Extracting malware is far easier when Windows is off. That’s what rootkit extractors are up against: they need to find, isolate, and remove the rootkit while the Windows system is whirring away. Now imagine trying to pull a wayward seed (a missed rootkit) out of the blender while it’s running.
Here’s an analogy: To make a watermelon smoothie, you’ve sliced the melon, removed the seeds, and mixed the cleaned pulp in a blender. That’s critical for finding rootkits, which are very good at hiding on your system. It’s completely self-contained - boot the afflicted PC from a WDO CD or USB drive, and the tool examines the system without any interference from the installed copy of Windows. Unlike MSE, WDO doesn’t depend on the Windows OS installed on your computer. But one possible reason WDO found malware that MSE could not find lies in the way WDO works. I’ve seen no published statistics about WDO’s ability to identify or clean rootkits. However, I know of one instance where a piece of malware was not caught by MSE but did trigger a WDO response. The earlier product doesn’t mention Windows 8, but WDO most definitely does run on Win8 Developer Preview.Īs best I can tell, WDO uses the same signature files used by Microsoft Security Essentials (MSE). The format of the signature files appears to be identical. (Susan Bradley’s July 28 Top Story talked about MSSS.) The size of the program hasn’t changed. Microsoft released the beta version of MSSS in May. WDO is almost identical to an earlier product called Microsoft Standalone System Sweeper. With a bit of reading between the lines, here’s what I can say:
If there are any published technical details about the program - what it does or how it works - I haven’t found them.
Oddly, Microsoft has been uncharacteristically mum about Windows Defender Offline. You suspect you have a rootkit: WDO can scan your system and remove many different kinds of rootkits. Windows won’t boot: You can boot your machine with a WDO CD or USB drive, and WDO will perform a detailed malware scan.Ģ. WDO should be able to catch a wide variety of nasties that evade detection by more traditional antivirus methods.Īlthough the name’s been around for years, don’t confuse this new version of WDO with previous incarnations - it’s a whole new animal and helps PC users in two very different situations:ġ. Microsoft’s newly released beta version of Windows Defender Offline, a rootkit-sniffing and Windows-rehabilitation tool, should be the latest addition to your bag of Windows-repair tricks. TOP STORY Windows Defender Offline - old name, new use
0 kommentar(er)
