Kingsoft AntiVirus 2011 SP5.2 KisKrnl.sys <= 2011.1.13.89 Local Kernel Mode D.O.S Exploit(3 lines of code)

Kingsoft AntiVirus 2011 SP5.2 KisKrnl.sys = 2011.1.13.89 Local Kernel Mode D.O.S Exploit Date: 2011-1-16 Author: MJ0011 Version: KingSoft AntiVirus 2011 SP5.2 with KisKrnl.sys =2011.1.13.89 Tested on: Windows XP SP3 DETAILS: KisKrnl.sys hook the kernel function KiFastCallEntry , but is not...

Kingsoft Antivirus "KisKrnl.sys"驱动程序拒绝服务漏洞

BUGTRAQ ID: 45821 金山毒霸是中国广泛使用反病毒程序。 金山毒霸的"KisKrnl.sys"驱动程序在实现存在安全漏洞，本地攻击者可利用词漏洞使应用程序崩溃造成拒绝服务 Kingsoft Corp Kingsoft Antivirus 2011.1.13 89 厂商补丁： Kingsoft Corp ------------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.kingsoft.com/ MJ0011 （[email protected]）提供了如下测试方法： asm mov edx ...

Kill IceSword-vulnerability warning-the black bar safety net

Posted By Inking This article is a study of the Rootkit... and the SSDT Hook magical－against ring0 inline hook after the results. According to the SSDT Hook magical－against ring0 inline hook said, IceSword inline Hook the NtOpenProcess function, but when I wrote out the code when how also unable ...

CVE-2007-5086

CVE-2007-5086 concerns Kaspersky Anti-Virus/Internet Security 7.0.0.125 where SSDT and Shadow SSDT parameter validation is insufficient, enabling local users to trigger a crash (DoS) via kernel hooks in kylif.sys (NtUserSendInput, LoadLibraryA, NtOpenProcess, NtOpenThread, NtTerminateProcess, NtU...

Breakthrough IceSword process itself protection method-vulnerability warning-the black bar safety net

IceSword drive on its own process to do the protection, so that the malicious program is terminated not him. IceSword did not use HOOK the SSDT method, but is also useless what is too perverted method, but the Inline Hook the NtOpenProcess And NtTerminateProcess several functions, namely to modif...

Breakthrough IceSword own process protection-vulnerability warning-the black bar safety net

IceSword drive on its own process to do the protection, so that the malicious program is terminated not him. IceSword did not use HOOK the SSDT method, but is also useless what too BT method, but the Inline Hook the NtOpenProcess And NtTerminateProcess several functions, namely to modify the...