Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Does anyone know how to disable patchguard for windows 7? Quick search on net took me to some sites which provide a driver to disable it. However, I am not sure if I want to trust it. I dont want to end up in installing a rootkit while disabling the patchguard. So, does any one know any trustworthy option of disabling the patchguard.

(I do know that patchguard gonna hamper my kernel level protection.)

Thanks

share|improve this question

migrated from stackoverflow.com Jun 6 '11 at 19:36

This question came from our site for professional and enthusiast programmers.

    
I believe patchguard is part of the kernel, so you would need some sort of patch to load before the kernel does at boot time, at least this is how advanced Malware circumvents it. –  Moab Jun 6 '11 at 21:53
add comment

1 Answer

From Wikipedia:

In January 2006, security researchers known by the pseudonyms "skape" and "Skywing" published a report that describes methods, some theoretical, through which Kernel Patch Protection might be bypassed. Skywing went on to publish a second report in January 2007 on bypassing KPP version 2, and a third report in September 2007 on KPP version 3. Also, in October 2006 security company Authentium developed a working method to bypass KPP.

Nevertheless, Microsoft has stated that they are committed to remove any flaws that allow KPP to be bypassed as part of its standard Security Response Center process. In keeping with this statement, Microsoft has so far released two major updates to KPP, each designed to break known bypass techniques in previous versions

So since patching the kernel is wholly unsupported by Microsoft, there's no "trustworthy option" to disable it -- you're always going to have to rely on some dodgy hack.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.