SE Labs

Special Edition
Computer security testing comment and analysis from SE Labs

Anti-virus certification and ELAM

A route to accessing Windows Early Launch Antimalware (ELAM).

Anti-virus certification and ELAM

Anti-malware products monitor Microsoft Windows for malware. They try to notice when new, unwanted software runs, but some malware can be extra sneaky and hide. To get ahead of the game anti-malware products can start monitoring the system early, before other software applications start. The security software then watches as the various programs load during the Windows boot-up process.

Early Launch AntiMalware

Annual Report 2021

While it is possible to run anti-malware software before other programs, it requires access to a special feature built into Windows. This is called Early Launch AntiMalware (ELAM).

Security vendors can create ELAM drivers that load earlier than many other applications. This gives them an early view on the system and they could potentially prevent malicious drivers and other malware from loading when Windows starts up.

As Microsoft puts it, “AM drivers are initialized first and allowed to control the initialization of subsequent boot drivers, potentially not initializing unknown boot drivers.”

How to get in early

Vendors can’t just write a special driver and wedge it into the early stages of the Windows boot process, though. It has to meet various requirements. These include:

SE Labs works with Microsoft to help security vendors gain access to this important feature. While we can’t help companies to write their drivers, we can help with MVI membership. Each MVI member must have its security solution certified annually by a recognised testing organisation. SE Labs is one such test lab.

For example, a product that achieves at least an ‘A’ rating in an SE Labs enterprise, small business or home user endpoint protection tests subsequently fulfills Microsoft’s certification requirement.

SE Labs anti-virus certification can help security vendors access ELAM. If you are a security vendor and need certification please contact us now.

Sign up to our monthly business and personal security newsletters.

Find out more

Our security test reports for enterprise, small business and home users are available for free.

Please download them and follow us on Twitter and/or LinkedIn to receive news, comment, updates and future reports.

Sign up to our monthly business and personal security newsletters.

See all blog posts relating to test results.

About

SE Labs Ltd is a private, independently-owned and run testing company that assesses security products and services. The main laboratory is located in Wimbledon, South London. It has excellent local and international travel connections. The lab is open for prearranged client visits.

Contact

SE Labs Ltd
Hill Place House
55A High Street
Wimbledon
SW19 5BA

020 3875 5000

info@selabs.uk

Press