My review and analysis of Microsoft's new anti-virus software Microsoft Security Essentials (MSE)

[DainBramaged]

First and foremost, a disclaimer for the trolls. I AM NOT NOR HAVE EVER WORKED FOR MICROSOFT nor accept gratuities for endorsing their products, PERIOD. Additionally, I am POSITIVE the thread will be overrun by those of you screaming LINUX is free, Apple doesn't need this blah blah blah. THIS REVIEW ISN'T FOR YOU, it's for the thousands of us who DON'T use anything BUT Windows.


I am a SYSADMIN, I am in charge of a lot of KOMputez where I work, so I spend lots of my free time working with hardware and software to find the best and LEAST expensive variations to make my life easier. I've been testing MSE for a couple of weeks now. Here's what I've found.


First it is 100% FREE! PREVX, AVG, and AVAST also have free scanners, but they limit their functionality and WANT you to purchase the enhanced versions for $29 and up. Kaspersky is excessively expensive and I have refused to even use their 'free' trial. PREVX is cunning. While it may detect an infection, purchasing a license key exposes your credit card to thieves who may have access to the infection;



It is FULLY compatible with OTHER anti-virus software running concurrently (AVG, AVIRA, ALWIL/AVAST,Norton 2009 on four systems I tested it on) BUT because of each program scanning your system in the background, it may slow down without a minimum of a dual core processor and AT LEAST 2 GB of memory IF you choose to run MSE and another anti-vir program. MSE uses about 13 MB running in the background, AVG 8.5/9.0 (my recent AV of choice) surprisingly about 26MB total when all of the scanners are running in the background. Norton 2009/10 is a dramatic improvement is cpu/memory loads along with scanning speed over previous versions, but it still is costly on an annual basis. Avast is very slow in scanning and loading (from tests I have run previously) and appears to be losing popularity.


AVG when doing a full system scan, ramps up an additional 44MB of memory usage during the system scan in addition to the 26MB in the background but CPU usAGE averages between 8-13%. MSE increases memory usage to 90MB and CPU usage jumps to over 20%. AVG takes a very long time in full system scan mode. Depending on the size of the hard drive and number of files you have. On the four test systems with drives of 40GB (purpose built for these tests), 80GB, 200GB and 250GB, all sizes that most of us have with 12-86GB of space used, it took from 11-198 minutes in full scan mode. MSE took from 2-7 in quick mode, 11-189 in full scan mode including scanning the restore volumes.

MSE also had the advantage NOT ONLY IN SCAN MODE but in background scanning where it scans your RESTORE VOLUMES. This means that novice users don't have to worry about tweaking the settings to scan (if applicable) the restore volumes on their computers. (I ALWAYS recommend creating a NEW restore point and deleting old volumes at least once a month via the system tools links).

During testing, MSE found the Browser Modifier Win32/Zwangi (that nasty fake anti-virus program going around) in a restore volume while Norton, AVG, and AVAST had ALL missed it during full and background scans and ALL of the anti-malware/spyware programs I use also missed it.

Additionally, MSE found THREE trojans and one worm I had planted on three of the computers while AVG, AVAST and Norton missed Trojan.Whitewell and Infostealer.Banker.F completely (since the tests the others have added those to their database). Malwarebytes found one of the three trojans and missed the worm, XoftspySE found two and the worm, and The Cleaner, a trojan specific cleaner, found only one trojan.




Microsoft says that in the first week, MSE made almost four million detections on 535,752 distinct machines; the company attributes the fact that the malware is eight times more than the number of computers since machines can be infected with multiple threats. Just over half of all detections were on XP while just under a third were on Vista.

http://arstechnica.com/microsoft/news/2009/10/mses-first-week-535752-users-four-million-detections.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss


I had some installation problems on a Windows XP SP2 computer. MSE likes SP3 and also Net Framework to be up to date. After correcting those and a Windows installer issue it installed smoothly. Also it takes MSE a few extra seconds longer to engage after booting up, which bothered me but I'm sure that will be addressed in upcoming builds.

