I recently installed the trial version of Kaspersky as I had always a good impression of the features of their software. I also bought a 1 PC 1 year license, but didn't unsealed it yet as something very unsatisfying happened to me.
When I was on a LAN gaming party and tried to use the network just a fractal of web services was accessible by domain-name for me. After some research and with help of others, we figured out this was due some suspicious entry as my primary DNS-server IP and that server was probably developed without considering the scenario, that was present on the LAN, as legit DNS had handled it.
After googling the IP which was set as my DNS server, almost any page was alerting about MITM attacks and trojan malware. And even the first post was a report in Kaspersky's tracker from back to 2012.
So here is my question:
How can it be, that a major anti male software like Kaspersky has been informed about this 4 years ago and still isn't able to track this?
From my understanding this should be a easy one to detect. I guess the most basic thing to do is add this IP-address to some blacklist and just check the DNS entry against the blacklist. Also figuring out how to read the systems DNS entry shouldn't be that much of a deal for devs of such a company, should it?
So, what might be reasons for Kaspersky not being able to track this, except simply lumpyness of the corresponding dev?
Note: I'm legit interested in this. I'm not trying to rant. If this might appear so, one can feel free to replace the product name with a pseudoproductname.