Slashdot Mirror
Malware Scanner Finds 5% of Windows PCs Infected
BogenDorpher writes "According to statistics generated by Microsoft's new free malware scanning and scrubbing tool, Safety Scanner, one in every twenty Windows PCs are infected with malware. Microsoft's Safety Scanner was downloaded 420,000 times in just one week of availability and it cleaned up malware or signs of exploitation from more than 20,000 Windows PCs, according to statistics generated by Microsoft's Malware Protection Center. This resulted in an infection rate of nearly 5%." That seems an awfully low number, based on how quickly Windows machines are scanned for plunder after going online; though it's a few years old, here's a report that suggests (as of 2007, at least) a grace period of less than 10 seconds. That was just one instance, and an intentionally vulnerable machine, but have improvements in security software software, and in Windows itself, made things so much better since then?
Most of the malware now is either socially engineered or exploiting third party software (Flash and PDF, I'm looking at you!). Frankly, every OS is vulnerable to those two and finally even Apple noted they're starting to get that problem on Macs.
I think this is more likely to have proven that the McAfee tool is crap.
Malwarebytes is pretty good, and I've heard Bullguard can sometimes get stuff that cannot.
-taosk8r
5% of PC's are malware infected and 5% of PC's are Macs. Coincidence much?
So a significant number of computers that downloaded the malware removal tool had malware on them. How is that surprising? Unless the installation of this tool is uniformly distributed amongst Windows users, which TFA is not entirely clear on...
Palm trees and 8
"Safety Scanner, which replaced an older online-only tool, uses the same technology and detection signatures as Microsoft's free consumer-grade Security Essentials antivirus program and its Forefront Endpoint Protection product for enterprises."
considering that by now everyone should run SOME anti virus, of which MSE is a legally free option, and that something which uses MSE's signature database finds 5% of machines have been compromised I don't think says much about computer security as a whole. Obviously there are a lot of users who *still* don't have anti virus software, which isn't really news. But MS can't exactly go including free anti virus in their OS without screams of anti trust.
That was just one instance, and an intentionally vulnerable machine [four years ago], but have improvements in security software software, and in Windows itself, made things so much better since then?
Yes.
Is it really surprising that computers with service packs, hot fixes, virus scanners, and firewalls are significantly more secure than those without?
Of course, it's also worth noting that the real infection rate is probably at least a little bit higher. The people who don't download this particular scanner are the same ones who wouldn't download the aforementioned service packets, hot fixes, virus scanners, and firewalls. The unanswered, and perhaps unanswerable, question is how many such people are out there.
I fixed one this afternoon: my parent's WinXP computer. Adjust your stats accordingly.
http://alternatives.rzero.com/
According to Mac Defender, 100% of all Macs are infested with malware.
Every new Hotmail account comes complete with no less than 10 emails promising 'bigGer Pen1s 4 hur plezures!" within the first thirty seconds of initial login.
Consistency is only a virtue if you're not a screw-up.
So it has been downloaded 420k times, so it is 5% of a very small and selective proportion of the installed base
Maybe the number is accurate, maybe it isn't. But the one thing that strikes me is that this is not an entirely random survey since there are too many factors that can affect the sampling. Examples: people who do not update their software (including but not limited to this scanner) are probably more likely to have an infected machine, making the number low. Yet institutional PCs that are professionally managed (and are likely to use third party solutions) are probably less likely less likely to be infected, making the number high. So that 5%, as good or as bad as it may sound to you, is actually just a number thrown around by the marketing department.
All this really 'proves' is that 95% of the people who are smart enough to download a free AV program didn't have an infection. Lets see, who uses those? Oh, I know! People who take precautions... When do they do it? BEFORE they get infected, lol.
While it is an interesting datapoint to hobknob about, this actually says ZILCH about Windows infection rate, except it probably can't possibly be LESS than 5%.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
Honestly? "as of 2007"? In computer terms, that's several lifetimes.
Not only that, but just because the news article linked to has 2007 at the top, doesn't mean the findings were from 2007. The news article in which the author "just read an incredible scary article" links to said incredible scary article - http://news.bbc.co.uk/2/hi/programmes/click_online/4423733.stm - from 2005. So not only was the news article writer 2 years behind the times, you're now suggesting that we should believe that you find it incredulous that things may have improved in 6 years' time?
