Microsoft has blocked a Trend Micro driver from running on Windows 10 – and Trend has withdrawn downloads of its rootkit detector that uses the driver – after the code appeared to game Redmond’s QA tests.

Late last week, Trend removed downloads of its Rootkit Buster from its website. And last night it emerged the kernel-level driver at the heart of the software, tmcomm.sys, was added to Windows 10 20H1’s list of blocked drivers – preventing it from loading and Rootkit Buster from running.

Windows internals guru and CrowdStrike veep Alex Ionescu discovered the blockade, and highlighted it on Twitter, while investigating research by computer security undergrad Bill Demirkapi that revealed not only shortcomings in the driver’s code but also an effort to detect Microsoft’s QA test suite.

Demirkapi, as we reported last week, discovered tmcomm.sys altered the way it allocated memory to pass Microsoft’s Windows Hardware Quality Labs (WHQL) certification tests.

Passing these tests is highly desirable: if a driver meets the grade, it can be digitally signed by Microsoft, is trusted by Windows, and potentially can be distributed via Windows Update and similar mechanisms.

Source: The Register


  • About

    Destabilizing cishetero amatonormativity. Providing disruption as a service. Once you know the way, you see it in all things. Unless you puke, faint or die, keep going. Also we never asked for this. I̸͝t̸̑ ̵̽i̷͗s̶͐ ̵͝a̶͒l̷ ͍r̷ ̗͕e̵͑a̶͌d̸̄y̷̚ ̶̀ ͓͑t̷̚ô̶o̸ ̥ ̶́ ̡l̷͝a̶̽t̵͒ė̶.̸ ̋͑

  • Got something interesting?

    You think you got something which should be on this site? Then contact us. You want something removed from this site, because you think it should not be here? Then go fuck yourself. This is a free website. Free as in freedom. It tolerates every opinion from everyone. However, it does not tolerate things which are illegal according to the Swiss legislation.

  • Disclaimer

    We cannot be held responsible for any kind of direct, indirect or consequential damages caused by the stuff and or opinions we provide here. Use this on your own risk. Don’t blame us if something goes wrong or totally messes up your machine, your life or whatever. If this is unacceptable for you then go away and never come back again. Thank you!