Slashdot Mirror
Malware Scanner Finds 5% of Windows PCs Infected
BogenDorpher writes "According to statistics generated by Microsoft's new free malware scanning and scrubbing tool, Safety Scanner, one in every twenty Windows PCs are infected with malware. Microsoft's Safety Scanner was downloaded 420,000 times in just one week of availability and it cleaned up malware or signs of exploitation from more than 20,000 Windows PCs, according to statistics generated by Microsoft's Malware Protection Center. This resulted in an infection rate of nearly 5%." That seems an awfully low number, based on how quickly Windows machines are scanned for plunder after going online; though it's a few years old, here's a report that suggests (as of 2007, at least) a grace period of less than 10 seconds. That was just one instance, and an intentionally vulnerable machine, but have improvements in security software software, and in Windows itself, made things so much better since then?
Most of the malware now is either socially engineered or exploiting third party software (Flash and PDF, I'm looking at you!). Frankly, every OS is vulnerable to those two and finally even Apple noted they're starting to get that problem on Macs.
I think this is more likely to have proven that the McAfee tool is crap.
Malwarebytes is pretty good, and I've heard Bullguard can sometimes get stuff that cannot.
-taosk8r
So a significant number of computers that downloaded the malware removal tool had malware on them. How is that surprising? Unless the installation of this tool is uniformly distributed amongst Windows users, which TFA is not entirely clear on...
Palm trees and 8
"Safety Scanner, which replaced an older online-only tool, uses the same technology and detection signatures as Microsoft's free consumer-grade Security Essentials antivirus program and its Forefront Endpoint Protection product for enterprises."
considering that by now everyone should run SOME anti virus, of which MSE is a legally free option, and that something which uses MSE's signature database finds 5% of machines have been compromised I don't think says much about computer security as a whole. Obviously there are a lot of users who *still* don't have anti virus software, which isn't really news. But MS can't exactly go including free anti virus in their OS without screams of anti trust.
That was just one instance, and an intentionally vulnerable machine [four years ago], but have improvements in security software software, and in Windows itself, made things so much better since then?
Yes.
Is it really surprising that computers with service packs, hot fixes, virus scanners, and firewalls are significantly more secure than those without?
Of course, it's also worth noting that the real infection rate is probably at least a little bit higher. The people who don't download this particular scanner are the same ones who wouldn't download the aforementioned service packets, hot fixes, virus scanners, and firewalls. The unanswered, and perhaps unanswerable, question is how many such people are out there.
I fixed one this afternoon: my parent's WinXP computer. Adjust your stats accordingly.
http://alternatives.rzero.com/
According to Mac Defender, 100% of all Macs are infested with malware.
Every new Hotmail account comes complete with no less than 10 emails promising 'bigGer Pen1s 4 hur plezures!" within the first thirty seconds of initial login.
Consistency is only a virtue if you're not a screw-up.
Maybe the number is accurate, maybe it isn't. But the one thing that strikes me is that this is not an entirely random survey since there are too many factors that can affect the sampling. Examples: people who do not update their software (including but not limited to this scanner) are probably more likely to have an infected machine, making the number low. Yet institutional PCs that are professionally managed (and are likely to use third party solutions) are probably less likely less likely to be infected, making the number high. So that 5%, as good or as bad as it may sound to you, is actually just a number thrown around by the marketing department.
Pretty much, yeah.
http://alternatives.rzero.com/
All this really 'proves' is that 95% of the people who are smart enough to download a free AV program didn't have an infection. Lets see, who uses those? Oh, I know! People who take precautions... When do they do it? BEFORE they get infected, lol.
While it is an interesting datapoint to hobknob about, this actually says ZILCH about Windows infection rate, except it probably can't possibly be LESS than 5%.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
Honestly? "as of 2007"? In computer terms, that's several lifetimes.
Not only that, but just because the news article linked to has 2007 at the top, doesn't mean the findings were from 2007. The news article in which the author "just read an incredible scary article" links to said incredible scary article - http://news.bbc.co.uk/2/hi/programmes/click_online/4423733.stm - from 2005. So not only was the news article writer 2 years behind the times, you're now suggesting that we should believe that you find it incredulous that things may have improved in 6 years' time?