In that time Windows 7 and Vista have been released - both with far better security models out of the box. Even Windows XP saw a reasonable update with SP3.
Then again, by April 2005, SP2 was also distributed and guess what it enabled by default? Windows Firewall. The worm in the original article, Sasser, would not have gotten very far.
Then again, Sasser would not even have been on the system if they bothered to install the update that fixed the hole that Sasser would eventually exploit.
It's just not a very convincing example to begin with, and certainly not one you should be citing 6 years later.
Same thing, right?
This issue is a bit more complicated than you think.
While I am glad that the online safety scanner can now clean infections, and will probably consider it in the future, it isn't a very widely used tool because of the windows live branding, rather than as a Microsoft product. Trend Micro Housecall has been around for longer. I wish more antivirus's would scan for lack of service packs or security vulnerabilities.
We don't have enough information to estimate the infection rate. For one thing, we don't know how good the scanner is. If it misses a lot malware, the infection rate may be much higher. We also don't know what kind of sample the downloads comprise. If only people who think they have an infection are downloading it, then the sample is biased high and the real infection rate may be much lower. Since it only detected infections in 5% of cases, either the scanner is very bad or people are downloading it as a precaution, not once they think they have an infection. If they're downloading it as a precaution, that probably means they are particularly security conscious, in which case the sample is probably biased toward a low infection rate. Overall, it looks like without more information the percentage of machines found to be infected by this scanner tells us very little.
The IP6 folks hate NAT, but it's the only thing that's saving personal computing at the moment. Because random inbound connections don't has through NAT devices, any home PC behind one is MUCH safer than one directly on the internet. It sucks in terms of the end to end utility of the internet, but it's the tradeoff most users are willing to make for reasonable safety.
> though it's a few years old, here's a report that suggests (as of 2007, at least) a grace period of less than 10 seconds.
These numbers mean nothing. Just like statistics about domestic abuse ("1 women in 3 is victim of abuse"), that kind of thing cannot be measured so someone comes up with a pseudo-scientific number and everybody keeps repeating this stuff ad nauseam like Rush Limbaugh on election week.
Individual malware is having way too much exposure in the media for its actual damage. In an era where legitimate companies such as Facebook or Google are cornering the market on privacy violation and shameless data-mining, nobody gives a sh*t about Uncle Joe's private information. Credit card numbers are traded by the thousands and it is not cost-effective to try to harvest valuable information from individual PC - financial institutions and service providers (PSN!) are a much better target.
The name of the game is now large-scale deployment and a botnet that does not protect its nodes does not live long enough to justify an article on Wikipedia. Actually for home users I would even argue that being part of a botnet can be a good thing - the operators know what malware is serious and they have a financial stake in maintaining a healthy network of zombies; they will keep the basement wannabes away. On a global scale they are the one with the best interest for home PC security - much more than most PC owner themselves. It's like joining a gang when you go to jail for a long time - be part of the swarm and the odds that you end up becoming a silent farter are much lower.
lucm, indeed.
All Windows PCs are infected...Windows IS a virus! Or at least malware/spyware!!
Even if it isn't actually MalWare, the name "Safety Scanner" is as suspect as "Windows Recovery" or "MAC Defender".
I would have thought Microsoft's marketing department (arguably one of the greatest marketing departments in Info Tech), could have come up with something less dodgy than "Safety Scanner".
Maybe the people who were inclined to download and install "Safety Scanner" are the same people who are inclined to download and install "Windows Recovery". Making the estimate of 5% high.
Conversely, maybe the people using "Safety Scanner" were more conscientious about Computer Security and were seeking out extra protection. Making the estimate of 5% low.
Wrong.
There are plenty of MS Windows XP machines that have not been patched since 2007. Also how many Microsoft based machines have you seen with spreadsheets etc newer than MS Office 2003?
how much of that is boarder line stuff flagged as Malware?
Wrong.
There are plenty of MS Windows XP machines that have not been patched since 2007. Also how many Microsoft based machines have you seen with spreadsheets etc newer than MS Office 2003?
Although there may be more Windows XP machines than all versions of Apple combined, it does not mean that the XP machines have gone unpatched since 2007.
