Hi Randissimo,
Let's clear up some things. I am not member of avast tim, nor of his developer department.
I am not associated with aswMBR developer department but I have access to some information that makes me feel competent to say a thing with certificate.
aswMBR is product of joint forces of Gmerek and avast Tim.
I am member of big alliance of Security Forum that does provide valid Malware Removal assistance.
Also know this. I would also like for aswMBR to be compatible with Windows 8.x systems, but it is not. As I need diagnostics for kernel RootKit, not to pay attention to what software displays on the screen, for valid ARK diagnostics I can not rely on aswMBR to Windows 8, which just has a lot of changes compared to Windows 7
Also, I do not care what you're gonna use it. I just telling you how things are.
Then tell me why it stops exactly on the same part, why it even bothers to load+scan files and why there is a software compatibility issue with Visual Studio.
[...]
What's your basis that it cannot be a simple "software" problem because of the new Defender when there still exists a known compatibility issue with Visual Studio even on earlier Windows versions?
It does not matter where stalls. It's load and preform because it's made so to work. Visual Studio is software working on userspace, does not have any driver loaded in kernel.
Simple software as you say works in userspace. Windows Defender on Windows 8 is AntiVirus, therefore it's owns his own loaded drivers in kernel.
Are you standing for what you're talking on about the aswmbr.exe issues on a knowledge basis or is that just an answer you've learned and/or are told to write?
I am standing to tell you that ARK tools are something else, they work differently and can not be measured with generic diagnostic tools that run in userspace level. The same goes for simple software. It's not always that simple ...run and scan.
Moreover, Windows 8 & 8.1 goes with usual GPT partition then MBR partition. For now, there is no way to use the GPT malicious purposes.
Moreover, x64bit Widndows editions ( including Win 8.x) own Kernel Patch Protection + Driver Signing Policy on x64. Un-signed driver can NOT be loaded in kernel.
Moreover, Windows 8.x have something that is called Secure Boot. In short, prevents any malicious kernel-level RootKit to be loaded into the system
Also, beginning with Windows 8 UEFI Secure Boot-enabled platforms have additional signing requirements, including requirements for ARM platforms. The driver code signing policy for 32-bit versions of Windows 8 UEFI Secure Boot-enabled platforms also requires drivers have a digital signature.
aswMBR reads MBR, it read partitions, then it uses his own heuristics to scan drivers (kernel) that it uses avast! engine to scan drivers.
Keep in mind that the aswMBR primarily set up to do diagnostics and Fix for first version MBR-based RootKits like TDL4/3, Sinowal and Whistler, never upgraded (at least not so often) to recognize and later versions of RootKit. aswMBR does that using his heuristics scan.
If you wanna ARK check on Windows 8.x, you may use TDSSKiller or MBAR it searches for malware that is larger rank and therefore scan takes longer.
But if you understand me right, you're be wondering, does I realy need ARK scan on Windows 8 !?
Also, when you write "avast! can detect known RootKits as well", are you referring to boot-time scans, to the scans from the created rescue disk or to the normal scan?
avast! is AntiVirus, therefore it has strongest system privileges (kernel driver as well) and therefore is able to detect known kernel-level RootKit. It has nothing to do with boot time scan, that's something else...
Edit: Maybe you these semantics help you to understand better
