Anti-virus Products Mostly Ignore Windows Security Features- ASLR or DEP

http://krebsonsecurity.com/2010/08/anti-virus-products-mostly-ignore-windows-security-features/

 

Interesting, thanks. MSE uses both

 

I'd be shocked if they didn't to be honest.

 

For what I could see (In my own testing), it seems that, perhaps due to a bug, MSE 2 beta doesn't support DEP. It does support ASLR, though.

Edit: Actually, it does support it! I was looking at the service, rather than the process msseces.exe.

My bad.

 

The malware service? It should have it too, in both v1/v2, below a screenshot of v2's 3 processes. Unless I'm doing something wrong?

 

I rechecked and this is what I have:

MsMpEng.exe - Only ASLR
NisSrv.exe - Only ASLR
msseces.exe - Both DEP and ASLR

Perhaps a bug with x86 version of MSE v2.0. I'll ask in the thread related with the beta version if anyone gets the same and report it to Microsoft.

 

I'll assume you have DEP turned on for everything?

 

Yes, I do.

Edit: I wasn't running Process Explorer with administrative rights, hence the incorrect display.
MSE v2 supports both DEP and ASLR on x86.

Sorry for any inconvenience.