Nuke Modified | AntiVirus Remover

New Security Feautures of Windows Vista in System and Kernel Mode

Section 1: Security Development Lifecycle

The Security Development Lifecycle technique or SDL is a professional process that helps for making sure that the software are built from the

base to reduce security risk. The SDL implements a professional process of secure design, coding, implementing, testing, review and response for all Microsoft products specific windows Vista .The SDL removes the surface area for attacks, improves operating system and

application be bugless, and helps organizations high securely management and isolate the network.

We can say that The Windows Vista is the first client operating system to be Designed and developed from the first step to finish using SDL.More than 1,000 threat models were developed for Windows Vista to ensure identification and reduse of risks in different parts of the

operating system that required especial testing.

Section 2: Kernel Patch

The most important security issue is out “operating system kernel”. These rootkits are usually very useful for unwanted software, like

spywares. Kernel patch Protection of rootkits can reduce the Risk and increase stability, reliability and performance in the system, include All User data and programs.

Handling of these problems were very difficult before, because 32-bit Windows drivers like windows XP are not identified and compatible

with digital signature and It has Unsupported and poor kernel.Windows 32-bit security products that provide blocking action capabilities modify the kernel through unsupported techniques .

Although the computer system moves from 32-bit to a 64-bit architecture but the smaller installed base of 64-bit software makes it

possible to making significant enhancements for security in the kernel and reduce the potential for rootkits .

What is Kernel Patching?

Kernel patching is the practice or trying for using unsupported methods or features to change or replace of kernel code. Kernel patching can

have different result in behavior during system instability and performance errors and problems such as the Blue Screen error that we know it can reach to lost user data. another issue that is very important in kernel patching is increase the mechanism versus malware developers and attackers for Windows Vista Operating system.

The biggest risk in kernel patching is about virus and spyware writers that use this technique with malicious for hiding their presence and

effects.

Of course Malware authors are motivated for patching the kernel because That’s a powerful and great mechanism for attacking the computers and data. What is Kernel Patch Protection?

There are many features of security in Windows Vista. But I want to emphasize Kernel Patch Protection is not one of them. I mean Kernel

Patch Protection created in x64 CPU architecture versions and Microsoft used it in Microsoft Windows Server 2003 SP1 and Windows XP Professional. but it not supported in x86 architectures or 32-bit systems. With increasing of using of 64-bit computers, The

Vista users will see more benefit from this technology. Actually Kernel Patch Protection monitors and looks if any resources used by the kernel or probably kernel code has been changed or modified by itself. Fortunately If windows vista detects or feels any unauthorized patch of data or code it will shut down the system

automatically. But we should consider that the Kernel Patch Protection can not prevent all viruses and malware . It can prevent one way versus attackers to system.

Section 3: Encrypting File System improvement:

We can say that The Encrypting File System or EFS is best tool for encryption of files in client and server computer. It helps users to protect their data from Unreal and unauthorized access by other person or computer or external attackers. In Windows Vista EFS includes many new security techniques and features.In Vista, EFS Technique supports “user keys storing” and also administrative keys on the smart cards. If smart card uses for login, EFS will operates in a Sign On mode, where it uses the login smart card for file encryption without require for the PIN. In windows vista through the process of creating and setting smart card keys performs their files from an old smart card to the new smart card . The utility program for smart card has these features as well.

EFS is available in Windows Vista Business, Enterprise and Ultimate.

Section 4: USB Device and Removable Devices Control:

As we know , connecting between Devices with computer is very usual in these days and users should have the ability to add new hardware to

the computer or use USB Devices or another removable storage devices.It can create two problems in system: First it may make harder

to maintain the computer when we install any unsupported device, and second it can create threats to data security as well. with a USB

Device or removable storage, with “autorun” technique can use by an attacker to install malwares or any malicious software on an

unattended system.

Fortunately Windows Vista manages or blocks the installation of unsupported or unauthorized parts or devices. These security configuration can applied independently on a client computer, or in

numbers of systems in a network. Administrator has a lot of power for setting these policies and controls in Windows vista. We can say that

The Group Policy settings are available special for manage and control for reading and writing action in removable storage devices like USB

Devices as a per user or per system base.