In that time Windows 7 and Vista have been released - both with far better security models out of the box. Even Windows XP saw a reasonable update with SP3.
Then again, by April 2005, SP2 was also distributed and guess what it enabled by default? Windows Firewall. The worm in the original article, Sasser, would not have gotten very far.
Then again, Sasser would not even have been on the system if they bothered to install the update that fixed the hole that Sasser would eventually exploit.
It's just not a very convincing example to begin with, and certainly not one you should be citing 6 years later.
Same thing, right?
This issue is a bit more complicated than you think.
While I am glad that the online safety scanner can now clean infections, and will probably consider it in the future, it isn't a very widely used tool because of the windows live branding, rather than as a Microsoft product. Trend Micro Housecall has been around for longer. I wish more antivirus's would scan for lack of service packs or security vulnerabilities.
We don't have enough information to estimate the infection rate. For one thing, we don't know how good the scanner is. If it misses a lot malware, the infection rate may be much higher. We also don't know what kind of sample the downloads comprise. If only people who think they have an infection are downloading it, then the sample is biased high and the real infection rate may be much lower. Since it only detected infections in 5% of cases, either the scanner is very bad or people are downloading it as a precaution, not once they think they have an infection. If they're downloading it as a precaution, that probably means they are particularly security conscious, in which case the sample is probably biased toward a low infection rate. Overall, it looks like without more information the percentage of machines found to be infected by this scanner tells us very little.
The IP6 folks hate NAT, but it's the only thing that's saving personal computing at the moment. Because random inbound connections don't has through NAT devices, any home PC behind one is MUCH safer than one directly on the internet. It sucks in terms of the end to end utility of the internet, but it's the tradeoff most users are willing to make for reasonable safety.
> though it's a few years old, here's a report that suggests (as of 2007, at least) a grace period of less than 10 seconds.
These numbers mean nothing. Just like statistics about domestic abuse ("1 women in 3 is victim of abuse"), that kind of thing cannot be measured so someone comes up with a pseudo-scientific number and everybody keeps repeating this stuff ad nauseam like Rush Limbaugh on election week.
Individual malware is having way too much exposure in the media for its actual damage. In an era where legitimate companies such as Facebook or Google are cornering the market on privacy violation and shameless data-mining, nobody gives a sh*t about Uncle Joe's private information. Credit card numbers are traded by the thousands and it is not cost-effective to try to harvest valuable information from individual PC - financial institutions and service providers (PSN!) are a much better target.
The name of the game is now large-scale deployment and a botnet that does not protect its nodes does not live long enough to justify an article on Wikipedia. Actually for home users I would even argue that being part of a botnet can be a good thing - the operators know what malware is serious and they have a financial stake in maintaining a healthy network of zombies; they will keep the basement wannabes away. On a global scale they are the one with the best interest for home PC security - much more than most PC owner themselves. It's like joining a gang when you go to jail for a long time - be part of the swarm and the odds that you end up becoming a silent farter are much lower.
lucm, indeed.
Even if it isn't actually MalWare, the name "Safety Scanner" is as suspect as "Windows Recovery" or "MAC Defender".
I would have thought Microsoft's marketing department (arguably one of the greatest marketing departments in Info Tech), could have come up with something less dodgy than "Safety Scanner".
Maybe the people who were inclined to download and install "Safety Scanner" are the same people who are inclined to download and install "Windows Recovery". Making the estimate of 5% high.
Conversely, maybe the people using "Safety Scanner" were more conscientious about Computer Security and were seeking out extra protection. Making the estimate of 5% low.
Wrong.
There are plenty of MS Windows XP machines that have not been patched since 2007. Also how many Microsoft based machines have you seen with spreadsheets etc newer than MS Office 2003?
Ran this thing on a server that lives in the closet. It complained that my custom hosts file was very suspicious. It also didn't like the VNC client.
So this machine was infested with malware? I don't think so!
Yet another scareware scanner!
One big thing has happened since 2007: Windows has started shipping with the Windows Firewall turned on by default and blocking inbound requests. Since network-spreading worms were the primary contagion factor back in 2007, this made a huge impact all by itself. Also, the growing prevalence of dynamic NAT in households (usually from the wireless routers that everyone has these days) also contributes to this.
