Thread: Microsoft (in)Security Essentilas

Originally Posted by d@rk51d3

One thing I have discovered, is that while MSE cleans well, it waits until you have been infected before it does anything.

Currently trying Avsat 8 Internet Security. Seems to be more pro-active.

I must disagree with that.

I write training material and was trying to deliberately infect a machine last week (virtual machine I could revert to original state when I finished). I had so much trouble with MSE not letting an infected file open I had to completely disable it to let the virus download, let alone install.

Admittly this was a virus, rather than a trojan, but while frustrating it showed MSE was providing security against that particular infection.

It highlights the need for keeping the definition database updated...

With my work I get play with this sort of thing a lot. We have virtual farms that develop and run malware in parallel to assess AV.. this is a similar process to what malware writers do to make sure their code isn't stopped or signatured by the AV companies.

MSE is, IMO, technically one of the best AV products in terms of how it works under the hood.

The problem that is has is that ALL anti-malware is BS - it is reactionary, and always behind.

This is compounded because a malware writer will ALWAYS have to bypass MSE as the % chance that someone is running it is MUCH higher than the % change of say someone running Trend, or Sophos.

So it creates an interesting conundrum where because it is the best and it is free it will always be the first priority to bypass so it wont ever be the best. Did someone say logic bomb?!