  Modern malware and spyware platforms attack existing antivirus solutions and
even Microsoft PatchGuard. To protect users and business systems new
technologies developed by Intel and AMD CPUs may be applied. To deal with the
new malware we propose monitoring and controlling access to the memory in real
time using Intel VT-x with EPT. We have checked this concept by developing
MemoryMonRWX, which is a bare-metal hypervisor. MemoryMonRWX is able to track
and trap all types of memory access: read, write, and execute. MemoryMonRWX
also has the following competitive advantages: fine-grained analysis, support
of multi-core CPUs and 64-bit Windows 10. MemoryMonRWX is able to protect
critical kernel memory areas even when PatchGuard has been disabled by malware.
Its main innovative features are as follows: guaranteed interception of every
memory access, resilience, and low performance degradation.