Section 5 : Windows Defender

As we know in these years spyware and other unwanted software like adware, bots and rootkits create big problems for systems and users.The progress of job for these type of software is Usually they installed without a user’s knowledge or confirmation and they can damage or corrupt personal information and passwords and send them

to third parties without the user’s permission.

Microsoft Knows that it is very important for users to use anti-spyware protection in system. As customer choice, Microsoft supports users for

having choice about what program install and run on their computer or from where it came or what it does and how we can to remove that.Based on these discuses and users complains about spyware, Microsoft decided to create and use anti-spyware solution or Windows Defender in Windows Vista. In fact Windows Defender will help for protection

and remove spywares, adwares, rootkits, control utilities and such these things that we call “malware.” In Windows Vista, Windows Defender helps us for protection of unwanted application and software installation. It prompts and monitors different aspects of OS when feels it abused by malware , like the Startup folder in windows and the registry file. If any software to

attempt for changing to one of the protected areas of the Vista , Windows Defender prompts and appeara a message the user for allow or reject that changes.Good news , Windows Defender is available as a free download plug ins for licensed customers of Windows 2000, Windows XP and Windows Server 2003.

Section 6 : Windows Firewall

Most of Windows XP users used from Firewall. A firewall is a critical first line for defense versus huge kinds of malware before they can

enter to user’s computer or our network.

When Microsoft XP released in the first version of that the built-in firewall be turned off by default. The reason was because of compatibility with some applications or probably third-party firewalls. Based on that Microsoft released the Windows XP with the disabled

firewall by default. Naturally , a lot of customers and users did not get any benefit from firewall protection whenever any network worms

arrived to their computer.

Windows Vista Firewall

Base on this experience and for prevent of such events, naturally the firewall in Windows Vista should be on as a default and also compatible with another software. because of that the Customers who want to use a third-party firewall can turn off the built-in firewall easily.

It means the firewall in Windows Vista will turn on by default at the beginning when Windows starts for user protection. Another issue is

that The Windows Firewall in Windows Vista also allows the administrator of network or single system to block some applications as a peer-to-peer sharing softwares or instant messaging softwares that usually nobody like them.

Section

7: Protecting the Kernel of Windows in 32-Bit vs. 64-Bit

Microsoft as a designer and developer of Windows vista tried the best for create more reliable and more secure product from attacks. In fact in basic level, It means that the design and development of kernel mode code in Windows Vista

needs to have a security-focused design and development, and then test and release. As I Mentioned Microsoft has been started this Method since 2002 Under Security Development Lifecycle (SDL) progress. The Microsoft development team had an important and clear goal for improving the reliability and security in new product . As a producer It has a risk because of application

compatibility should considered in during security platform. In 32-bit windows mostly Windows XP there is , over time, third-party

developers used unsupported in a lot of applications that used by users. Actually to simply using unsupported and undocumented interfaces , there is a technique that called “kernel patching” . I emphasize here that kernel instructions and data structures are responsible directly for manipulating to

modify , change and control of system behavior.

Windows 32-Bit Architecture in Kernel and User Mode .This technique is very useful for prevent with malwares but even without malwares the using of this technique can introduce instability and stability in the system.Advantage of supported interface is that If this kind of interface is used,and changed the developers are informed about that From Microsoft documents and he/she can update their code for handle the changes. In other hand , the changes to undocumented and unsupported interfaces can not tracked and will

reach to crashes or other unexpected problems and effects when the kernel patching technique is used. Unsupported patching techniques usually will patch the undocumented kernel interfaces and naturally without introducing this side it

can reduce security in the system. When some Software and Program packages try to chain together to using of unsupported patching techniques these issues will be important. for example, Some times the order of calls from a package to next package is undefined, the

same as its behavior when we want remove one package from that chain. This kind of problem is too complex and it can lead to other subtle problems that are very difficult to diagnose and mostly it happen frequently. Although , these

