Feeds

One thumb up for MS Security Essentials in early tests

Detection fair but clean-up lacking, reports AV-Test.org

5 things you didn’t know about cloud backup

Independent testing lab AV-Test.org has published one of the first reviews of Microsoft Security Essentials, Redmond's freebie anti-virus package.

The software earned favourable comparison with other free packages, such as AVG and Avast. Detection rates were respectable and the product scored plaudits in avoiding false positives, a perennial problem for anti-virus scanner where legitimate files are detected as potentially malign and put into quarantine, sometimes hobbling systems in the process.

Most of the worst problems occur when anti-virus scanners decide that Windows systems files might be dodgy. Microsoft has an obvious advantage in been able to avoid such problems. Even so, minimising the risk of false positives is a big plus mark for Microsoft Security Essentials.

Scan speed for the product was fair and rootkit removal was good. The main deficiency identified in the product was a lack of effective behaviour-based malware detection, a feature Redmond claims was bundled with Microsoft Security Essentials. There's also scope for improvement in the clean-up process. Malware infections left Windows firewall turned off even after disinfection using Security Essentials, for example.

AV-Test.org first tested Microsoft Security Essentials against 3,732 malware samples from the WildList (a standard test set of malware known to be in circulation). All the samples were successfully detected and blocked during on-demand and on-access tests. Security Essentials has been in development for months, so problems in detecting standard malware threats with a launch product would have been a major fail.

Microsoft Security Essentials also coped reasonably well against a larger set of malware, as AV-Test.org reports.

We continued testing the detection rates of Microsoft Security Essentials on Windows XP. For this, we used our set of 545,034 current malware samples, including viruses, worms, backdoors, bots and trojan horses. MSSE was able to detect 536,535 samples what's a very good detection score of 98.44 per cent.

In case of the ad-/spyware testset, MSSE detected 12,935 out of 14,222 samples what's a detection score of 90.95 per cent. We found no false positives during our scan of 600,000 known clean files from Windows, Office and other common applications (as the majority of these files are from Microsoft, everything else would be a big surprise.

So far so good - but in tests on dynamic malware detection, Security Essentials came up short.

We have then tested the dynamic (behavior-based) detection with a few recently released malware samples which are not yet detected by heuristics, signatures or the "in the cloud" features. We found no effective "dynamic detection" features in place. None of the samples were detected based on their (suspicious) behavior. However, other AV-only offerings doesn't include dynamic detection features either, in most cases they are only available in the Internet Security Suites editions of the products.

Detection and cleaning of already infected Windows PCs worked but AV-Test.org noted that in many cases, "traces of the infection were left behind (eg some inactive executable files, empty 'Run' entries in the Registry, the Windows firewall remains disabled, the 'hosts' file remains modified".

The software is available for Windows machines running Windows XP SP2 or later, Vista and Windows 7. Users have to validate their copy of Windows using the sometimes irksome Windows Genuine Advantage utility. Counterfeit copies of Windows are excluded from running the software, so infected machines there will continue to harbour the botnet agents and Trojans Microsoft is keen to eradicate from the Windows eco-system.

Consumers with legitimate copies of Windows can download the software from Microsoft's microsite here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.