McAfee introduces anti-rootkit security beyond the OS

Code:

http://www.net-security.org/secworld.php?id=11619

Code:

http://www.mcafee.com/us/solutions/mcafee-deepsafe.aspx

 

I've been hoping for mainstream antivirus vendors to be able do something like this, as it just makes sense as an approach.

If you've found yourself in a fair fight with malware, then it means you've not prepared properly. Why face these threats on even footing?

I probably wouldn't trust McAfee programmers not to foul things up with this level of access to my PC - but it's a step in the right direction IMO and hopefully the more capable vendors will be able to follow suit.

ITPro suggest that it'll be considered more anti-competitive behaviour from Intel if the company doesn't give other vendors the same access:
http://www.itpro.co.uk/636106/idf-2011-intel-unveils-first-fruits-of-mcafee-acquisition

I wonder how much of a performance hit there'll be using this.

Presumably there'll be an update mechanism for the 'DeepSAFE' platform, so hopefully they'll secure this properly otherwise this would open up a new vector for attack.

 

"I keep getting asked for comments on McAfee/Intel’s new Deepsafe. So what the heck, here goes." : http://sunbeltblog.blogspot.com/2011/09/deepsafe.html

 

Short, but sweet comment from Alex. Nothing ground-breaking then except perhaps McAfee might be taking the lead on this one because of their relationship with Intel. I know Alex doesn't think so.

If this is available to all AV vendors, it shouldn't be too long before others produce similar technologies in their products if they feel it is warranted. Maybe it already does exist because I believe there are some scanners that do pre-boot scans. Perhaps those pre-boot scans already utilise the not-so-secret sauce Alex refers to.

 

Windows bundled with AV, and now this. Sigh, can it be at least disabled?

 

Remember Hypersight Rootkit Detector, same approach.

 

Nope, will that stay free?

 

RE - Hypersight Rootkit Detector

@ Meriadoc

Good point

Hi, yes i do it & i still have it somewhere It was just one of Many ARK's etc featured in here http://forum.sysinternals.com/forum...Hypersight&title=rootkit-detection-prevention

It's still available http://northsecuritylabs.com along with other Apps etc. If someone could install it & try it out =