Posts made by Wesly.Zhang

congratulations! Cheer

Reproduction steps:

AVP do database update automaticlly --> crash suddenly.

Actual result:

Crash and restart itself. KIS convert to KFA and report License problem and ask for database updating.

Expected Result:

No crash.

Reproduction steps:

Create a folder in C:\new folder

right click it and select 'scan for virus.'

avp crash and reload it self.

Actual result:

avp crash

Expected Result:

scan can be done successful.

I am not sure that the reason for crash maybe is the same as #2342.

Congratulations!

Hi,

klhk.sys and klgse.sys located in C:\Program Files (x86)\Common Files\Kaspersky Lab folder is not signed, only use Kaspersky self signed certificate. Just link @xzz123 said, The driver loaded failed because of secure boot.

InstallDriversDeferred (38f4:2f60) [16:54:48:055]: A file copy 'C:\Program Files (x86)\Common Files\Kaspersky Lab\klgse\klgse_x64\klgse.sys'->'C:\Windows\system32\DRIVERS\klgse.sys' operation has started.

InstallDriversDeferred (38f4:2f60) [16:54:48:057]: A file copying 'C:\Program Files (x86)\Common Files\Kaspersky Lab\klgse\klgse_x64\klgse.sys'->'C:\Windows\system32\DRIVERS\klgse.sys' operation has ended.

InstallDriversDeferred (38f4:2f60) [16:54:48:058]: A subqueue 0 has ended.

InstallDriversDeferred (38f4:2f60) [16:54:48:059]: The queue has finished committing.

InstallDriversDeferred (38f4:2f60) [16:54:48:060]: StartService: 'klgse'

InstallDriversDeferred (38f4:2f60) [16:54:48:069]: Failed to execute driver package 'klgse.sys_x64'. Failed to start service: klgse Error 0x80070241.

InstallDriversDeferred (38f4:2860) [16:54:48:069]: Failed to start service: klgse Error 0x80070241.

MSI (s) (64!60) [16:56:15:416]: 应用程序: 卡巴斯基安全软件技术预览--错误27300。 安装驱动程序 klgse.sys_x64 时出错。错误码: -2147024319。<<29100>>

InstallDriversDeferred (38f4:2860) [16:56:15:417]: InstallDriversDeferred: finished. Return value 1603.

The download speed is the same as 56K moden from two mirror site. 

Small small speed.

Long Long time.

Let me shock.

Let me cry......

@ilya-zadonsky said in What's my post going on？:

Thank you, I'll analyze it.

I have solved the problem now. 

Let it go...

@dmitriy-pisarets said in Need some help with 2345SafeCenter:

@wesly-zhang, can you please check it with other antiviruses ? avast, nod, panda etc...

Hi,

Sure. Sorry for my delay. Some other its drivers are also been detected by microsoft.

2345Base.sys - Microsoft - PUA:Win32/2345Cn | SHA-256 3d9e93488d7ae760de63a13c4eba132b02236261e5512d7ee4a1ee7e7c761569

2345ExProtect.sys - Microsoft - PUA:Win32/2345Cn | SHA-256 66735892e6742efa89eb93363f06e220bf3c87626607f49b1908fba4ae6ecc22

2345Iron.sy - Microsoft - PUA:Win32/2345Cn | SHA-256 8d61e864702700ffa26e0621757fbee1f97359571a7710652f3dee9a3b992574

2345Misc.sys - Microsoft - PUA:Win32/2345Cn | SHA-256 c662e56c3dc2e9751bf0cff4c1bca61bd1c857de4317ef6da56b4c0b1d668737

2345NetMgr.sys - Microsoft - PUA:Win32/2345Cn | SHA-256 633e31ec8cd87c9bdbc563b9d9676c4b73eeffd9daa69fe84a1c5f2fce14d1fb

2345Prot.sys - Microsoft - PUA:Win32/2345Cn | SHA-256 987df613a7639cb64c823826b74832c5931f6ff02a7e1ff418040aa29389a42c

Now, Only Microsoft Defender detect its driver files as a adware. This is the result.