techniques will be bad computer science and techniques practice, and we can say it does not support most of computer science engineering disciplines.With malicious or malwares , rootkits can be much more dangerous, because of

allowing malicious program for hiding and protecting itself while controlling and monitoring all user, as well as controlling access and performing to all software, files, and connecting to network and even hardware. These activities of malwares can do to online theft for passwords of banks or IDs.Unfortunately, making compact or zip for kernel of 32-bit systems would have a risk for some attack techniques. but for reduce this compressing and risk rate Microsoft decided to implement and improve these changes in 64-bit Windows. Because of that we have “clean start” state in Vista with native 64-bit drivers and all software adapted to these changes.

Section 8: What was Vista security holes?

As we heard Kaspersky Anti Virus Company is one of the best company for prevent of Malwares and Viruses in these days. Their experts Labs have

predicted more that 90% of current and distributed of malware will run on Windows Vista.

We believe now that Vista appears to be much more secure than previous Windows XP but The researchers warned to Microsoft and users that as Vista becomes more popular in these days and it should increase protection of kernel vs hackers.

As we know the first pieces and parts of any operating system would be attacked by attackers .It should be PatchGuard that protects the Vista kernel that we talked about that.

Although the first thing as a aim can be the technology that it take access to the

kernel of operating system more difficult.

PatchGuard as we said or kernel protection tries to prevent or protect the Vista

kernel from illegal access and unauthorised user or softwares. It can lock the system completely if it detects any risky patch or code.

Unfortunately Some hackers could try to install malware to the kernel of vista in the test stage by using new method. Actually as a drivers they ran their software in kernel space of vista.

Section 9 : New Security vs. Convenience Usability

Sometimes with appearance of new features some of advantages will be lose.in fact One of the basic issue in security designing is keeping fair between security and usability. We can say If the security is too complex, then usable simply will

be gone. If a feature offers very good level of security protection level , if it is much more complex or it has poor design of usability it will be disabled by users or administrator of systems. When microsoft engineers and designers underestood that Windows Vista is very secure , they tried to create security capabilities and they enabled by default for usable enough for users for prevent of inconvinience. It’s great when you know the risks decrease by adding new security features and you can use as well as before or may be appear easier to use .

That was very hard and expert balance that you know How many softwares or applications will be need harder security and how many users wants to turn off security feature if their usability comes down?One of the great new thing in Windows Vista is User Account Control or UAC. In fact UAC is a “standard user that works” or “non-administrative user that can actually do things.” For doing some things such as change the local time zone on the windows XP , you had to have local administrator level. It means we can

say everyone did a login account to system he or she was a member of the local administrators level.

But in Windows Vista, one of the main goal of User Account Control was to protect users from attack of malware or another users. To achieve that goals for Vista, they defined a standard user for all end-user that they wanted to get their changing , but for protect some user that they really need to be an administrator

from something bad and risky. Totally The primary aim of microsoft was to protect the system from user with malicious and some users that they want to illegal access.

Section 10: Windows Defender

For that When you want to see the usability of vista ,The first thing may be that the system asked too frequently for permission. Microsoft before release of vista also worked and contacted with application and software vendors to making sure that they do not require elevation and verificatin from administrators side except whenever it is necessary.

Another example for comparing convenience versus security is the policy and strategy for enabling Data Execution Prevention or DEP in Vista. In fact DEP treats data as data even code as code, and then it blocks execution stage. The

benefit of this is it allows the data buffer to be overrun with DEP, so it is harder for attacker to execute the malware codes that was placed already in the data buffer . DEP is turned on in vista by default for the kernel Mode and it is a

excellent technique for protecting parts in the system mostly Internet Explorer. The problem is that it turns out that a third-party add-ons that generate a dynamically code and store that code in the data buffer and there is no way for

DEP to diagnose between this add-ons and malware. It mean we have more security or we can select application compatibility issues.

