Feeds

One thumb up for MS Security Essentials in early tests

Detection fair but clean-up lacking, reports AV-Test.org

The Essential Guide to IT Transformation

Independent testing lab AV-Test.org has published one of the first reviews of Microsoft Security Essentials, Redmond's freebie anti-virus package.

The software earned favourable comparison with other free packages, such as AVG and Avast. Detection rates were respectable and the product scored plaudits in avoiding false positives, a perennial problem for anti-virus scanner where legitimate files are detected as potentially malign and put into quarantine, sometimes hobbling systems in the process.

Most of the worst problems occur when anti-virus scanners decide that Windows systems files might be dodgy. Microsoft has an obvious advantage in been able to avoid such problems. Even so, minimising the risk of false positives is a big plus mark for Microsoft Security Essentials.

Scan speed for the product was fair and rootkit removal was good. The main deficiency identified in the product was a lack of effective behaviour-based malware detection, a feature Redmond claims was bundled with Microsoft Security Essentials. There's also scope for improvement in the clean-up process. Malware infections left Windows firewall turned off even after disinfection using Security Essentials, for example.

AV-Test.org first tested Microsoft Security Essentials against 3,732 malware samples from the WildList (a standard test set of malware known to be in circulation). All the samples were successfully detected and blocked during on-demand and on-access tests. Security Essentials has been in development for months, so problems in detecting standard malware threats with a launch product would have been a major fail.

Microsoft Security Essentials also coped reasonably well against a larger set of malware, as AV-Test.org reports.

We continued testing the detection rates of Microsoft Security Essentials on Windows XP. For this, we used our set of 545,034 current malware samples, including viruses, worms, backdoors, bots and trojan horses. MSSE was able to detect 536,535 samples what's a very good detection score of 98.44 per cent.

In case of the ad-/spyware testset, MSSE detected 12,935 out of 14,222 samples what's a detection score of 90.95 per cent. We found no false positives during our scan of 600,000 known clean files from Windows, Office and other common applications (as the majority of these files are from Microsoft, everything else would be a big surprise.

So far so good - but in tests on dynamic malware detection, Security Essentials came up short.

We have then tested the dynamic (behavior-based) detection with a few recently released malware samples which are not yet detected by heuristics, signatures or the "in the cloud" features. We found no effective "dynamic detection" features in place. None of the samples were detected based on their (suspicious) behavior. However, other AV-only offerings doesn't include dynamic detection features either, in most cases they are only available in the Internet Security Suites editions of the products.

Detection and cleaning of already infected Windows PCs worked but AV-Test.org noted that in many cases, "traces of the infection were left behind (eg some inactive executable files, empty 'Run' entries in the Registry, the Windows firewall remains disabled, the 'hosts' file remains modified".

The software is available for Windows machines running Windows XP SP2 or later, Vista and Windows 7. Users have to validate their copy of Windows using the sometimes irksome Windows Genuine Advantage utility. Counterfeit copies of Windows are excluded from running the software, so infected machines there will continue to harbour the botnet agents and Trojans Microsoft is keen to eradicate from the Windows eco-system.

Consumers with legitimate copies of Windows can download the software from Microsoft's microsite here. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.