But its main executable file: 2345SafeTray.exe | SHA-256 92a26f8364f1b9ce1501941ce8b435cece7e40d6ce8131b1bf5a54a8e4a422e1 has been 8 AV solutions detected as adware.

Cylance Unsafe

Cyren W32/Trojan.LVBB-6338

ESET-NOD32 A Variant Of Win32/2345.H Potentially Unwanted

Fortinet Riskware/2345

K7AntiVirus Adware ( 0055ce2c1 )

K7GW Adware ( 0055ce2c1 )

Microsoft PUA:Win32/2345Cn

Sophos AV Generic PUA KH (PUA)

I use ESENT NOD32 Online scanner ( enable detect potential unwanted and unsafe applications ) to check all 2345 product folder. Here is the result:

Scan log: https://cloud.qainfo.ru/s/GKOLefB4xB9hhD7

I also use panda cloud cleaner and avast free antivirus. There is no any PUA detection, Maybe they don't know 2345 product.

@ilya-zadonsky said in What's my post going on？:

Thank you, I'll analyze it.

Now, I have a new post which has been flagged as spam by Akisment.com. What the hell? This post is in https://eap.kaspersky.com/topic/2001/need-some-help-with-2345safecenter.

@huang1111 said in KAV\\KIS\\KTS\\KFA\\KS\\KSOS: 21\.0\.37\.1270:

My download speed is only 3.2KB / s. Can you upload to https://send.firefox.com/ or https://cowtransfer.com/ for downloading in China?

Hello,

How about Mirror - 1 ？The download speed of this source is OK from my side "China telecom in Shanghai".

@dmitriy-pisarets said in Need some help with 2345SafeCenter:

Can also say, do other antivirus consider 2345 as malware or adware ?

I think Adware is more relevant. For this program, it has not reached the level of malicious programs.

You can ask your chinese colleagues about the evaluation of 2345 company.

@ilya-zadonsky said in What's my post going on？:

Hey, what message was marked as spam?

Hi,

Just like this.

https://wx2.sinaimg.cn/large/7e58f42agy1ga8oy8hn17j215h06v405.jpg

Hi,

Do someone could remove my post out to black list?

It told me my post:

ERROR

Post content was flagged as spam by Akisment.com

@huang1111 said in Need some help with 2345SafeCenter:

Hello, according to the tests of these days, Kaspersky does not seem to have any incompatibility issues with the 2345 Security Center application. They have not shown any obvious conflicts on one computer. However, at the same time, it is also regrettable that Kaspersky did not identify and block the pop-up advertisement module of the application.

Hello, huang1111

The same to me here. Do you try to run a malware in a controlled enviroment such as vmware to see whether KL product and 2345 application also report "found a malware" and process it without any problem at the same time or not. On my side, it seem that 2345 process malware speed is higher than KL product. It is not a problem, I think. But I take care their PDM model behavior: If I allow some malicous actions in 2345 proactive defense model ( 应用入口防护/Application Defense, 系统底层防护/System protection ), KL product could be blocked or detect it and countinue to handle it, which is the best important things, I think. Do you also test this way?

Regards.

There are two news published by huorong which is famous IT & Anti-virus company in china :

http://www.huorong.cn/info/151212805083.html

https://www.huorong.cn/info/1554067875200.html

These two news & malicous software analysis articles are very instersting.

@harlan4096 said in Need some help with 2345SafeCenter:

The link to download it is very slow here, not more than 12kbytes/seg... but stable downloading at 6 Kb/seg

Meanwhile, is it a real-time tool? then should be incompatible with Kaspersky or tagged as it?

Hello,

Let me share to you: https://cloud.qainfo.ru/s/NYwxIlz5ltc4xLT

This program doesn't have english or other languages GUI. I don't know this will lead to some problem or not when you install and operate it.

 QA: Is it a real-time tool？

Yes. It is. It could do some other things such as fix and install OS patch, System and registry junk file cleanup, etc.

QA：should be incompatible with Kaspersky or tagged as it?