For your security, this post has been encrypted with ROT-13, twice.
No, what does tell me and should tell you is simple observation. Many XP machines in homes do not have automatic updates turned on and have never been updated after the day they were purchased. There are also a vast number of cracked copies of XP out there which have never been updated because the users are worried that an attempt to download updates will identify their XP as copies instead of purchased software.
Those "Windows machines get attacked in 10 seconds" type things are utter rubbish. It was quoted at a recent security conference I went to and I interrupted the speaker about it as it's a blatantly false claim.
I have an unpatched Windows 2000 machine behind a cheap Netgear router. It's never once been attacked and it sits on the Internet 24/7 sending weather data to an FTP site. It doesn't get used for anything else and it's been up for four years now. The hard drive is too small to install the service packs (the machine is a P133 from 1996).
Furthermore, I don't know what ISP these people are using but I get a couple of port scans a day (at most) coming into my router. I'm on a static IP too.
It's my opinion that the 10-second claim (or 4 minutes, as in the one I heard at that security conference) was made up by a security vendor in order to hawk their products. The claim has then been spread over the years, Chinese Whispers style, until it's accepted as a truth.
It's interesting to note that the number of infected pc's is exactly 5% of the computers that had that tool installed. Not 5% of all machines as the article implies.
Slow night on slashdot?
- Dan.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
These are likely not so bad without exposure to Adobe and Java.
Let us be honest for once.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I think lack of information can make a biased output about infection rate. So infected rate that is proved by this scanner gives us a little part of whole scenario. http://www.pranon.com/
Wonder how many wine (www.winehq.org) users are infected, as users.
http://wiki.winehq.org/FAQ#head-3cb8f054b33a63be30f98a1b6225d74e305a0459
http://www.google.com/search?q=wine+virus
I would argue that 100% of Windows machines are loaded with malware, called Windows.
Because there is a guaranteed timeline for how long the product will remain serviced, and that was available knowledge when you bought the damn prodcut. AND it was EXTENDED past the original announced date.
Stop complaining about XP security. The Windows model has and likely always will be a series of paid upgrades in order to gain not only the latest features but also the latest security updates after a certain point. It's not like that was a recent change to their business model, that's how it's always been. Since Windows 1.0. So I mean, really, do suck it up.
First, they've made XP more secure. Compare SP3 with vanilla XP.
Second, Microsoft runs a business. If you're looking for a system developed under a cooperation model, there are many open source systems available for you to choose, although there are good reasons why almost nobody wants any of them on their desktops.
Though it doesn't name it in TFA, I'm betting that this also has something to do with the Malicious Software Removal Tool that is a part of normal Windows updates. This is downloaded and installed and run by default if you let Windows Update do its thing without manually configuring which update to install and which to ignore.
When this is run, and it detects known malware, it reports the infection and the full version (Major release, SP number, and updates that are installed) to Microsoft and attempts to remove it.
Since it's run in quiet mode at installation, I'm inclined to believe that this 5% number is pretty reliable on Windows 7 machines, somewhat reliable on Vista machines, and of marginal reliability in regards to XP boxes. Due to the nature of Windows Update settings on those OS', ranging from On by default in Vista and 7, to on if you made it so in XP.
As a sysadmin that helps look after over 10,000 desktops and close to 500 servers, I'm even more inclined to believe that 5% is accurate. Compared to what I was seeing 5 years ago, Malware is /much/ less common now. Despite the fact that it's craftier. Windows users, while still apt to click on everything that they're asked to click on, have a harder time wrecking their systems due to the security subsystem changes that have been made in Vista and 7.
Is Windows secure? Fuck no. Is it infinitely better than it was when XP came out? Unquestionably, and anyone that disagrees with that is too busy trolling Microsoft to see that they have made significant improvements.
Keep on knockin'
https://robbiecrash.me
And only valid for 10 days. No updates, have to re-download the whole thing to have the new definitions. It's *bigger* than most AV software...
What the heck MS ????
I've got better things to do tonight than die.
Only 5%?
