Microsoft's OneCare improves antivirus test ranking
627402
Microsoft Corp.'s Windows Live OneCare climbed from March's dead last to 14th place in a test of 17 antivirus programs, an Austrian security researcher reported.
724732
(InfoWorld) - Retailers have begun taking orders for Symantec's next-generation desktop security software, and the product is set to ship in the middle of next month, according to Amazon.com. Symantec has been working on the software for more than a year and is heavily marketing it as an alternative to Microsoft's Windows Live OneCare and McAfee's Total Protection 2007. Like its competitors, Norton 360 can be used to back up files, and the software also delivers new encryption, hard drive clean-up, and password-protection features. The software, which is sold on an annual subscription basis, has been beta tested by more than 100,000 users since it was released in beta late last November. Symantec had said it was expecting to ship Norton 360 sometime in March, and over the past few days, Amazon has begun accepting orders for the product, which will be released to Amazon customers on March 15, according to the company's Web site. Norton 360, which can be used by as many as three PCs simultaneously, is list-priced at $76.99, but Symantec is offering a $20 rebate, putting the Amazon.com price at $56.99. That's a lower list price than McAfee's comparable Total Protection software, which lists at $99.99, but after rebates and pricing breaks, a three-license version of Total Protection can be had on Amazon.com for just $39.99. Windows Live OneCare has the lowest list price of the three products, just $49.95. It can be purchased on Amazon.com for $37.49.
255954
Technical support improvements lead to better overall scores for PC industry.
104408
A software patch to protect your system is available from Microsoft.
65644
The free service pack is a major overhaul aimed at defeating a wide variety of security weaknesses that hackers have exploited. Microsoft says the easiest way to obtain
759367
Microsoft has launched a beta of Windows Live OneCare Family Safety, aimed at protecting families online. The application includes content filtering, contact management, activity reports, and guidance on online safety issues.
411156
Microsoft's consumer security software changes the AU (Automatic Updates) settings in Windows XP and Vista without telling users or getting their approval, a researcher said Thursday -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.Scott Dunn, an editor at the "Windows Secrets" newsletter, reported Thursday morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option."Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec's Norton 360 and Norton Internet Security, McAfee's Internet Security Suite, and Check Point Software's ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had."I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."Four options, down to one In both Windows XP and Vista, users can select from four options in AU: Download and install all updates automatically; download files but do not install them without user consent; check for but neither download nor install without permission; and disable Automatic Updates entirely.OneCare, sold for $49.95 and offered as a free 90-day trial, sets AU to the first, and all-automatic, setting, said Dunn, on both operating systems. "It does that even if Automatic Updates is completely disabled," he added. If users later uninstall OneCare -- for instance, after a trial has expired -- the software does not return the machine to the earlier settings; they must be reset by the user."Worse, OneCare silently turns on [Windows] services that have been disabled by the user," Dunn said, referring to the two services that some users, frustrated at earlier incidents in which Windows retrieved and installed patches without permission, have manually turned off: Automatic Updates and Background Intelligent Transfer Service. The services can be switched off manually using the Windows services.msc utility. Normally, once disabled, they remain that way until the user manually turns them back on.ComputerWorld confirmed Dunn's account of OneCare's AU changes by installing the security suite on both Windows XP and Windows Vista.At no time during installation, said Dunn, does OneCare tell the user that the software will modify Windows' settings or provide an opt-in dialog. Nor do the various online documents -- including Microsoft's privacy statement and an addendum for OneCare -- that are offered up early during the process contain any information about the changes. "It turns out there's a brief mention of it buried deep in one of the OneCare help files," said Dunn. "But that's not the same as telling users upfront."The help file (select "What does Windows Live Update do to help manage and maintain my computer's software updates?" to view the pertinent section) acknowledges that OneCare makes changes without bothering to ask. "When you first install Windows Live OneCare, setup automatically enlists your computer in Microsoft Update and changes your computer's settings to download and install updates automatically using Automatic Updates," it reads.Who's 'forgetful' now? Although Microsoft was not immediately available for comment this morning, it made it clear last week that reports of unauthorized updates, and even PC reboots, could not be blamed on its software."I want to stress that the Windows Update client does not change AU settings without users' consent," said Nate Clinton, a program manager with the Microsoft Update team in a company blog entry a week ago. He went on to list five possible explanations; all require the user to take action or accept one option from several offered.Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing/remembering doing so," she said last Tuesday. She also called out OneCare's installation as one such possible moment and claimed that the security suite offered users the option of changing AU settings. It does not."This is just one more example of Microsoft having the attitude that we know better than you do, that you should just stop asking questions and let us do what we want," said Dunn.Computerworld is an InfoWorld affiliate
410495
Windows Live OneCare has once again come up with a failing grade, as it was disclosed Monday the program had not passed a virus test by the AV Comparatives organization. The failure means that Microsoft will not receive any type of certification from the group.
115619
What is this thing you call heuristics? Antivirus software is getting worse at protecting users from new threats, according to two reports which found malware authors are getting better at disguising their creations.â¦
236050
'Virtual security solution' is designed to slow virus and malware attacks.
537829
New packages promote promise of improved PC security.
176002
Taking the gloves off Software is unstable, full of bugs and bloated. Developers spend so much time adding new features that software testing is a last minute thing. Even the mantra of "designed secure" has failed to really improve the quality of software - just witness the number of day zero attacks against Microsoft.â¦
182207
Following Microsoft's lead, software maker opts to issue fixes on a monthly timetable. But does that make customers more secure?
