Windows 7: Microsoft: MSE safe from Windows kernel hook attack

Lordbob75 · 13 May 2010

Microsoft: MSE safe from Windows kernel hook attack

Quote:

Microsoft Security Essentials (MSE), the software giant's free antimalware solution, is one of the few products that is not affected by the recently rediscovered method for disabling security software on Windows. MSE does not use SSDT hooks, so its real-time protection cannot be disabled via this method.
When the report was first published, we noticed that MSE was not on the list of affected products and contacted Microsoft for clarification. "Microsoft is aware of research published by Matousec and we are investigating the issue," a Microsoft spokesperson told Ars. "Based on available information, we do not believe our products are affected due to the design of our real-time protection. We are working to confirm this."

Source: Microsoft: MSE safe from Windows kernel hook attack

~Lordbob

IggyAZ · 13 May 2010

What you mean MS Security Essentials does something better than all the rest of the Antivirus software.
I'm sure this will not reach the national media.

And I'm sure the lovers of all those other antivirus software won't say a word how really good MS Security Essentials reallt is.....

I just love MSE.

seekermeister · 13 May 2010

From what I read here:

New Attack Bypasses Anti-Malware Protection [Update] - Security Watch

MSE may be unique in this respect, but unless I have a problem, I'm not going to use it.

Phone Man · 13 May 2010

Quote: Originally Posted by seekermeister

From what I read here:

New Attack Bypasses Anti-Malware Protection [Update] - Security Watch

MSE may be unique in this respect, but unless I have a problem, I'm not going to use it.

From reading the above article it seems that 64bit systems were not tested and because MS uses Patch Guard on 64bit systems to prevent kernel hooks this attack probably wont work on 64bit systems. Thats was one of the main reasons I chose Win 7 64bit instead of the 32bit version.

Jim

baarod · 13 May 2010

Quote: Originally Posted by seekermeister

From what I read here:

New Attack Bypasses Anti-Malware Protection [Update] - Security Watch

MSE may be unique in this respect, but unless I have a problem, I'm not going to use it.

Not unique. McAfee, Norton and Kaspersky all patch the kernel like crazy under x86. Under x64 the are supposed to use the new APIs because of PatchGuard. According to Wikipedia "Antivirus software made by competitors ESET,[17] Trend Micro,[18] Grisoft AVG,[19] and Sophos does not patch the kernel."

This information is somewhat specious because we're not sure which versions we're talking about and whether these lists are inclusive.

Either way MSE is easily the most compatible with 7 and it's performance is only getting better.

johnwillyums · 14 May 2010

Quote: Originally Posted by IggyAZ

What you mean MS Security Essentials does something better than all the rest of the Antivirus software.
I'm sure this will not reach the national media.

And I'm sure the lovers of all those other antivirus software won't say a word how really good MS Security Essentials reallt is.....

I just love MSE.

Agreed. I was sceptical but now I'm sold on MSE

MattRainier · 14 May 2010

Aha, another reason never to give up my MSE.

Thorsen · 14 May 2010

good to know. I had been wondering about this for a few days since that other article had been posted. thanks Lordbob75

KazeNoKoe23 · 14 May 2010

Thank God I chose MSE for my anti-malware solution on my netbook.

Lordbob75 · 14 May 2010

Quote: Originally Posted by Thorsen

good to know. I had been wondering about this for a few days since that other article had been posted. thanks Lordbob75

No problem. There are not always follow up articles, but in this case there was.
There is a follow up to another one, with a rather sadder ending.

~Lordbob

Windows 7: Microsoft: MSE safe from Windows kernel hook attack

Microsoft: MSE safe from Windows kernel hook attack problems?