2009-09-30

Morro / Microsoft Security Essentials vs OneCare / Sybari / ForeFront

Microsoft released their new free Anti Virus and Anti Malware software yesterday, originally codenamed "Morro", this new iteration entitled Microsoft Security Essentials promises piece of mind for free, but the question you ask is will the free software be as good as the paid for OneCare software that was available a year ago and how will it compare to other leading engines?

Unfortunately there is no "quick" answer to this "quick" question; "Morro" supposedly uses the same underlying engine as Forefront and OneCare. I have my doubts on how closely the engine operates compared to OneCare based on the fact that the Morro team based in Israel spent nine months recoding the engine under Ray Ozzie's watchful eye until release yesterday.

The Guardian has a good exclusive here.

Virus Bulletin (www.virusbtn.com) carries out the VB100 independent testing, the detection rates for OneCare were improving with each iteration of testing but you have to ask yourself the question of which operating system and architecture you are testing under. Some engines perform better under XP than they would under an NT based kernel. By the same logic, some engines can outstrip their peers under multiple cored processing or x64 architecture. I should know, I used to work for Microsoft and it was my job to constantly reassess engine performance against a number of different engines against a host of different architectures and operating systems.

Probably the best thing to do is set up an account with Virus Bulletin and compare the test results, but don't expect a clear black and white answer. OneCare served customers well ... you got good detection rates for known malware AND for potential malware under XP and Vista. If Morro is as good as OneCare then you get all that for free, that would be VERY good ... but there is a "but", and a big one ... Morro does something that OneCare didn't do and I expect this to affect the next iteration of VB100 testing greatly. Morro scans unknown potential malware in the cloud, when the Morro engine finds something it thinks might be malware it contacts servers at Redmond for hore powerful heuristic scanning. Good security sense but it may severely impact scan times for non-US based customers.

I have high hopes for Morro, Microsoft put customer security first and foremost with Bill Gates' vision of Trustworthy Computing and then seemed to backtrack in 2006 by charging for OneCare. Morro breathes life back into Gates' vision by ensuring that customer security comes before profits but will EU anti-competition legislation agree?

2009-06-29

Windows 7 and Anti Virus

For those of you that were keen to get involved with either the Beta or RC versions of Windows 7, you may have noticed that the operating system was quick to highlight deficiencies with certain products that you may have previously installed on Windows Vista.

Grisoft's AVG was always a popular candidate for installing on your third-cousin-twice-removed's laptop but there are plenty of alternatives out there for the home user. When looking for an AV engine of choice, ensure you choose it for the right reasons. I always consult the VB100 and AV-Test.org test results to make a more informed decision. With that said, I also conduct my own strenuous testing on the core components and interoperability with other core components, everyone has their own needs.

My latest AV engine of choice for home user installations of the Windows 7 Beta is either:

Windows Security Essentials Beta (32 bit / 64 bit downloads from Softpedia)
or
Avira's free desktop engine

... of course, there are others.

Whilst Microsoft have pulled their Beta downloads from the Microsoft website, the installs are still available through Softpedia as outlined in the links above. Avira unfortunately throws a few advertising pop-ups from time to time. The Microsoft offering does not. Interestingly, Microsoft's Windows Security Essentials (codenamed "Morro") is the replacement for OneCare which previously was a paid-for subscription based product.

I can't help but think that Microsoft's decision to launch a free AV product is one of their best ideas ever and is a definitive realisation of Bill Gate's Trustworthy Computing initiative. From a business perspective it will also help strengthen their business-end product Forefront which likely uses the same signatures as the free client. As end-users feedback false positives and contaminated files found through heuristic analysis from the home user market, the new signatures developed will strengthen the business product also. This is an incredibly astute business decision and also a very responsible outcome from a long-term security perspective.