No way in hell just 5% are infected. In fact, the opposite is probably closer to the truth. I fix PCs as an occasional job, and not one Windows computer I've had to fix was completely malware-free. That's not to say 100% are infected, but the uninfected ones are probably owned by nerds who don't come to me to get them fixed, so I can't give a proper statistic. Still, the 5% figure is completely unrealistic.
Actually for home users I would even argue that being part of a botnet can be a good thing - the operators know what malware is serious and they have a financial stake in maintaining a healthy network of zombies
My title says it all.
Although most viruses and malware are easy to avoid for the "informed user" the "naive user" is still a humongous target. I could NOT keep malware and viruses and unwanted Firefox toolbars off my kid's computer. I lectured them and told them how to avoid most of them (don't install things without asking me), took away their admin rights, etc. It did no good, the stuff kept appearing, even though we've tried both AVG and Norton. I think most of them are appearing because my daughter likes to Google Image search for cute puppy pictures. It makes me wonder if the malware distributing population has figured out kids are the best conduit to getting their apps on your computer. So now they're using Linux. Took them 10 minutes to figure out where everything was. Plus the machine is much faster without an antivirus running and checking everything they do.
5% of windows machines are NOT infected with something.
---- Booth was a patriot ----
I don't run an anti-virus because it slows the PC down. I have a good system worked out. I have a KVM switch with Windows on one PC and Linux on the other PC. I use Windows for my programs that won't run on Linux, and Linux to get on the Net with. I keep the amount of important stuff to a minimum on Windows, so I can reinstall easily if needed.
My windows runs very fast even on a PC with mediocre specs, and I go for years without trouble on it, though I won't say I have never had any viruses.
Now my kids, they can touch a Windows machine and, between facebook and free mp3 downloaders, have a virus on it in five minutes. I cringe when I see them on my windows machine.
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
The sample is of necessity limited to users who knew about this tool and downloaded it. I suspect that group to be more security aware than most, and more likely to have a clean system to start with.
Your entire post, which seems to be entirely about the hosts file, can be summarized by your summary:
All one needs to do is swap your statement and it should be obvious why malware scanners report these things;
P.S.=> Yes - Sure: You can use them to YOUR advantage, but then again, so can malware!
Malware scanners are incapable of knowing whether it was you, or a disgruntled employee, or a piece of malware, or the alignment of the planets that adjusted the hosts file.
All it can do is report that it was modified, and then let you decide what to do about it.
Now, I haven't run Microsoft's specific tool to see how it handles these things, but every scanner I've used lets you choose what to do, including the option to ignore the changes / whitelisting the file.
If you know that you made the modifications it's reporting about, then all you have to do is tell it so. On the other hand, if changes are made to it that you are not aware of, would you really want a malware scanner to just ignore it?
That's like a security researcher complaining that their anti-virus complains about the 1,287 infected files in their "%userdocs%\VirusResearch\Archives\" folder and suggesting that the virus scanner is crap because it can't tell that clearly the viruses are supposed to be there.
Almost a decade ago I watched as a blaster variant compromised a XP machine BEFORE THE INSTALL HAD COMPLETED. Microsoft in their infinite wisdom thought it would be cool to enable remote procedure call before you even get a desktop up. (I guess unattended setup scripts weren't enough?) Had to re-install disconnected, patch it, then setup networking. I had no machine at the time to make a patched install disc. None of that would have been a problem if I could have installed my firewall software before windows starting RPC.
If the grace period from going on line to infection is only 10 seconds, how does one build a Windows machine that is secured with the latest patches - given that you need to be on line to get the patches from Microsoft?
Ah - just a case of mistaken intention, then :)
No, the hosts file in itself, and editing thereof, is (or, well, can be) perfectly fine for the reasons you cited and many more. But it's also fine that malware scanners may opt to report anything they think looks suspicious. But you're about to address that, so.. on to that.
( Editing the quotes for formatting purposes )
But if you designed this system - or even if you didn't design it, but at least run it intentionally - doesn't that explicitly make you aware of the changes being made? You might not know the exact changes, but you know that there's a program running that could change the content of the hosts file every 15 minutes.
My point was with regard to modifications that you're not aware of.
