BUG description: kaspersky product's file monitor and scan module (OAS and ODS) can not trigger detection for some files which already been blacklisted by KSN. But System Watcher is able to trigger detection correctly once the file is executed.

I encountered this problem a long time ago in some old versions of Kaspersky products, but no one discovered it at the time, so I didn't report it. Recently, many friends on chinese K fans forum have discovered this problem when testing viruses.

These files can not be detected as malicious by both scanning and monitoring.but these files are already KSN blacklisted. If you scan them on virustotal, the Kaspersky engine will report viruses. However, there is no virus report on the user's computer, and the query of KSN reputation shows that it has been blacklisted. In this case, only double-clicking to run the file or the script can trigger the detection which comes from system monitor component. I have tried methods such as clearing the KSN cache and renaming the file, but none of them worked. You must double-click to run the virus to trigger it.

Reproduction process:

Start Kaspersky
Browse the virus file, right-click the file, check the file properties, check the KSN reputation, the reputation status is blacklisted, and OAS has no detection at this time
Scan the file, ODS has no detection
Use selective scanning select scan, and close iswift and ichecker to ensure that it is not affected by the scan cache, and there is still no detection.
Double-click to run the virus, the system monitor reports the virus and deletes it. HIPS only moves the file to the low-restricted group and does not process the file. In fact, according to the design, HIPS should trigger detection independently before System Watcher, HIPS should obtain the bad reputation and move the file to untrusted group. It should not be the turn for the system monitor component to process the virus. There is a problem here as well.

It should be noted that as the file will eventually added to the signature detection, the problem cannot be reproduced. Unless KL finds a similar file again and tests it immediately, it cannot be reproduced for the file I uploaded.

Above, I think this problem will affect the user's security, and this phenomenon does not conform to the correct design intention of Kaspersky products. I hope the developers will investigate the problem and fix it as soon as possible.

please see my traces. there is screen record with it.
I cannot login owncloud now, can you download from google drive?

https://drive.google.com/file/d/172dCEVJTdMx-C0zP1fV9gjQ4k2axrm3x/view?usp=sharing, https://drive.google.com/file/d/1YkHlh5BZDDSHnkUyIBU7bNKZSPJqD0EC/view?usp=sharing

Kaspersky Beta

xzz123