Protecting anti-malware processes

摘要

Anti-malware process protection techniques are described. In one or more implementations, an anti-malware driver is signed using a hash that identifies a manufacturer of the anti-malware driver. The anti-malware driver is then provided to a computing device. The anti-malware driver may be assigned a protection level based on an agreement between the anti-malware manufacturer and an operating system manufacturer, and this protection level effects the operation of the anti-malware program on the computing device.

主权项

1. A method comprising:
signing an anti-malware driver by one or more computing devices with a signature verifiable to determine authenticity of the anti-malware driver through comparison of the signature to a verified signature from a trusted source to determine if the anti-malware driver originated from the trusted source; based on the verified signature, associating the anti-malware driver with at least one of a plurality of protection levels associated with anti-malware process protection techniques of the anti-malware driver, the plurality of protection levels defining which processes are permitted access to the anti-malware driver during execution by a computing device; and providing the anti-malware driver by the one or more computing devices to the computing device for execution.