how can kaspersky failed badly against terminator virus ??

[Gionatan]

This option (unchecked) can help vs trusted signed drivers?

 

[Yury Parshin]

11 hours ago, Xeno said:

Is this going to help against other drivers that terminate Kaspersky? I've seen other ones terminate the anti-virus (in detections) but what if there is a day zero one?

It is impossible to block generically all vulnerable drivers in advance because we are working on the same access level. But is is possible to block known drivers, rules for blocking are updated regularly

[Yury Parshin]

8 hours ago, Bav said:

But it didn't cause terminator was shutting down a fully enabled kaspersky just last week. Again, it's all on video with proof. And it happened SO Fast, kasperky didn't even try to stop it.

It's unknown what's in this video. But definitely not a publicly available utility Terminator using Zemana driver

[Yury Parshin]

4 hours ago, Gionatan said:

This option (unchecked) can help vs trusted signed drivers?

 

No, this option for user mode applications

[Xzz123]

10 minutes ago, Yury Parshin said:

It is impossible to block generically all vulnerable drivers in advance because we are working on the same access level. But is is possible to block known drivers, rules for blocking are updated regularly

Hello sir

I found some vendors may use hardware virtualization to enhance HIPS and proactive defense. Is it possible that K product also use hardware virtualization to block more R0 level dangerous actions? for example, direct syscall.

thx

[Xeno]

7 hours ago, Yury Parshin said:

It is impossible to block generically all vulnerable drivers in advance because we are working on the same access level. But is is possible to block known drivers, rules for blocking are updated regularly

Couldnt it be possible though to stop unknown drivers - take the safe rather than sorry approach. In theory really, you shouldnt have unknown applications try to terminate Kaspersky.

Edited July 2, 2023 by Xeno

[Xeno]

15 hours ago, Yury Parshin said:

It's unknown what's in this video. But definitely not a publicly available utility Terminator using Zemana driver

Possible they made a exclusion to test just its termination abilities