503690
(InfoWorld) - Antivirus software is frequently tested for performance, so picking a top product should be straightforward: Select the No. 1 vendor whose software kills off all of the evil things circulating on the Internet. You're good to go then, right? Not necessarily. The increasing complexity of security software is causing vendors to gripe that current evaluations do not adequately test other technologies in the products designed to protect machines. Relations between vendors and testing organizations are generally cordial but occasionally tense when a product fails a test. Representatives in both camps agree that the testing regimes need to be overhauled to give consumers a more accurate view of how different products compare. "I don't think anyone believes the tests as they are run now ... are an accurate reflection of how one product relates to the other," said Mark Kennedy, an antivirus engineer with Symantec. Representatives of Symantec, F-Secure,Â and Panda SoftwareÂ agreed last month at the International Antivirus Testing Workshop in Reykjavik, Iceland, to design a new testing plan that would better reflect the capabilities of competing products. They hope all security vendors will agree on a new test that can be applied industrywide, Kennedy said. A preliminary plan should be drawn up by September, Kennedy said. One of the most common tests involves running a set of malicious software samples through a product's antivirus engine. The antivirus engine contains indicators, called signatures, that enable it to identify harmful software. But antivirus products have changed over the last couple years, and "now many products have other ways of detecting and blocking malware," said Toralv Dirron, security lead system engineer for McAfee Inc. Signature-based detection is important, but an explosion in the number of unique malicious software programs created by hackers is threatening its effectiveness. As a result, vendors have added overlapping defenses to catch malware. Vendors are employing behavioral detection technology, which may identify a malicious program if it undertakes a suspicious action on a machine. A user may unwittingly download a malicious software program that is not detected through signatures. But if the program starts sending spam, the activity can be identified and halted. Also, a program can be halted if it tries to exploit a buffer overflow vulnerability, where an error in memory can allow a bad program to run. Host-based, intrusion-prevention systems, which can employ firewalls and packet inspection techniques, can also stop attacks. The ways in which a computer can be infected also make comprehensive testing complex. For example, users may infect their computers by opening malicious e-mail attachments or visiting harmful Web sites designed to exploit known vulnerabilities in a Web browser. The different modes of attack also involve different defenses, all of which would need to be tested to arrive at an accurate ranking, analysts said. By contrast, signature-based tests can take as little as five minutes. "This is a very basic test," said Andreas Marx of AV-Test.org, who wrote his master's degree thesis on antivirus testing. "It's easy, and it's cheap." Other concerns remain, over sample sets of malicious software, the age of the samples and the relative threat those samples pose on the Internet as they become older. Security vendors also think tests should check how well security applications remove bad programs, a process that can affect a computer's performance. For vendors, a failed test can be embarrassing, since the testing companies often issue news releases highlighting the latest results. Testing companies make money in various ways. AV-Test.org is often commissioned by technology magazines such as PC World (a magazine owned by IDG). Virus Bulletin licenses its logo to companies for use in promotional material and publishes a monthly online magazine. Earlier this month, Virus Bulletin announced that its latest round of testing produced some "big-name failures," including products from Kaspersky Lab and Grisoft SRO. The company's VB100 tests antivirus engines against malware samples collected by the Wildlist Organization International, a group of security researchers who collect and study malware. To pass the VB100, products must detect all samples. Kaspersky briefly removed a signature for a worm out of its product for "optimization" purposes on the day of the test, wrote Roel Schouwenberg, senior research engineer for Kaspersky, in an e-mail. The signature has since been put back in, he said. "Obviously, we would have rather passed than failed," Schouwenberg wrote. "Had the test been conducted a day earlier or a day later, we would have passed." Similarly, F-Secure initially failed its test also because of a technicality, but the failed rating was later reversed. All vendors are told after testing which samples they failed to detect, thus most end up adding signatures to their products. So what should a user do? John Hawes, a technical consultant for Virus Bulletin, cautioned that the signature-based tests are "not enormously representative of the way things are in the real world." But Hawes also noted that signature-based tests can indicate the reliability and consistency of a vendor's software. Virus Bulletin also writes reviews of AV suites, which take into account aspects such as usability, which may be just as important as detection for consumers. The company is developing more advanced tests that will test new security technologies. AV-Test.org is already performing more comprehensive tests, although it uses between 30 to 50 malware samples, a much smaller sample set compared to the Wildlist, which uses more than 600,000 samples, Marx said. Those tests may give a better indication of how a security software suite performs. At a bare minimum, through, users should install some security software, as computers without it can face high risks, Marx said. Several free suites are available that may be fine for light Internet use, he said. Ironically, Marx doesn't use any antivirus software. That's because AV-Test.org collects malware for its testing, most of which comes through e-mail from other researchers. "I'm getting about 1,000 viruses a day," he said. "It [antivirus software] would be counterproductive." Â
585588
Microsoft on Thursday released a test version of its new Forefront Security for SharePoint software. The product is based on the Antigen software Microsoft picked up in its acquisition of Sybari Software.
706555
A false positive in company's antivirus products leads to quarantine or deletion of some Windows users' copies of explorer.exe.
15038
A rash of users of Microsoft's new Windows Live OneCare service, launched last January 30, have been reporting on Microsoft's support forums that virus scans performed by the service have resulted in the deletion of their OUTLOOK.PST files - the local, centralized repositories of e-mail, scheduling, and collaboration data used by Outlook.