Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Security Essentials Loses AV-Test Certificate

Posted by samzenpus on from the is-there-extra-credit? dept.

helix2301 writes "Every two months, AV-Test takes a look at popular antivirus software and security suites and tests them in several ways. In their latest test which was performed on Windows 7 during September and October, Microsoft Security Essentials didn't pass the test to achieve certification. Although that may not sound that impressive, Microsoft's program was the only one which didn't receive AV-Test's certificate. For comparison, the other free antivirus software, including Avast, AVG and Panda Cloud did."

4 of 185 comments (clear)

  1. Now for the rest of them... by multiben · · Score: 5, Interesting

    Seriously. Most anti-virus software is worse than getting a virus.

    1. Re:Now for the rest of them... by Voyager529 · · Score: 5, Interesting

      I know, it's anonymous coward and all...but I had an interesting issue along this vein...

      Two weeks ago, a client called us saying she got some FBI scareware that also tapped into her webcam. I went to investigate. No FBI scareware when I tried it, but I did see security essentials find stuff, and take some time to remove each item...during which it invariably found more.

      So, I tried the usual tools - Fixboot/Fixmbr, Combofix, TDSSKiller, ADWMBR, Malwarebytes, and my trusty ESET NOD32 recovery disc. None of that seemed to stop it. So I tried a repair XP install. I learned that the 'repair' install doesn't do nearly as much as I'd like it to, but whatevs, it was gone. ESET said it was clean, TDSSKiller said it was clean, Combofix said it was clean, and MBAM said it was clean. Security Essentials wouldn't shut up.

      I googled a bit and found out that this client had caught one of the strains from the xpaj family. It does EVERYTHING - MBR rewrite, device driver, etc. Seriously among the nastiest virus infections I've ever come across. Further googling revealed that Kaspersky had an explicitly dedicated removal tool just for xpaj. it took about half an hour to run, and found literally thousands of files infected with it. It must have been file headers or something because they were all ultimately cleaned...but this thing fooled EVERYONE but Security Essentials.

      Now granted MSE didn't completely take care of the issue, and clearly it also didn't stop it from running amuck...but it did find something nothing else I tried did...so I'm not thoroughly convinced that writing it off wholesale isn't entirely warranted either.

  2. Re:This is a surprise? by phrackthat · · Score: 5, Interesting

    I stopped using AVG when they changed their license terms to unilaterally audit the location where the software is being used and gave themselves the right to unilaterally share my information with whomever they choose. - no thanks. See sections 9b and 12 of their license: - http://www.avg.com/us-en/eula-avg-2013-all-1-0

  3. It also depends on how you want to do things by Sycraft-fu · · Score: 4, Interesting

    One problem with AV is that as detection rate rises, so does false positive rate. So far, nobody has found a way around this. So some products go for heavy detection, Bitdefender being a good example. Fair enough, but it comes at the cost of more false positives (and it still isn't a 100% detection rate).

    MS goes the other way. They go for low false positives, and in the last AV Comapritives test they had 0, but at a lower detection rate.

    Why? Well because they are going for the mass market, the people who didn't want virus scanners. If the thing bothers them all the time with false positives, they'll turn it off, and then they have 0% detection. So instead they go for a lower detection rate, but with low false positives so people get some protection.

    I'm not calling it the right answer, but you can see the logic.

    And for that matter, I've found that in the real world, MSE seems to do better than Sophos, which is decidedly not free and very popular in enterprise.