One of the nice pluses is that the MSE active threats page is easier to use than AVG and Norton/Symantec (and they don't try to get you to buy ANYTHING at ANY time while viewing their pages, unlike AVG and Symantec which are very weak and FORCE you to search for the threats). Links for comparison below.

http://www.microsoft.com/security/portal/Threat/Views.aspx

http://free.avg.com/us-en/homepage

http://free.avg.com/us-en/kb

http://www.symantec.com/index.jsp

http://www.symantec.com/norton/security_response/index.jsp


In conclusion, I am fairly certain that MSE is going to become a valued addition to the war against the hackers/crackers and malcontents of the world. And being free it may very well take the prize from AVG and Norton as the most used anti-virus/malware programs in the world in a very short time. I've installed it at work on a number of systems (exclusively now) and un-installed AVG on this system, I'm that comfortable with it.


Thanks for reading.


http://www.microsoft.com/security_essentials/

[Captain Hilts]

1. I want to have the baby of whoever designed Prevx. I had a virus this week and that is

the only thing that could solve it!

xoxo and **
to Prevx

[ohheckyeah]

2. Has it been compared to McAfee anywhere? n/t

[Captain Hilts]

34. BETTER.

[TrogL]

50. McAfee *is* a virus

[tabatha]

3. Thank you for writing.

That is extremely interesting.
I use AVG and hate the extra time it adds to boot up.

[Paper Roses]

4. Is your bottom line that this is free and does a better job than AVG?

I'm having some problems updating AVG as you saw in the post in the computer group. If I try MSE, should I disable AVG ? Help this old timer. I installed AVG Version 9 today because the version I had would not update.
Thanks

[Greyhound]

7. Since they were bought AVG has steadily become less effective, more bloated,

and more intrusive. I stopped using them quite a while ago.

[Statistical]

47. Agreed when AVG started getting bloated Avast became the leader.

My 2 line summary

Avast = free but requires you to sign up for a year free license. Slightly more complex but has more options.
MSE = free and simple. Less "customization" but pretty much set and forget.

The expensive pay alternatives will need to up their game. I see no reason to use anything other than MSE (or Avast if you don't want to "support" Microsoft).

[DainBramaged]

10. Yes, I uninstalled AVG on my prime system (this one)

and replaced it with MSE. I think it does a better job. :hi:

[Paper Roses]

35. Last might I removed AVG, S&D, Malwarebytes and installed MSE

Did the short scan as suggested, then this AM, I did the full scan. Found nothing--which is good. Do you think I should reinstall Spybot S&D and Malwarebytes?

Thanks,
PR

[DainBramaged]

37. I stopped using Spybot about a year ago when I discovered malwarebytes

and it scans so much faster I still kept it on this system. But I also use XoftspySE (paid version) here and on a thumb drive (portable version) for use at work for emergency scans.

[Warren Stupidity]

5. Only caveat I have is that Msft abandoned their last offering.

At the time it was the only fully functional 64bit Vista av, so it got installed on my 64bit vista system, and it was fine until they pulled the plug, at which point I switched to f-prot, which I use on the rest of my systems. I've since installed this AV on other people's systems (as I routinely get asked to clean up friend and family's damaged systems) to replace the awful crapware passing as av that comes from the pc vendors. It seems pretty good, as in unobtrusive, simple to install and maintain, low overhead.

[B3Nut]

6. Another admin here

and I'm a fan of MSE and have it on all my Windows boxen save my wife's PC, merely because I haven't gotten a round tuit. ;) Any personal PC that hits my bench and has expired AV gets whatever it had yanked and MSE installed. Works great and it's free...it's a no-brainer!

I also don't have it on Windows Home Server as it won't install on that OS. But I don't use a console session to the WHS box for anything other than administrative tasks, otherwise it just stores files.

If you run XP, Vista, or 7, get this app.

Todd in Cheesecurdistan

[Occulus]

24. .

[B3Nut]

36. hehehehehe!