My idea is that it is better to be compatible, this is a situation that everyone will happy. If there is a problem to see if it can be resolved through communication, it is really impossible from technology side and there is no way. Let it go~

Hello,

2345 Safe Center is not a independently installed program. It is inherited in 2345 safe guard program installation file. 2345 compared to Qihoo 360,——This brand is not well known in China , it can be said that it is very small. And this brand has been used for malicious promotion and bundled installation, which can be said to be notorious. I don't like this brand indeed.

The file you provided only has been detected by Microsoft as "PUA:Win32/2345Cn". I installed 2345 safe guard with KIS 2020. Now there is no problem has been found, Only a few popup window related to it push to display in the right corner. If I found somethings go wrong, I will reply here.

Regards.

@harlan4096 said in Need some help with 2345SafeCenter:

Hum this link is a compressed small file of 85Kb with file 2345Base.sys inside , so how can We test it?

Hi, Harlan4096

I think this driver is related to this software could be download from here: http://dl.2345.cc/2345pcsafe/2345pcsafe_v5.4.1.11945.exe. This software integrates avira scanning engine and have application control funciton.

Regards.

第6章 - 词汇及缩略语扩展

 

产品组件

 

• 反广告 = 是一个阻止广告信息呈现在浏览器页面或者内置到各种程序的接口并安装在您的计算机上用来显示在线内容的组件。
• 反钓鱼 = 跟踪试图打开钓鱼网站和阻止它们的组件
• 反垃圾邮件 = 允许检测不需要的消息（垃圾邮件）的组件
• AVZ = 用于解决系统问题的脚本
• 排除&信任区域 = 排除是被产品排除在扫描之外的对象。信任区域是用户创建的不应由产品控制的对象列表。
• GUI = 图形用户界面
• HIPS，应用程序控制 = 它记录系统中应用程序执行的操作，并根据应用程序所属的组管理应用程序的活动。为每组应用程序定义了一组规则的组件。
• IDS = 网络攻击拦截器
• IM AV = 扫描即时通讯工具（如ICQ、AIM等）流量的组件
• 安装程序 = 安装产品或应用程序的程序
• 邮件反病毒 = 扫描传入和传出的电子邮件，以确定是否存在恶意对象
• OAS = 文件反病毒（按访问扫描）
• ODS = 按需扫描
• PC，家长控制 = 家长监控孩子访问Internet的组件，用于限制对某些资源或特定url的访问。
• PDM = 主动防御
• Qscan，Rootkit scan = 扫描难以检测的隐藏其活动痕迹的威胁的技术
• 隔离 = 对象以加密形式保存的文件夹，排除了感染的威胁。它还存储消毒或删除之前创建的对象的备份副本。
• RD，救援盘 = 创建一个可引导磁盘的组件，该磁盘能够引导受到严重感染且无法通过反病毒程序消毒的计算机。
• Self-Defense，自我保护 = 根据用户意愿阻止关闭产品或更改设置的模块
• 安全键盘 = 使用硬件键盘输入个人数据（如密码或信用卡号码）的技术，同时避免被键盘记录程序（注册击键的程序）拦截监听（注册击键的程序）。
• 安全支付 = 在一个独立的环境中启动浏览器，以实现安全的在线支付。
• SW，系统监控 = 系统事件监视器。它收集和保存不同的事件日志，并将其提供给产品的组件，以便检测恶意软件特有的事件序列。
• Updater = 用于更新数据库或产品模块的模块
• VK，虚拟键盘 = 输入个人数据（如密码或信用卡号码）的特殊工具，以避免被键盘记录程序（注册击键的程序）截获。
• 漏洞扫描 = 扫描已安装程序中的漏洞
• Web AV，网页反病毒 = 扫描互联网流量的组件。
• WMUF = 危险url数据库

 

版本名称

 

