Posts made by Wesly.Zhang

I add some information about this behavior.

The discussion about this behavior are in this topics:

https://bbs.kafan.cn/thread-2156860-1-1.html.

and

https://bbs.kafan.cn/thread-2157065-6-1.html

It seems AVP couldn't do system reboot after done a Advanced Disinfection because malware pre-execute following system command to setup a system shutdown scheduled task for turning off OS.

shutdown -s -t 2000 -c 0

In order to avoid this problem, Can you execute the following command before executing the restart command to cancel all shutdown scheduled task at the end of advanced disinfection process.

shutdown -a

If need some additional information, Please let us know.

@huang1111 said in AIQIYI software will cause Kaspersky to fail to pop up full screen confirmation window:

@jarvis在AIQIYI软件中表示将导致卡巴斯基无法弹出全屏确认窗口：

您好！我能理解吗？这是此问题的其他信息https://eap.kaspersky.com/topic/1435？

You can understand this

Hello, huang1111

Sorry. I follow your reproduce step. I install the iqiyi client and reboot the PC and wait ten minutes. But I can not encounter your issue at last.

Could you remove KB4505903 additional updates and reinstall iqiyi client to confirm this issue?

@huang1111 said in Right clicking on certain files will cause Kaspersky to keep scanning, resources going up, resource manager and being out of response:

https://cloud.qainfo.ru/s/l8jgi5NKD0OOYhr

Hello,

WoW...This tool have protected by VMProtect. Also It is an known PC security manager tool. right? What's your request? KIS couldn't scan this file when os go to access it? It can't be done because File-AV is set to "scaned by access" by default. If you want to say product use a lot of system resource to scan this file. I agree this behavior. It may lead to the packer of this file and its size.

03.08.2019 18.53.37;Detected object (file) not processed;C:\Users\Wesly.Zhang\Desktop\PCHunter64.exe;C:\Users\Wesly.Zhang\Desktop\PCHunter64.exe;not-a-virus:HEUR:RiskTool.Win32.PCH.gen;Legitimate software that can be used by criminals to damage your computer or personal data;08/03/2019 18:53:37

Hi,

In my side, The default behavior is just link this when I go to Network settings of product settings to install browsers plugin. Is this similar to you?

The sample is from here if I don't guess incorrectly. This sample is very intersting.

@harlan4096 said in KAV\\KIS\\KTS\\KFA\\KS\\KSOS: 21\.0\.15\.544:

Is anybody having issues with Kaspersky Protection add-on in FireFox and Chrome? in both cases I'm getting Private Browsing + Anti-Banner disabled, and when I click on enable it does not work...

Hi, harlan4096

I haven't encounter this issue. Do you reboot PC to check whether this issue will happen again or not?

Regards.

@xzz123 said in avp service may eat too much cpu when watching live stream media\.:

@wesly-zhang

I dont know

I do the test that disable those drivers. If klwtp is disabled, the problem is gone( of course once the driver is disabled, webAV is stoped). If you disable other driver, there is still the problem.

You may find the answer if you ask huang1111

 he do the test of disabling protections..... that is the first time we are requested by the tech support.

my driver test was the second time....tech support want more...

Hi,

klwtp is an web transmission processor driver I think. It takes a lot of research to figure out what the player is doing on media stream. Because there are many players that use flash technology, it's the only one that's causing problems, and there must be something special about it.

Best regards.

@xzz123 said in avp service may eat too much cpu when watching live stream media\.:

https://www.huya.com/ 

Hi, guy

I find huya use flash technology to build its live player. Perhaps the product has a performance impact when dealing with flash streaming media. Take a look at action script and see what the player is doing.

@xzz123 said in avp service may eat too much cpu when watching live stream media\.:

Frankly speaking, I believe that those tough and long barriers between dev and users cause the very long period which it takes to fix a localization problem.

Tech support always asking us provide tons of data again and again, after months, there still even no bug ID. Maybe, the problem is still not confirmed yet.........

Dont know what to do now.

Be patient, Guy. You are always the best. Take it easy.

Hi,

Does this issue will be improved after disabled webav? I want to ask this question.

Regards.

Wow... Congratulations and see me in K 2021 testing!

Reproduction steps:

1. Right-click the product tray icon.
2. Tools --> Application Activity
3. Right-click any process to choose "Run sequence".
4. No "Run sequence" information display. 

Also, this behavior happened in HIPS popup window in "Run sequence" item.

Actual result:

There isn't display any information about  "Run sequence" of process.

Expected Result:

It should display "Run sequence" of process information correctly, or delete this item in GUI.

Password for access share: 35Hg

Repeat submission of the same problem. Close 

Reproduction steps:

1. collect traces or dumps.
2. Support --> Support Tools --> Send report to Technical Support.
3. confirm uncheck Operation system information, check Data received for analysis.
4. Select Save report to your computer. I choose to save the report to the Desktop.
5. Wait for processing to the end.

Actual result:

You find the zip file was been created in Desktop. But Suddenly disappeared after the process of saving report finished.

Expected Result:

zip file should be created correctly, could not be delete.

Here is the screen record video: https://cloud.qainfo.ru/s/2clvRhfDRrxmrhA    Access Password: Nw2m

Traces for access password: Wv28

@xzz123 said in [Web\_Antivirus\_give\_incorrect\_report\_'Clean Object Move to Quarantine'](/post/764): >

This problem also reproduce with 2019 patch(b)

Really? Oops...