Conclusion:

Windows Vista can make our job easier and more secure our system. If we are a systems engineer or expert , surely we will find it nearly for develop to high level secure client platform. For nonprofessional users I think there is a little

problem for using windows vista just for unsupported some programs that they probably need and some hardware as well. From security point of view with these terms that I explained , windows vista is really one big successfully for

microsoft. Because with using of Security Development Life Cycle, Kernel Patch Protection , Encrypting File System, Preparing security for USB and Removable Device, Windows Defender ,Windows Firewall and a lot of

techniques that microsoft never pulished that it’s too hard attacking and cracking

and any abuse of probably holes in this product.I recommend to everyone for installing from today and enjoy from the latest operating system in the world.

About the Author

Published By: Mojtaba Sadeghi
Master of computer Engineering in Software
IAU University
Date of Publishing: July 2007

Alienware M17x 17-Inch Gaming Laptop (Space Black), Intel Core i7-740QM 1.73GHz, 8GB DR3 Memory, 500GB Hard Drive, 1GB ATI Mobility Radeon HD 5870 Graphics, Windows 7 Home Premium $2,799.84 Take control of your gaming with the Alienware M17X multimedia laptop (model m17x10-1847DSB), which features a thermally optimized case design with aggressive lines and an in-your-face attitude. It features a stunning, high-definition 17-inch display and a powerful Intel Core i7 processor–featuring four cores of intelligent processing power. Additionally, it offers ultra-fast DDR3 system memory a…

Alienware M17x 17-Inch Gaming Laptop (Space Black), Intel Core i7-740QM 1.73GHz, 8GB DR3 Memory, 640GB Hard Drive, 1GB ATI Mobility Radeon HD 5870 Graphics, Windows 7 Home Premium $2,599.84 Take control of your gaming with the Alienware M17X multimedia laptop (model m17x10-1847DSB), which features a thermally optimized case design with aggressive lines and an in-your-face attitude. It features a stunning, high-definition 17-inch display and a powerful Intel Core i7 processor–featuring four cores of intelligent processing power. Additionally, it offers ultra-fast DDR3 system memory a…

Alienware M17x 17-Inch Gaming Laptop (Space Black), Intel Core i7-740QM 1.73GHz, 16 GB DR3 Memory, 640GB Hard Drive, 1GB ATI Mobility Radeon HD 5870 Graphics, Windows 7 Home Premium $2,589.00 Take control of your gaming with the Alienware M17X multimedia laptop (model m17x10-1847DSB), which features a thermally optimized case design with aggressive lines and an in-your-face attitude. It features a stunning, high-definition 17-inch display and a powerful Intel Core i7 processor–featuring four cores of intelligent processing power. Additionally, it offers ultra-fast DDR3 system memory a…

Windows 7 System Recovery disk Live Boot CD 32 bit DVD. (disc works with Home Basic, Home Premium, Business, and Ultimate) $3.00 For sale official Windows 7 System Recovery Discs If you’re like most PC users, you probably got Windows 7 with a new PC or laptop. And if you’re like 99% of the population, you get your new machines from one of the major manufacturers. Dell, Acer, Asus, Sony, HP, Toshiba, Lenovo, who all have one thing in common: they don’t give you a real Windows 7 installation disc with your purchase. Instead, …

Kaspersky Internet Security 2011 3-User [Old Version] $18.49 Kaspersky Internet Security combines the essential security of our advanced anti-virus software with additional layers of defense, such as firewall and parental controls. Innovative technologies deliver real-time protection, monitor suspicious activity, and block dangerous actions before they can cause harm—all while working silently in the background. Real-Time Protection against…

Eset Nod32 Antivirus V.4.0, 3 User $23.92 ESET NOD32 Antivirus 4 is the most effective protection you can find to combat today’s huge volumes of Internet and email threats. It provides comprehensive antivirus and antispyware protection without affecting your computer’s performance. Using advanced ThreatSense technology, ESET NOD32 Antivirus proactively protects you from new attacks, even during the critical first hours when other products…