Looks like I've got to get cracking then! :D

[blogslut]

8. Virus's don't really worry me

Sites with nasty scripts that try to get into my system settings concern me the most. I love my NoScript plugin.

[JerseygirlCT]

9. Wow. Thanks

I just updated (today!) my AVG to 9, but this is very good to know.

I appreciate the info!

[Taitertots]

11. I've got McAfee

Am I screwed?

[Toucano]

12. To the wall, baby!

I actually don't know.

I just like saying that. :silly:

[quiller4]

18. I have MSE running with McAfee on my XP not a problem to run both.

[boppers]

13. ClamWin is free, and doesn't require windows "validation".

It's also open source, unlike this software.

[wuvuj]

14. Hope it's better than the crapola that came with Vista Basic....

Just installed a-squared Free today...rates fairly well vs some other progs.

http://o-c-s.us/uploads/ANTI-MALWARE%20COMPARISON%202009.pdf

Last time I ran Windows Defender...it scanned a desktop file named politics.txt before it quit...bet there was some trojans in that text file for sure. Shut it down.

[Feron]

17. Last time I ran ClamAv was on Linux.

Slower than molasses. It took five minutes to scan a small text file.

Hopefully it's improved since then.

[boppers]

19. LOL, it's much faster now, especially as a native binary.

The earlier versions were for simple SMTP, there's been some re-writing to scale up.

[Regret My New Name]

15. I've been running it and I like it thus far...

I can't stand norton and other bloated shit. I usually just take my chances and run nothing.. I figure running MSE will be better than nothing.

[Feron]

16. I appreciate your review.

I'm currently using Avira, but I was curious to see how well Microsoft's anti-virus worked.

Avira works well, but their help is primarily in another language which can be frustrating. I'll definitely give this a serious look.

[OldEuropean]

28. Help?

If you got problems with AntiVir, drop me a mail ([e-mail]). :-)

[DainBramaged]

30. Thanks for hanging out at DU.

:hi:

[TreasonousBastard]

20. Wow! Thanks. I've been using AVG since about day 1 but...

it's getting pretty bloated and the last upgrade to 9 obviously slowed my 1gig XP machine down.

If MSE does the job, I'm in.

[nadinbrzezinski]

21. hmm time to rethink my war against the bad guys

on the XP box....

<------ AVG thankee...

Now the mac box... well that is another story... and yes I DO HAVE a free virus scanner and yes I DO run it every so often... m'kay.

And yes I do the sysadmin at home... so yes, I will give this more than just a second look...

[DainBramaged]

22. It runs FINE with any other scanner installed, just slows the system with two

That was the single most important part of my testing. You CAN'T run any of the popular anti-virus software together, but MSE CAN, and that is a great feature, even though during installation they claim you shouldn't. I never once disabled or shut down via task manager any of the other systems I tested.


And I JUST found this......


http://vista.blorge.com/2009/11/01/microsoft-security-essentials-rated-best-free-antivirus-software/

http://www.av-comparatives.org/images/stories/test/removal/avc_removal_2009.pdf


Microsoft Security Essentials rated best free antivirus software

When Microsoft announced Microsoft Security Essentials, its new free antivirus software designed to replace Windows Live OneCare, it was treated with contempt by the vendors of both other free antivirus software and the paid-for security suites. But a recent testing of the most popular antivirus products placed MSE on a par with the paid-for products and above its free competitors.

A free antivirus product from Microsoft was touted for a year before it finally appeared. Originally codenamed Morro, MSE (Microsoft Security Essentials) was officially announced in June 2009. After a brief period of public beta testing, in which the product gained a resoundingly positive reception, it was finally released as a full product late September.

A couple of weeks later came evidence that MSE had already proved its worth, with 2.6 million people having downloaded the product and it making four million infection detections in the first week. And it isn’t just users who are impressed with the software Microsoft is offering, with a new study into the effectiveness of several antivirus products rating MSE very highly.

