Trusteer endpoint protection removal tool

broken image
broken image

A check of Task Manager showed 2 separate unkillable processes. I was first made aware of it earlier this week when my boss asked me about it based on something funky he'd seen on his office PC's screen. One thing's for sure, this thing is sneaky. If the program is a requirement, I've got a massive number of regulatory questions as the rootkit nature of this thing implies massive reputation risk issues on the part of the bank, especially given how the vendor advertises that they burrow deep into the kernel. I just learned of this thing a couple of days ago and don't know if the bank in question requires accepting this thing in order to maintain an online banking relationship. Change management is a hard job, this doesn't read like software that gonna do you any favors.Īnd that's my issue.

broken image

This reads ripe for nasty interactions with OS patches and service packs especially. To be more succinct, who knows how much software compatibility that tool will break.

broken image

Again - it might work great - but you now have an extra variable in terms of support when evaluating the abilty of that branch to migrate to updated or new software. That being said, I start to draw the line at security programs that are excited about the fact they are essentially rootkits.