Secondly, Although MS Office 2003 is several lifetimes ago for Office productivity suites, as well, it still is not an indicator that the Office 2003 system is not unpatched.
Ran this thing on a server that lives in the closet. It complained that my custom hosts file was very suspicious. It also didn't like the VNC client.
So this machine was infested with malware? I don't think so!
Yet another scareware scanner!
In another post I stated
"The question here is why hasn't Microsoft made their Windows XP more secure by now? WinXP has been around for quite some time now, considerably longer than Win7, so they have had plenty of time to do it. Could it be that they are not focusing on XP security partly because doing so would make people less likely to switch to Win7?"
http://news.slashdot.org/story/11/05/12/210202/Win-7s-Malware-Infection-Rate-Climbs-XPs-Falls
Someone responded
"Yea they should keep making Windows XP more secure. And while they are at it they should keep patching the bugs in Windows 98 and ME as well."
My response to that is
As far as I'm concerned, so long as they own the copyright on it and so long as they don't release it under a CC license, which prevents others from working on it, they should be responsible for it. If they own it, it's their responsibility to maintain it, at least until the copyright expires or until they relinquish their ownership of it. After all, it's still licensed to their users by them, why should they continue to be the license holder if they aren't going to service it?
One big thing has happened since 2007: Windows has started shipping with the Windows Firewall turned on by default and blocking inbound requests. Since network-spreading worms were the primary contagion factor back in 2007, this made a huge impact all by itself. Also, the growing prevalence of dynamic NAT in households (usually from the wireless routers that everyone has these days) also contributes to this.
For your security, this post has been encrypted with ROT-13, twice.
No, what does tell me and should tell you is simple observation. Many XP machines in homes do not have automatic updates turned on and have never been updated after the day they were purchased. There are also a vast number of cracked copies of XP out there which have never been updated because the users are worried that an attempt to download updates will identify their XP as copies instead of purchased software.
Those "Windows machines get attacked in 10 seconds" type things are utter rubbish. It was quoted at a recent security conference I went to and I interrupted the speaker about it as it's a blatantly false claim.
I have an unpatched Windows 2000 machine behind a cheap Netgear router. It's never once been attacked and it sits on the Internet 24/7 sending weather data to an FTP site. It doesn't get used for anything else and it's been up for four years now. The hard drive is too small to install the service packs (the machine is a P133 from 1996).
Furthermore, I don't know what ISP these people are using but I get a couple of port scans a day (at most) coming into my router. I'm on a static IP too.
It's my opinion that the 10-second claim (or 4 minutes, as in the one I heard at that security conference) was made up by a security vendor in order to hawk their products. The claim has then been spread over the years, Chinese Whispers style, until it's accepted as a truth.
While I agree the numbers seem low, its not because 'computers are scanned when they go online'. How many people these days connect their computer directly to the internet? Most machines are behind nat, which while not a complete security measure any any means, it does off protect for out side scanning.
Infections mostly come from browser based and download/execute attacks.
These are likely not so bad without exposure to Adobe and Java.
Let us be honest for once.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I think lack of information can make a biased output about infection rate. So infected rate that is proved by this scanner gives us a little part of whole scenario. http://www.pranon.com/
Wonder how many wine (www.winehq.org) users are infected, as users.
http://wiki.winehq.org/FAQ#head-3cb8f054b33a63be30f98a1b6225d74e305a0459
http://www.google.com/search?q=wine+virus
I would argue that 100% of Windows machines are loaded with malware, called Windows.
So, what TFA is saying is 100% of people who use the Ten Day Trial of Microsoft Safety Scanner, and windows update, have their information reported to Microsoft, who then in turn filters it and releases a vague portion of the information back to the public without details of what was actually detected, thereby creating FUD, and eliminating joe 6-pack from spinning any feedback at all.
virus collectors should not drink all of the 3 day old urine up, or pop all their fart balloons when using this scanner one must maintain a cloned backup of the virus collection beforehand in case the 10 day trial scanner should delete something and sneakily report it back for more statistic fud without being asked.
With secunia, a command line scanner, and process hacker, you can make it leave the virus collection alone, patch more than just the os, and spin a bit of feedback in a friendly volunteer community when need be, and maintain control of process's and resources down to their dirty basic details all while sipping your favorite drink in your underwear.
