Feeds

One thumb up for MS Security Essentials in early tests

Detection fair but clean-up lacking, reports AV-Test.org

Protecting users from Firesheep and other Sidejacking attacks with SSL

Independent testing lab AV-Test.org has published one of the first reviews of Microsoft Security Essentials, Redmond's freebie anti-virus package.

The software earned favourable comparison with other free packages, such as AVG and Avast. Detection rates were respectable and the product scored plaudits in avoiding false positives, a perennial problem for anti-virus scanner where legitimate files are detected as potentially malign and put into quarantine, sometimes hobbling systems in the process.

Most of the worst problems occur when anti-virus scanners decide that Windows systems files might be dodgy. Microsoft has an obvious advantage in been able to avoid such problems. Even so, minimising the risk of false positives is a big plus mark for Microsoft Security Essentials.

Scan speed for the product was fair and rootkit removal was good. The main deficiency identified in the product was a lack of effective behaviour-based malware detection, a feature Redmond claims was bundled with Microsoft Security Essentials. There's also scope for improvement in the clean-up process. Malware infections left Windows firewall turned off even after disinfection using Security Essentials, for example.

AV-Test.org first tested Microsoft Security Essentials against 3,732 malware samples from the WildList (a standard test set of malware known to be in circulation). All the samples were successfully detected and blocked during on-demand and on-access tests. Security Essentials has been in development for months, so problems in detecting standard malware threats with a launch product would have been a major fail.

Microsoft Security Essentials also coped reasonably well against a larger set of malware, as AV-Test.org reports.

We continued testing the detection rates of Microsoft Security Essentials on Windows XP. For this, we used our set of 545,034 current malware samples, including viruses, worms, backdoors, bots and trojan horses. MSSE was able to detect 536,535 samples what's a very good detection score of 98.44 per cent.

In case of the ad-/spyware testset, MSSE detected 12,935 out of 14,222 samples what's a detection score of 90.95 per cent. We found no false positives during our scan of 600,000 known clean files from Windows, Office and other common applications (as the majority of these files are from Microsoft, everything else would be a big surprise.

So far so good - but in tests on dynamic malware detection, Security Essentials came up short.

We have then tested the dynamic (behavior-based) detection with a few recently released malware samples which are not yet detected by heuristics, signatures or the "in the cloud" features. We found no effective "dynamic detection" features in place. None of the samples were detected based on their (suspicious) behavior. However, other AV-only offerings doesn't include dynamic detection features either, in most cases they are only available in the Internet Security Suites editions of the products.

Detection and cleaning of already infected Windows PCs worked but AV-Test.org noted that in many cases, "traces of the infection were left behind (eg some inactive executable files, empty 'Run' entries in the Registry, the Windows firewall remains disabled, the 'hosts' file remains modified".

The software is available for Windows machines running Windows XP SP2 or later, Vista and Windows 7. Users have to validate their copy of Windows using the sometimes irksome Windows Genuine Advantage utility. Counterfeit copies of Windows are excluded from running the software, so infected machines there will continue to harbour the botnet agents and Trojans Microsoft is keen to eradicate from the Windows eco-system.

Consumers with legitimate copies of Windows can download the software from Microsoft's microsite here. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.