Windows 7 XP mode cripples Malware

[KarmaKiller]

Quote:

Additionally, Windows 7's XP Mode is likely to cause more headaches for attackers. XP Mode is implemented using hardware virtualization extensions. A common hacker tool -- rootkits -- rely on hardware virtualization and a special privilege level called VMX root mode. With the OS now using hardware virtualization, attempts to gain the privileges necessary to launch the special hardware virtualization support needed by the rootkit tends to crash the OS or provide the user with warnings. For this reason Blue Pill, one common rootkit, doesn't work well in Windows 7.

Many malware programs will also be crippled by XP-Mode. This is because in the past Windows security software has used hardware virtualization extensions to detect malware. It is common practice for malware to be written to not run on machines where hardware-assisted virtualization is detected. However, as all Windows 7 Professional and Ultimate licenses come with XP Mode, this malware won't run on a large portion of Windows 7 installs. Modification is possible, but this will be time consuming and frustrating to attackers.

Source

Looks like MS got it right on many fronts.