Though it doesn't name it in TFA, I'm betting that this also has something to do with the Malicious Software Removal Tool that is a part of normal Windows updates. This is downloaded and installed and run by default if you let Windows Update do its thing without manually configuring which update to install and which to ignore.
When this is run, and it detects known malware, it reports the infection and the full version (Major release, SP number, and updates that are installed) to Microsoft and attempts to remove it.
Since it's run in quiet mode at installation, I'm inclined to believe that this 5% number is pretty reliable on Windows 7 machines, somewhat reliable on Vista machines, and of marginal reliability in regards to XP boxes. Due to the nature of Windows Update settings on those OS', ranging from On by default in Vista and 7, to on if you made it so in XP.
As a sysadmin that helps look after over 10,000 desktops and close to 500 servers, I'm even more inclined to believe that 5% is accurate. Compared to what I was seeing 5 years ago, Malware is /much/ less common now. Despite the fact that it's craftier. Windows users, while still apt to click on everything that they're asked to click on, have a harder time wrecking their systems due to the security subsystem changes that have been made in Vista and 7.
Is Windows secure? Fuck no. Is it infinitely better than it was when XP came out? Unquestionably, and anyone that disagrees with that is too busy trolling Microsoft to see that they have made significant improvements.
Keep on knockin'
https://robbiecrash.me
And only valid for 10 days. No updates, have to re-download the whole thing to have the new definitions. It's *bigger* than most AV software...
What the heck MS ????
I've got better things to do tonight than die.
Only 5%?
No way in hell just 5% are infected. In fact, the opposite is probably closer to the truth. I fix PCs as an occasional job, and not one Windows computer I've had to fix was completely malware-free. That's not to say 100% are infected, but the uninfected ones are probably owned by nerds who don't come to me to get them fixed, so I can't give a proper statistic. Still, the 5% figure is completely unrealistic.
Actually for home users I would even argue that being part of a botnet can be a good thing - the operators know what malware is serious and they have a financial stake in maintaining a healthy network of zombies
My title says it all.
Although most viruses and malware are easy to avoid for the "informed user" the "naive user" is still a humongous target. I could NOT keep malware and viruses and unwanted Firefox toolbars off my kid's computer. I lectured them and told them how to avoid most of them (don't install things without asking me), took away their admin rights, etc. It did no good, the stuff kept appearing, even though we've tried both AVG and Norton. I think most of them are appearing because my daughter likes to Google Image search for cute puppy pictures. It makes me wonder if the malware distributing population has figured out kids are the best conduit to getting their apps on your computer. So now they're using Linux. Took them 10 minutes to figure out where everything was. Plus the machine is much faster without an antivirus running and checking everything they do.
5% of windows machines are NOT infected with something.
---- Booth was a patriot ----
I don't run an anti-virus because it slows the PC down. I have a good system worked out. I have a KVM switch with Windows on one PC and Linux on the other PC. I use Windows for my programs that won't run on Linux, and Linux to get on the Net with. I keep the amount of important stuff to a minimum on Windows, so I can reinstall easily if needed.
My windows runs very fast even on a PC with mediocre specs, and I go for years without trouble on it, though I won't say I have never had any viruses.
Now my kids, they can touch a Windows machine and, between facebook and free mp3 downloaders, have a virus on it in five minutes. I cringe when I see them on my windows machine.
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
The sample is of necessity limited to users who knew about this tool and downloaded it. I suspect that group to be more security aware than most, and more likely to have a clean system to start with.
Actually no. Very difficult to prove there is no infection. As fast as new Malware comes, it is difficult to catch it all. Now MS might have a chance of finding system files where the signature is not right.
Your entire post, which seems to be entirely about the hosts file, can be summarized by your summary:
All one needs to do is swap your statement and it should be obvious why malware scanners report these things;
P.S.=> Yes - Sure: You can use them to YOUR advantage, but then again, so can malware!
Malware scanners are incapable of knowing whether it was you, or a disgruntled employee, or a piece of malware, or the alignment of the planets that adjusted the hosts file.
All it can do is report that it was modified, and then let you decide what to do about it.