Now, the hosts file handling, at least under Windows, is such that there's no explicit trail of what process wrote what to it, making it difficult to differentiate your program's changes from those of a piece of malware, so in your case you'd tell the malware scanner to just ignore the hosts file; at your own risk, but you clearly understand any risks involved there (given that your app helps to mitigate such risks).
Your next section is a bit disorderly, but as far as I can tell, you're saying that malware scanners could check the content of the hosts file to perform, for example, checks that a certain host actually meets the given IP address - and if that is the case, there is no problem, and it should ignore that entry.
But then you, quite correctly, point out that DNS server records might be incorrect. Or your DNS server settings were changed. Or a TCP/IP stack injection simply returns whatever the scanner wants to hear but when e.g. iexplore.exe (just to name a browser process) asks for it, servers up the malicious website.
So rather than just implicitly trust added IP/name combination on the basis that they appear to be correct at the time of the scan, it's better to alert the user that there's a value there that's not normally in it OR wasn't in there the last time the scan was run.
Note that the above is for on-demand scanners. Any 'active' scanner (the background running things) could just monitor process access to the file and then alert the user if some process is trying to write data to it, report the data, report the process, etc.
Now, you do make one more point:
The question is... is that a bad thing?
To simplify things a bit - perhaps oversimplify - there's 3 groups of people who would get hit by a warning regarding the hosts file having entries that aren't there originally / since the last scan.
Group 1: The people who did not edit the hosts file themselves nor installed a program - such as yours - that modifies the hosts file for them.
In these cases, I'd argue that any removal of lines in the hosts file is less harmful than leaving them in, as the user clearly doesn't know why the entries are in there in the first place.
Group 2: The people who did not edit the hosts file themselves, but installed a program - such as yours - that modifies the hosts file for them.
In these cases, although it may not be desirable for the modifications to be undone - it stands to reason that the program that made the modifications will redo the mo
It's clearly not a defective product. It's insecure, yes, but those insecurities are "by design" - in that at some point, some coder coded something in such a way that was insecure. Complaining that this is "defective" in terms of consumer law seems folly - the claim "100% secure" was never made, so not being 100% secure is not a defect, it is merely an aspect of the product. My car is not 100% soundproof. I can hear the wind as I drive, I can hear the sound of my tires on the road, I can hear other cars pass by, and if someone is playing loud music in another car, I can hear that. My ideal car might provide a quieter experience - there are cars on the market that do provide a quieter experience - but I bought my car as is. If my car was found to be substantially less sound proof than all other cars exactly the same as mine, then this would be a defective car, however that is not the case. Windows XP is not perfect. But Windows XP is perfectly Windows XP. Heck, there have even been FREE improvements - so WIndows XP now is better than XP was. But as a customer, I don't expect them to keep improving XP forever because they never said they would. Rather, they have done what is expected as per their business model - they released new versions which cost money. Just like the new version of my model of car is a quiter ride, but in order to gain that benefit, I have to buy the new car. Yes, Microsoft relies on copyright law in order to force you to pay for their product - but copyright law is substantially older than Microsoft as a business, and thus it seems natural that their business model would take copyright law in to account. But frankly, after they stop improving a product, they aren't exactly disabling that product, are they. I mean, Windows XP still activates, and it still runs - and there is no indication that this will cease to be, or that the facility to activate the product will at some point cease. Obviosly, if the product purchased failed to activate - and thus failed to actually perform the task of operating the system, then you would have a damn good consumer case in my mind in terms of owning a defective product. If you want to change the situation from a legal perspective, you need to convince a heck of a lot of people to agree with you - and then convince all of them to take action on that topic, enacting change through the democratic/legal process. But realise that - GIVEN the CURRENT LEGAL REALITY - Microsoft ending patch support for Windows XP - leaving in a state that is not 100% secure (albeit more secure than when released, is EXPECTED, and they are CLEARLY not in the wrong.
First, the conclusion in the summary is wrong.
No, the statistics show that 1 in ever 20 PCs using Safety Scanner is infected. It says nothing of the larger population of Windows PCs. It also does not address systems running some other security program along with Safety Scanner.
Second, the statistics suffer from selection bias. The sample used is not necessarily, and probably isn't, a representative sample of Windows PCs, so the statistics are not really valid.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.