Reproduction steps:  Two dumps after OS waking up

Dumps: https://cloud.qainfo.ru/s/Q9jeqEVdVUlIL6u       Access Password: C5q9

@helios_07

Yes, You are right, Me too, now. 

@xzz123

Yeah~ I see now. Sorry for my mistake. This issue happen on "Detected object" in Detail report. Ya... It seems AVP do not deal with some item and filter it.

When a threat local in the zip,rar,7zip or some compressed package (parent directory ), AVP don't process its log to filter/hide or improve the log event about the processing state of the thread in compressed package to list in Detected Object window. Maybe It is a beta version, So they haven't dealt with it yet.

15:08:09.326	0xa50	INF	SqliteDataDb	sqlite query processed: 'select "value","expirationTime","insertionTime" from "Data"  where "key" = x'010000008cb9fed65c02';'
15:08:09.326	0xa50	INF	SqliteCache	Value not found in cache
15:08:09.326	0xa50	ERR	amfcd	RollbackInfoManager::GetRollbackInfo: Unable to retrieve object from storage. Error code: 0x8000004c
15:08:09.326	0xa50	INF	amfcd	ThreatsManagement::GetThreatsByIDs: Threat: https://development56.baidupan.com/2018063016bb/2018/06/30/a1130b5f1df6829365e96162d69cace9.zip?st=XyfWJl_YHSw8cbaBzqQMnA&q=MEMZ.zip&e=1530349352&ip=124.79.173.114&fi=3943706&up= detect:  status: Clear object type: 0x0 rollback made: 0x0 couldBeRestored: 0x0, object size: 0x0, parent: 0x0
15:08:09.326	0xa50	INF	amfcd	RollbackInfoProvider::GetRollbackInfo: Enter. Threat 0x3
15:08:09.326	0xa50	INF	SqliteDataDb	sqlite query processed: 'select "value","expirationTime","insertionTime" from "Data"  where "key" = x'010000008cb9fed65c03';'
15:08:09.326	0xa50	INF	SqliteCache	Value not found in cache
15:08:09.326	0xa50	ERR	amfcd	RollbackInfoManager::GetRollbackInfo: Unable to retrieve object from storage. Error code: 0x8000004c
15:08:09.326	0xa50	INF	amfcd	ThreatsManagement::GetThreatsByIDs: Threat: https://development56.baidupan.com/2018063016bb/2018/06/30/a1130b5f1df6829365e96162d69cace9.zip?st=XyfWJl_YHSw8cbaBzqQMnA&q=MEMZ.zip&e=1530349352&ip=124.79.173.114&fi=3943706&up=//MEMZ/Geometry dash auto speedhack.bat detect: Trojan.BAT.Memz.b status: Untreatable object type: 0x0 rollback made: 0x0 couldBeRestored: 0x0, object size: 0x0, parent: 0x2
15:08:09.326	0xa50	INF	amfcd	RollbackInfoProvider::GetRollbackInfo: Enter. Threat 0x4

@xzz123

According to the traces, AVP collectly detected "http://bbs.huorong.cn/forum.php?mod=attachment&aid=MzIwNDF8YjZiMmFmN2J8MTUzMDI4MDQzMnwyNzA0N3w0NzcyMA%3D%3D//mv_sophia_docs/mv_sophia_docs.exe" as "Backdoor.Win32.Androm.qbms", But failed to deal with it. Does this issue only happened in "360Chrome/ 360极速浏览器" browsers?

21:54:34.677 0x8 INF aveng asl_trace: leave DetectReportPost Backdoor.Win32.Androm.qbms

21:54:34.677 0x8 INF aveng asl_trace: enter DetectProcessDone Backdoor.Win32.Androm.qbms

21:54:34.677 0x8 INF aveng asl_link: objId:0190a918

21:54:34.677 0x8 INF aveng asl_trace: leave DetectProcessDone Backdoor.Win32.Androm.qbms

21:54:34.677 0x8 INF aveng AVP !EMU (DT)

21:54:34.677 0x8 INF avs aveng Cancel (req) : 0x80000051

21:54:34.677 0x8 INF aveng USR CANCEL 0x80000051

21:54:34.677 0x8 WRN aveng PROC CANCEL: Usr

21:54:34.677 0x8 WRN aveng PROC EF:0x10000 Cnc

21:54:34.677 0x8 WRN aveng PROC ST:0x80000051

21:54:34.677 0x8 WRN aveng AM PROCESS_FINISH #0 !ERR:0x80000051

21:54:34.677 0x8 WRN aveng AM PROCESS_OBJECT_END #0 !ERR:0x80000051

21:54:34.677 0x8 WRN aveng AVP CANCELED

21:54:34.677 0x8 INF aveng AVP LEAVE http://bbs.huorong.cn/forum.php?mod=attachment&aid=MzIwNDF8YjZiMmFmN2J8MTUzMDI4MDQzMnwyNzA0N3w0NzcyMA%3D%3D//mv_sophia_docs/mv_sophia_docs.exe

Do you set some ignored message in KL Product settings? Restore all notification message in KL Settings and use IE browser to check this issue again.

Hello,

If you encounter a crash and bsod problem. you need provide Full memory dump file for bsod issue or crash process dump file for application crash issue even if problem that seems to be the the same as someone else described. This could let KL confirm the crash reason to improve its product. 

Else, in particularly, GUI/Help issue, You needn't provide the same issue. 

Regards.