Now, I haven't run Microsoft's specific tool to see how it handles these things, but every scanner I've used lets you choose what to do, including the option to ignore the changes / whitelisting the file.
If you know that you made the modifications it's reporting about, then all you have to do is tell it so. On the other hand, if changes are made to it that you are not aware of, would you really want a malware scanner to just ignore it?
That's like a security researcher complaining that their anti-virus complains about the 1,287 infected files in their "%userdocs%\VirusResearch\Archives\" folder and suggesting that the virus scanner is crap because it can't tell that clearly the viruses are supposed to be there.
Almost a decade ago I watched as a blaster variant compromised a XP machine BEFORE THE INSTALL HAD COMPLETED. Microsoft in their infinite wisdom thought it would be cool to enable remote procedure call before you even get a desktop up. (I guess unattended setup scripts weren't enough?) Had to re-install disconnected, patch it, then setup networking. I had no machine at the time to make a patched install disc. None of that would have been a problem if I could have installed my firewall software before windows starting RPC.
If the grace period from going on line to infection is only 10 seconds, how does one build a Windows machine that is secured with the latest patches - given that you need to be on line to get the patches from Microsoft?
Ah - just a case of mistaken intention, then :)
No, the hosts file in itself, and editing thereof, is (or, well, can be) perfectly fine for the reasons you cited and many more. But it's also fine that malware scanners may opt to report anything they think looks suspicious. But you're about to address that, so.. on to that.
( Editing the quotes for formatting purposes )
But if you designed this system - or even if you didn't design it, but at least run it intentionally - doesn't that explicitly make you aware of the changes being made? You might not know the exact changes, but you know that there's a program running that could change the content of the hosts file every 15 minutes.
My point was with regard to modifications that you're not aware of.
Now, the hosts file handling, at least under Windows, is such that there's no explicit trail of what process wrote what to it, making it difficult to differentiate your program's changes from those of a piece of malware, so in your case you'd tell the malware scanner to just ignore the hosts file; at your own risk, but you clearly understand any risks involved there (given that your app helps to mitigate such risks).
Your next section is a bit disorderly, but as far as I can tell, you're saying that malware scanners could check the content of the hosts file to perform, for example, checks that a certain host actually meets the given IP address - and if that is the case, there is no problem, and it should ignore that entry.
But then you, quite correctly, point out that DNS server records might be incorrect. Or your DNS server settings were changed. Or a TCP/IP stack injection simply returns whatever the scanner wants to hear but when e.g. iexplore.exe (just to name a browser process) asks for it, servers up the malicious website.
So rather than just implicitly trust added IP/name combination on the basis that they appear to be correct at the time of the scan, it's better to alert the user that there's a value there that's not normally in it OR wasn't in there the last time the scan was run.
Note that the above is for on-demand scanners. Any 'active' scanner (the background running things) could just monitor process access to the file and then alert the user if some process is trying to write data to it, report the data, report the process, etc.
Now, you do make one more point:
The question is... is that a bad thing?
To simplify things a bit - perhaps oversimplify - there's 3 groups of people who would get hit by a warning regarding the hosts file having entries that aren't there originally / since the last scan.
Group 1: The people who did not edit the hosts file themselves nor installed a program - such as yours - that modifies the hosts file for them.
In these cases, I'd argue that any removal of lines in the hosts file is less harmful than leaving them in, as the user clearly doesn't know why the entries are in there in the first place.
Group 2: The people who did not edit the hosts file themselves, but installed a program - such as yours - that modifies the hosts file for them.
In these cases, although it may not be desirable for the modifications to be undone - it stands to reason that the program that made the modifications will redo the mo
First, the conclusion in the summary is wrong.
No, the statistics show that 1 in ever 20 PCs using Safety Scanner is infected. It says nothing of the larger population of Windows PCs. It also does not address systems running some other security program along with Safety Scanner.
Second, the statistics suffer from selection bias. The sample used is not necessarily, and probably isn't, a representative sample of Windows PCs, so the statistics are not really valid.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
can the antimalware tool detect. We didn't hear how often that tool was updated before scanning, nor dd he find out how effective it is in finding malware even polymorphic stealth trojans and rootkits that make up the botnets and the like that are hard to find.