Another one that Microsoft won't patch. https://www.bleepingcomputer.com/ne...t-security-software-from-identifying-malware/
They would have to patch to much, so it's easier not to do so. Then people wonder why I don't trust MS with my security
Maybe what you mean is that you don´t trust Windows with your security. The post doesn´t refer to MS security software.
A few details about PsSetLoadImageNotifyRoutine: https://msdn.microsoft.com/en-us/library/windows/hardware/ff559957(v=vs.85).aspx Used in conjunction with PLOAD_IMAGE_NOTIFY_ROUTINE callback function: https://msdn.microsoft.com/en-us/library/windows/hardware/mt764088(v=vs.85).aspx It is fairly obvious that this bug if exploited would nullify HIPS and anti-exec capability to detect new process startup activities. Microsoft doesn't care since none of their "security" software mechanisms ever used or ever will use this capability. -EDIT- Or and more likely, Microsoft's "neglect" is just one more attempt to cripple third party security software to support their new profit making woefully deficit security software development.
A comment from the original bleepingcomputer.com article: Your malware bypass is in the second paragraph.