According to Ars Technica, AV-Comparatives tested 16 security products, both free and paid-for. The test focused on the malware removal/cleaning capabilities of the products rather than the detection and prevention capabilities.






And this is an independent study from August 2009 prior to MSE being released and including Live One-Care (which was a joke) it's an eye-opener

http://www.av-comparatives.org/images/stories/test/ondret/avc_report23.pdf

[DainBramaged]

23. MicroWorld/eSCAN Free Anti-Virus Toolkit Utility (MWAV)

This Windows toolkit is a complete SCANNER ONLY from the makers of eScan on of the top PAID anti-virus products in the world, comparable to Norton and G DATA.

http://www.mwti.com/products/mwav/mwav.asp

http://www.escan.com.au/default.aspx?menuid=1



Download it from HERE so you don't have to sign your life away. It's a great tool and will help you to determine the status of any computer you may have (put it on a thumb drive).

http://www.tucows.com/preview/509081

[Occulus]

25. I would only install this if you have a valid license.

Win7 RC here, so I'm okay, but some other readers (oh, you know who you are) may not be using valid copies.

From the EULA:

2. VALIDATION.
a. The software may cause the operating system software to conduct validation checks of your operating system software from time to time, depending upon your specific operating system. 
b. Validation verifies that your computer’s operating system has been activated and is properly licensed. Validation also permits you to use certain features of the operating system software or to obtain additional benefits.
c. If a validation check is performed, the operating system software will send information about the software and your operating system software to Microsoft. This information includes the versions of the software and operating system software. Microsoft does not use the information to identify or contact you. By using the software, you consent to the transmission of this information. For more information, see http://go.microsoft.com/fwlink/?LinkId=163954.
d. If, after a validation check, your operating system software is found not to be properly licensed, the software you are installing may be disabled, or the functionality of the operating system software may be affected, depending upon your specific operating system and applicable laws. For example, you may need to reactivate the operating system software or you may receive reminders to obtain a properly licensed copy of the operating system software, or you may not be able to use or continue to use some of the features of the operating system software or obtain certain updates, upgrades or services from Microsoft.

Translation: We can cripple your operating system if you install this on an unlicensed copy. Just FYI.

edit- their license for this gets ridiculous at one point:

4. SCOPE OF LICENSE. The software is licensed, not sold. This agreement only gives you some rights to use the software. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not

· disclose the results of any benchmark tests of the software to any third party without Microsoft’s prior written approval;

I read that as, "I can't tell anyone how well this software runs, both in a standalone technical sense and as compared to other similar applications, unless Microsoft says so in writing". If someone can tell me I'm wrong in my interpretation of this part of the license agreement, please do so, because I know what 'benchmark' means, and I'm frankly flabbergasted that Microsoft's license for a virus scanner/security suite would go so far as to say 'shhhhh' when I want to talk about its own performance.

I'm not hating on Microsoft here (really! I'm posting this from Win7 and I like it a lot), but licenses are there to be read, and it's clear Microsoft is sneaking some absurdity into the EULA on this score. "Any benchmark tests" and "any third party" have a fairly precise legal meaning in this context. I'd like to see them defend this clause; I'm sure it would be entertaining. I know it'll never happen, but.... this sort of thing makes me glad I have Ubuntu on the same drive.

[DainBramaged]

26. Honesty is ALWAYS the best policy

If, after a validation check, your operating system software is found not to be properly licensed, the software you are installing may be disabled, or the functionality of the operating system software may be affected


Just another weapon in the war against the counterfeiters.

[boppers]

33. Minor point of order:

Most unpaid copies of windows are not counterfeit "fakes", they are bit-for-bit duplicates.

Sort of like an actual, US dollar bill, only where you haven't paid the US government a fee to use it, transfer it, or share it.

[hyphenate]

27. Thanks for the review

Someone suggested it to me earlier this week when I complained how slow my system was moving. The problem I had, in part, was Comodo AV, which for some reason was slowing me down almost to a crawl. I uninstalled it, and reloaded AVG. I think I will try out the MSE to see if it makes a difference.

