2009-09-30

Morro / Microsoft Security Essentials vs OneCare / Sybari / ForeFront

Microsoft released their new free Anti Virus and Anti Malware software yesterday, originally codenamed "Morro", this new iteration entitled Microsoft Security Essentials promises piece of mind for free, but the question you ask is will the free software be as good as the paid for OneCare software that was available a year ago and how will it compare to other leading engines?

Unfortunately there is no "quick" answer to this "quick" question; "Morro" supposedly uses the same underlying engine as Forefront and OneCare. I have my doubts on how closely the engine operates compared to OneCare based on the fact that the Morro team based in Israel spent nine months recoding the engine under Ray Ozzie's watchful eye until release yesterday.

The Guardian has a good exclusive here.

Virus Bulletin (www.virusbtn.com) carries out the VB100 independent testing, the detection rates for OneCare were improving with each iteration of testing but you have to ask yourself the question of which operating system and architecture you are testing under. Some engines perform better under XP than they would under an NT based kernel. By the same logic, some engines can outstrip their peers under multiple cored processing or x64 architecture. I should know, I used to work for Microsoft and it was my job to constantly reassess engine performance against a number of different engines against a host of different architectures and operating systems.

Probably the best thing to do is set up an account with Virus Bulletin and compare the test results, but don't expect a clear black and white answer. OneCare served customers well ... you got good detection rates for known malware AND for potential malware under XP and Vista. If Morro is as good as OneCare then you get all that for free, that would be VERY good ... but there is a "but", and a big one ... Morro does something that OneCare didn't do and I expect this to affect the next iteration of VB100 testing greatly. Morro scans unknown potential malware in the cloud, when the Morro engine finds something it thinks might be malware it contacts servers at Redmond for hore powerful heuristic scanning. Good security sense but it may severely impact scan times for non-US based customers.

I have high hopes for Morro, Microsoft put customer security first and foremost with Bill Gates' vision of Trustworthy Computing and then seemed to backtrack in 2006 by charging for OneCare. Morro breathes life back into Gates' vision by ensuring that customer security comes before profits but will EU anti-competition legislation agree?