Microsoft: MSE safe from Windows kernel hook attack
Source: Microsoft: MSE safe from Windows kernel hook attackMicrosoft Security Essentials (MSE), the software giant's free antimalware solution, is one of the few products that is not affected by the recently rediscovered method for disabling security software on Windows. MSE does not use SSDT hooks, so its real-time protection cannot be disabled via this method.
When the report was first published, we noticed that MSE was not on the list of affected products and contacted Microsoft for clarification. "Microsoft is aware of research published by Matousec and we are investigating the issue," a Microsoft spokesperson told Ars. "Based on available information, we do not believe our products are affected due to the design of our real-time protection. We are working to confirm this."
~Lordbob
What you mean MS Security Essentials does something better than all the rest of the Antivirus software.
I'm sure this will not reach the national media.
And I'm sure the lovers of all those other antivirus software won't say a word how really good MS Security Essentials reallt is.....
I just love MSE.
From what I read here:
New Attack Bypasses Anti-Malware Protection [Update] - Security Watch
MSE may be unique in this respect, but unless I have a problem, I'm not going to use it.
From reading the above article it seems that 64bit systems were not tested and because MS uses Patch Guard on 64bit systems to prevent kernel hooks this attack probably wont work on 64bit systems. Thats was one of the main reasons I chose Win 7 64bit instead of the 32bit version.
Jim
Not unique. McAfee, Norton and Kaspersky all patch the kernel like crazy under x86. Under x64 the are supposed to use the new APIs because of PatchGuard. According to Wikipedia "Antivirus software made by competitors ESET,[17] Trend Micro,[18] Grisoft AVG,[19] and Sophos does not patch the kernel."
This information is somewhat specious because we're not sure which versions we're talking about and whether these lists are inclusive.
Either way MSE is easily the most compatible with 7 and it's performance is only getting better.
Agreed. I was sceptical but now I'm sold on MSE:)What you mean MS Security Essentials does something better than all the rest of the Antivirus software.
I'm sure this will not reach the national media.
And I'm sure the lovers of all those other antivirus software won't say a word how really good MS Security Essentials reallt is.....
I just love MSE.
good to know. I had been wondering about this for a few days since that other article had been posted. thanks Lordbob75
Quote