• Build = 编译号码，也是产品版本的最后一个编号
• Alpha-version  = 产品开发的初始状态，可能会丢失大部分新功能
• Beta-version  = 具有完整功能并准备对各组件进行测试的版本
• RC, Release Candidate  = 可以成为发行版的版本
• TR，技术发布 = 技术上准备投入生产环境的版本（待定打印产品包装、编写知识库或帮助内容等）
• CR, Commercial Release  = 产品在销售时，技术支持开始对产品负责支持工作
• CF, Critical Fix = 修复产品中的关键bug，以及可能有一些新功能的版本
• MP, Maintenance Pack / MR, Maintenance Release = 是一种更新包。发现的错误已得到修复以及添加了一些新的功能的版本。这类似于Microsoft产品的服务包。
• Hotfix，热修复补丁 = 紧急更新修复关键错误的补丁

 

其他常见的术语

 

• Alert  = 允许选择操作的产品信息弹出框
• Balloon，气泡消息 = 产品的信息窗口
• BSOD，死亡蓝屏 = 操作系统崩溃时显示的蓝色窗口
• Bug = 程序或程序接口的功能错误
• Case = 测试场景或重现bug的步骤
• Change log，更改日志 =某个版本功能的更改列表
• Crash，崩溃 = 应用程序或操作系统非正常关闭
• GBT，Gold Beta Tester = 在产品开发周期结束时授予最活跃的测试人员的头衔
• KL = 卡巴斯基实验室
• Memory dump，内存转储 = 包含系统崩溃时内存状态的完整数据的文件
• Screenshot，截屏 = 计算机为记录显示器上显示的可见项而拍摄的图像文件
• trace = 组件活动追踪日志文件，包含产品执行的所有操作，帮助开发人员处理和解决问题
• Tray = 带有运行应用程序图标的任务栏区域（系统时间旁边）
• VirLab = 卡巴斯基计算机病毒实验室

第五章 - 清除不正确的产品卸载后的产品残留

 

有一个工具可以被用来对产品卸载后残留的文件进行清理，这个工具仅在产品正常卸载无法工作或者它自动回滚安装时使用。您可以在这篇知识库文章中找到关于它的使用说明：http://support.kaspersky.com/common/service.aspx?el=1464

 

重要！| 在测试期间，这个工具或许不兼容新测试版产品。

 

以下说明说明如何在将 Windows 引导到安全模式后手动删除产品。并不是所有的产品残留都可以通过这种方式移除，但是您应该能够在那之后重新安装产品了。完成后请重新启动系统。

 

1）移除 Kaspersky Lab 文件夹，从以下目录：

 

32位：C:\Program Files\

64位：C:\Program Files (x86)\  

 

    Windows XP: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\

    Windows Vista/7/8/10: C:\ProgramData\Kaspersky Lab\

 

2）在 C:\Windows\System32\drivers\ 移除所有 kl 开头的文件。

 

3）从注册表移除以下键值：

 

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\kl*

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KL*（更改该键值的访问权限从自己到所有人）

    HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab and HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\（在该键值下搜索 “kaspersky”，移除从 Installer 与 Uninstall 子键中搜索到的相关键值）

 

4）从注册表以下键值中移除 klmouflt 与 klkbdflt 项目，其他的项目必须保留：

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}\UpperFilters

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters

 

5）从 C:\Windows\installer\ 移除具有卡巴斯基实验室数字签名的 MSI 文件。

 

如果出现无法删除注册表键值的情况，请尝试更改权限，如下所述。在所有Windows版本中，一般过程应该是相同的。然而，选项的确切名称可能不同。

 

1）在有关键值上右击后选择“权限”。

 

2）点击“高级”按钮后选择“所有者”标签。

 

3）选择“所有人”。如果“所有人”没有列出，请通过“其他用户或组”手动插入（只需将其写入文本字段）。

 

4）启用“替换子容器和对象上的所有者”。

 

5）点击“应用”。

 

6）选择“Permissions”选项卡，并启用“将所有子对象权限替换为此对象的可继承权限”。

 

7）选择“所有人”并且点击“编辑”。

 

8）通过勾选相应的复选框授予“完全控制”。

 

9）确认所有对话框点击“OK/Yes”