Iomega 500GB eGo BlackBelt Portable Hard Drive, SuperSpeed USB 3.0/USB 2.0 – 35314 $129.99 Super Speed. Super Tough. The eGo BlackBelt Portable Hard Drive offers a stylish look that is fast, sleek, and rugged. Now with a fast USB 3.0 interface, you can save your media in a fraction of the time up to 10 times faster than with USB 2.0. All Iomega USB 3.0 drives are backward compatible to USB 2.0 using the same USB cable. So enjoy fast speeds now if you have a USB 3.0 computer or use USB …

Dell Computer Corp Inspiron 620 Desktop PC with 24 LED Monitor – i620-9994NBK $863.57 The Dell Inspiron 620 – tower of power – is also a pillar of fun. With the latest 2nd Gen Intel Core processors, you’ll whiz through tasks with time to spare. Perfect, as this desktop has plenty of media connectivity to entertain you and your family. Whether you’re surfing the web, emailing friends and family, downloading music and photos, or sharing your world online, your Inspiron 620 desktop ca…

Samsung Series 7 XE700T1A-A04US Super Bundle 11.6-Inch Slate (128 GB SSD, Win 7 Pro 64bit) WITH DOCK AND KEYBOARD And Stand Case upto 7 Hours Battery 4GB DDR3 IPS WIFI Core i5 2467M 802.11 abg/n WiFi, Bluetooth V3.0 Microsoft Essential Security Antivirus Software Included. $1,659.99 The Samsung Series 7 slate gives you full PC power packed into an ultraportable device, taking mobility to a new level with a touch-focused design. It weighs just shy of two pounds and is only a half-inch thick, making it perfect for users who need a slim, lightweight computer but don’t want to sacrifice true PC functionality. Its 11.6-inch display supports 10-digit and stylus input for excellent …

Dell Inspiron 560 Desktop Intel Pentium Dual-Core E6700 – OPEN BOX ***OPEN BOX***   This NEW product you are browsing has been inspected by our certified technicians to ensure that it meets factory specifications. It is guaranteed to be in perfect working order but it is sold in AS IS condition (for example, the box may be torn, etc) and returns will not be accepted. Please contact us with any questions BEFORE placing an order.  We accept PayPal an…

Microsoft OEM Software FQC04649 Windows 7 Professional 64 Bit English DSP Oem 1Pack $234.73 1 pack of Microsoft Windows 7 PRO SP1 64 Bit on DVD for OEM computers ONLY.

CA Anti-Virus v.8.1 $50.99 1 User 12×5 Phone-Based Support Centralized Virus Management Quick Response Ease of Distribution, Implementation and Management Provides Anti-Virus Protection Extensive Reporting Recommended configuration for servers: Processor: Pentium 4 – 2.6 GHz or higher Hard Disk: 10 GB Memory: 1 GB of RAM minimum (2 GB recommended) Recommended configuration for each client running the agent: Processor: Pentium 300+ MHz recommended (200 MHz minimum) Hard Disk: 256 MB Memory: 512 MB of RAM Supported Platforms: Microsoft: Windows 95, 98, ME, NT 4.0 SP6a, 2000, XP (32/64-bit), Server 2003 (32/64-bit), as well as Microsoft Exchange 2000 and 2003 Linux (32-bit): Red Hat Enterprise Linux 3 and greater, SuSE Linux Enterprise Server 8 and greater, SuSE 9.0 and greater UNIX: Sun Solaris 8 and greater; HP-UX 11.0 and 11.11 Novell: NetWare 5.1 and greater Citrix Presentation Server 4 for Windows Lotus: Notes/Domino 4.6.2 and greater Network Appliance NAS Devices: Filer Appliance Cisco NAC and Microsoft NAP Support for Windows Apple: Macintosh OS X 10.3 and greater for Power PC; Macintosh OS X 10.4 and greater for Intel Gateway: Microsoft Windows NT 4.0, 2000, XP, 2003 and Red Hat Linux Gateway Plug-In: Microsoft ISA Server; Apache; CVP PDAs: Palm, Microsoft Windows Mobile 2002/2003/2005, Microsoft Smartphone 2005, and Pocket PC 200 CA Anti-Virus is the next generation in comprehensive anti-virus security for business PCs, servers and PDAs. It combines proactive protection against viruses and malware with powerful management features that stop and remove malicious code before it enters your network, reducing system downtime and outbreak response costs. Anti-Virus v.8.1 Antivirus CA Computer Associates International, Inc EAV8101BPE Security Software www.ca.com

