Kerio uses strange ring3 hooks that communicates the Kerio driver using an interrupt. Windows API CreateRemoteThread is hooked by Kerio in user mode in every process. Calling this API can cause a crash of the Kerio service ‘kpf4ss.exe’. Sunbelt Kerio Personal Firewall 4.3.246 is affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/48334/matousec-2006-07-15.01.txt
Source: https://packetstormsecurity.com/files/48334/matousec-2006-07-15.01.txt.html