, in particularly, GUI/Help issue, You needn't provide the same issue. 

Regards.

@xzz123

If this behavior could be reproduced stably, Try to clear ichecker and iswift database. After do that, check again.

Settings -> Protection -> File-Antivirus -> Advanced settings -> uncheck ichecker and iswift technology-> recheck them.

@xzz123

Somethings wrong or ... I still doesn't  reproduce this behavior. Interesting......

Waiting for KL response.

Hi, @xzz123

I simple test this behavior, Nothing happened. Please PM the sample.

This link you have provided couldn't download the sample directly without registering.

Reproduction steps:

Open Main window. Run update or execute quick scan or any file scan task and turn back to main window.

It is better to deepen the progress bar.

Actual result:

progress bar is too light in green.

Expected Result:

Here we go~ 

Yes, At least, AVP needs to prompt the user to detect pup programs, whether they are automatically processed or not.

@panxi

Glad to meet you, man 

@ not inform me...