Driver loading and exploit protection?

[captainron]

What would happen if an attacker remotely executed code in a SYSTEM level process and attempted to drop binaries, register them with startup and as services, and attempted to load a driver rootkit all from inside the SYSTEM level process while Malware Fighter was running with full protection?

[yowanvista]

This is not possible in 64-bit systems because the kernel is protected from possible attempts of tampering

[captainron]

This is not possible in 64-bit systems because the kernel is protected from possible attempts of tampering

 

TDSS and other industrial level rootkits do. Some of those spread via such remote code executions.

 

Here are some other ways:http ://uninformed.org/index.cgi?v=3&a=3&p=15