Hello there!

 

I have noticed that after using my computer for a while (performing only routine daily tasks), a Windows process (Local Security Authority Process) begins to increase its resource consumption (specifically RAM) by about 0.5 MB every 2 seconds.

- Powershell command used: "1..6 | ForEach-Object { Get-Process lsass | Select-Object @{N='Hora';E={Get-Date -Format 'HH:mm:ss'}},@{N='RAM_MB';E={[math]::Round($_.WorkingSet64/1MB,1)}},@{N='Private_MB';E={[math]::Round($_.PrivateMemorySize64/1MB,1)}}; Start-Sleep 10 }".

 

After checking the windows events, I'v found out this:

- Powershell command used: "Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" -MaxEvents 200 -ErrorAction SilentlyContinue | Where-Object { $_.Id -in 3033,3063,3065,3066 } | Select-Object TimeCreated,Id,Message"

 

This becomes clearer when examining those specific Windows event logs:

- Powershell command used: "Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" -MaxEvents 200 | Where-Object { $_.Id -eq 3033 } | Select-Object -First 1 | Format-List TimeCreated,Id,Message"

 

As I understand it, this means a Kaspersky component attempted to integrate with a protected Windows process and was rejected because it did not meet the required signature level.

Could you take a look at this?

 

Windows version: 

 

Kaspersky version:

@Mario Junior Welcome.

22 minutes ago, Mario Junior said:

com_antivirus.dll that did not meet the Windows signing level requirements

Please clean install Kaspersky 21.26.4.406 ?

1 час назад, Mario Junior сказал:

Kaspersky component attempted to integrate with a protected Windows process and was rejected because it did not meet the required signature level.

There’s nothing to worry about. Take a look, e.g., at this thread and all the links inside it, especially this one with the best explanation, as I guess.

16 hours ago, Mario Junior said:

com_antivirus.dll did not meet the required signature level

↓ This certificate is OK ↓

Spoiler

 

The requirements for DLL load in PPL and PP processes are strict - level 8 (Microsoft) or 12 (Windows) is required. Anyway, there's no problem for users. Code integrity protection works, which prevents the third-party DLL from being loaded.

You can read more details here, although the info is not recent, and smth might changed.