Anti-Virus 2012 $27.99 AVG Anti-Virus 2012 – - Win

Microsoft OEM Software GLC00736 WINDOWS 7 ULT 64 BIt OEM 1PK $307.44 Windows 7 Ultimate gives you everything Home Premium and Professional offers plus added security features and the flexibility to work in multiple languages. Create a home network and share all of your favorite photos videos and music. You can even watch TV programs for free whenever and wherever you want.

Microsoft OEM Software GLC01844 Windows 7 ultimate sp1 64Bit 1 Pack $308.81 1 pack of Microsoft Windows 7 Ultimate SP1 64 Bit on DVD for OEM computers ONLY.

Microsoft OEM Software FQC04725 Windows 7 Professional SP1 64bit System Builder DVD 3 Pack $721.31 3 pack of Microsoft Windows 7 SP1 PRO 64 Bit on DVD for OEM computers ONLY.

Microsoft OEM Software GFC02153 Windows 7 Home Premium 64bit With Sp1 Oem 3 User $549.32 3 pack of Microsoft Windows 7 Home Premium SP1 64 Bit on DVD for OEM computers ONLY.

Koko (Computer Virus) $68.51 High Quality Content by WIKIPEDIA articles KOKO Virus is a memory resident parasitic virus created on March 1991. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. On July 29 and February 15 it displays a message and erases the disk sectors, and the next day everything goes back to normal. In 1991, an Egyptian Engineer Developed the virus for testing and research purposes, become the first Virus Creator in Middle East for EXE COM TSR Virus over DOS and workgroup windows, after a straight order from the government he release the antivirus (AAV Adham Anti Virus ). the virus spread fast and easily and it became one of the famous names KOKO in Memory resident Viruses. KOKOs name came from the creator himself, which was his nickname used by his friends in 1991 Author: Surhone, Lambert M./ Tennoe, Mariam T./ Henssonow, Susan F. Binding Type: Paperback Number of Pages: 84 Publication Date: 2010/08/25 Language: English Dimensions: 6.00 x 9.02 x 0.20 inches

Anti-Virus 2012 – Business Edition – 7 User $119.99 Award winning protection for your data Free up time to focus on your business Spend less on protection more on your business

Max Group HR18010 HiRO V.92 56K Internal PCI Data Fax Voice Modem Windows 7 Vista XP 32 64 bit RoHS $26.33 Latest V.92 Standard Protocol. PCM Upstream Max. Data Upload up to 48K. MOH Receive Phone Call During Active Internet Connection. Quick Connect Connect to Your ISP Faster. Fully Compatible With the Latest Windows 7 Operation Systems. RoHS Compaliance. Modem Protocol: ITUT V.92/K56Flex ITUT V.34bis V.34 V.32bis V.32 V.22bis V.22 V.21 V.23 Bell 212A/103 V.80. Fax Compatibility: 14.4 kbps Send / Receive G3 Compatible. Software Compatibility: AT Command Set Compatible. Error Correction: MNP24 V.42. Data Compression: MNP5 V.42bis and V.44. DTE To Modem Data Rate Max: 115200 bps. Data Interface: PCI BUS 2.1. Voice function with Telephone Answering Machine (TAM). Line Interface: RJ11 Modular Jack Line and Phone. System Requirement: Pentium II 266 MHz or higher 1 CDROM Drive 1 Available PCI Slot. Supported Operation Systems: 98SE 2000 Server 2000/2003 XP Home/Professional XP Professional X64 Edition Vista 32/64 FAmilies and Windows 7 32/64 Families.