Microsoft: MSE safe from Windows kernel hook attack

[Lordbob75]

Microsoft: MSE safe from Windows kernel hook attack

Microsoft Security Essentials (MSE), the software giant's free antimalware solution, is one of the few products that is not affected by the recently rediscovered method for disabling security software on Windows. MSE does not use SSDT hooks, so its real-time protection cannot be disabled via this method.
When the report was first published, we noticed that MSE was not on the list of affected products and contacted Microsoft for clarification. "Microsoft is aware of research published by Matousec and we are investigating the issue," a Microsoft spokesperson told Ars. "Based on available information, we do not believe our products are affected due to the design of our real-time protection. We are working to confirm this."

Source: Microsoft: MSE safe from Windows kernel hook attack


~Lordbob

 

[IggyAZ]

What you mean MS Security Essentials does something better than all the rest of the Antivirus software.
I'm sure this will not reach the national media.
And I'm sure the lovers of all those other antivirus software won't say a word how really good MS Security Essentials reallt is.....
I just love MSE.

 

[seekermeister]

From what I read here:

New Attack Bypasses Anti-Malware Protection [Update] - Security Watch

MSE may be unique in this respect, but unless I have a problem, I'm not going to use it.

 

[Phone Man]

From what I read here:

New Attack Bypasses Anti-Malware Protection [Update] - Security Watch

MSE may be unique in this respect, but unless I have a problem, I'm not going to use it.

From reading the above article it seems that 64bit systems were not tested and because MS uses Patch Guard on 64bit systems to prevent kernel hooks this attack probably wont work on 64bit systems. Thats was one of the main reasons I chose Win 7 64bit instead of the 32bit version.

Jim

 

[baarod]

From what I read here:

New Attack Bypasses Anti-Malware Protection [Update] - Security Watch

MSE may be unique in this respect, but unless I have a problem, I'm not going to use it.

Not unique. McAfee, Norton and Kaspersky all patch the kernel like crazy under x86. Under x64 the are supposed to use the new APIs because of PatchGuard. According to Wikipedia "Antivirus software made by competitors ESET,[17] Trend Micro,[18] Grisoft AVG,[19] and Sophos does not patch the kernel."

This information is somewhat specious because we're not sure which versions we're talking about and whether these lists are inclusive.

Either way MSE is easily the most compatible with 7 and it's performance is only getting better.

 

[johnwillyums]

What you mean MS Security Essentials does something better than all the rest of the Antivirus software.
I'm sure this will not reach the national media.
And I'm sure the lovers of all those other antivirus software won't say a word how really good MS Security Essentials reallt is.....
I just love MSE.

Agreed. I was sceptical but now I'm sold on MSE

 

[MattRainier]

Aha, another reason never to give up my MSE.

 

[Thorsen]

good to know. I had been wondering about this for a few days since that other article had been posted. thanks Lordbob75

 

[KazeNoKoe23]

Thank God I chose MSE for my anti-malware solution on my netbook.

 

[Lordbob75]

good to know. I had been wondering about this for a few days since that other article had been posted. thanks Lordbob75

No problem. There are not always follow up articles, but in this case there was.
There is a follow up to another one, with a rather sadder ending.

~Lordbob