Feeds

One thumb up for MS Security Essentials in early tests

Detection fair but clean-up lacking, reports AV-Test.org

High performance access to file storage

Independent testing lab AV-Test.org has published one of the first reviews of Microsoft Security Essentials, Redmond's freebie anti-virus package.

The software earned favourable comparison with other free packages, such as AVG and Avast. Detection rates were respectable and the product scored plaudits in avoiding false positives, a perennial problem for anti-virus scanner where legitimate files are detected as potentially malign and put into quarantine, sometimes hobbling systems in the process.

Most of the worst problems occur when anti-virus scanners decide that Windows systems files might be dodgy. Microsoft has an obvious advantage in been able to avoid such problems. Even so, minimising the risk of false positives is a big plus mark for Microsoft Security Essentials.

Scan speed for the product was fair and rootkit removal was good. The main deficiency identified in the product was a lack of effective behaviour-based malware detection, a feature Redmond claims was bundled with Microsoft Security Essentials. There's also scope for improvement in the clean-up process. Malware infections left Windows firewall turned off even after disinfection using Security Essentials, for example.

AV-Test.org first tested Microsoft Security Essentials against 3,732 malware samples from the WildList (a standard test set of malware known to be in circulation). All the samples were successfully detected and blocked during on-demand and on-access tests. Security Essentials has been in development for months, so problems in detecting standard malware threats with a launch product would have been a major fail.

Microsoft Security Essentials also coped reasonably well against a larger set of malware, as AV-Test.org reports.

We continued testing the detection rates of Microsoft Security Essentials on Windows XP. For this, we used our set of 545,034 current malware samples, including viruses, worms, backdoors, bots and trojan horses. MSSE was able to detect 536,535 samples what's a very good detection score of 98.44 per cent.

In case of the ad-/spyware testset, MSSE detected 12,935 out of 14,222 samples what's a detection score of 90.95 per cent. We found no false positives during our scan of 600,000 known clean files from Windows, Office and other common applications (as the majority of these files are from Microsoft, everything else would be a big surprise.

So far so good - but in tests on dynamic malware detection, Security Essentials came up short.

We have then tested the dynamic (behavior-based) detection with a few recently released malware samples which are not yet detected by heuristics, signatures or the "in the cloud" features. We found no effective "dynamic detection" features in place. None of the samples were detected based on their (suspicious) behavior. However, other AV-only offerings doesn't include dynamic detection features either, in most cases they are only available in the Internet Security Suites editions of the products.

Detection and cleaning of already infected Windows PCs worked but AV-Test.org noted that in many cases, "traces of the infection were left behind (eg some inactive executable files, empty 'Run' entries in the Registry, the Windows firewall remains disabled, the 'hosts' file remains modified".

The software is available for Windows machines running Windows XP SP2 or later, Vista and Windows 7. Users have to validate their copy of Windows using the sometimes irksome Windows Genuine Advantage utility. Counterfeit copies of Windows are excluded from running the software, so infected machines there will continue to harbour the botnet agents and Trojans Microsoft is keen to eradicate from the Windows eco-system.

Consumers with legitimate copies of Windows can download the software from Microsoft's microsite here. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.