I have found often times that a decent AV starts out very competently, but after a time, they start to miss things and that's the end of how good they are. At least with AVG, the database is constantly updating.

I will let you know if it works out for me.

[DainBramaged]

29. Run it with the AVG for comparison like I did.

I'm playing with the eScan scanner now (it installs to a local temp file very compact and then updates).

[OldEuropean]

31. The malware situation

The scan engine of MSE is one of the best currently around, their generic detections for detecting entire malware families or new unknown malware are also top notch! I wish I could do similar detections routines with our scan engine, sigh.

However, because now MSE is released, available for free and will be installed on many computers, it now also a primary target for the malware writers. All new professional written malware is tested against all major virus scanners and not "released" bevor it bypasses every single of them.
Now, MSE is new and the malware writers will need some time to understand how the detection methods of MSE work internally. But I think, within 2-3 months, the top malware crowd will easily bypass MSE. Of course, Microsoft has alot of manpower to update their generic detection rules and scan engine. It will be interesting how the outcome will be.

That said, I currently would recommend the following setup:

- run your browser sandboxed (Sandboxie, www.sandboxie.com)
- ThreatFire (good behaviour blocker, www.threatfire.com)
- MSE for on-access and on-demand malware scanning
- always have all the patches installed for Windows, the browser, and especially PDF and Flash viewer/plugins!
- if you are "high risk", get PrevX (www.prevx.com, cloud based scanned, a bit paranoid and has quite some false positives)

[DainBramaged]

32. I also use and recommend WOT

http://www.mywot.com/

WOT warns you about risky websites


Thank you for your comments and advice.

[Feron]

38. So I tried MSE and it didn't work out for me.

When the installer says that it doesn't play well with any other anti-spyware apps, they aren't kidding.

It definitely doesn't work with Zonealarm Pro or Zonealarm basic firewalls.

I also found out that you can't uninstall MSE in safe mode. Fortunately I was able to get rid of Zonealarm there.

Once I got Zonealarm out of the way, it worked well. However the problem was now finding a firewall that would be compatible with it and I didn't want Windows firewall. I'm sure there is one out there, but I didn't feel like experimenting. I had already burned up about an hour.

I finally just decided to uninstall MSE and install a Mcafee security suite that my ISP offers for free. So far, so good. And my computer runs faster than it did even with plain MSE installed.

[DainBramaged]

39. Good to know. Zonealarm is something I haven't used in years

I hardwall through my router and have used Windows firewall (along with Net monitoring software)since 2004.

[DainBramaged]

40. Today's kick for the cube crowd......

[cliffordu]

41. I just hate having to kick the carjackers out of my auto every morning.

And why do I keep buying cars without locks??

[City of Mills]

42. Can you run MSE from the command-line?

I can probably google the answer but just wondering if you know...

I've had good luck with MSE, we had an outbreak of W32.Yalove (annoying worm virus) which kept reinfecting user's thumb drives...Symantec Endpoint was 'cleaning' the virus supposedly, but i'd check the running processes and still the virus was resident on systems afer a reboot. I installed MSE on one of the infected boxes and ran it, and found it removed the virus completely. I'd love to replace Symantec Endpoint Protection, I think the scanner is garbage and not as good as it was a few years ago, and maybe MSE would be the way to go. I'll continue testing it when we have occasional outbreaks to see how it handles them...

[Gold Metal Flake]

43. Wow, GD was so overrun with kids on a plane that I did not see this until today.

Thanks for the review. I will try it this evening.

[Heddi]

44. GREAT program---DL'ed it yesterday based on your review

and others I had seen on line (although yours was the first I read about the program).

The laptop I'm using now is maybe...3 years old? and it's had norton on it from the time it came out of the box. Computer has always made this clicky, geiger-counter sound continuously. Thought it was just a quirk b/c computer ran fine otherwise.

However, norton is so fucking bloaty. Sometimes 'pooter would be clicking away, I'd open up task manager and find that norton was taking up more power than Firefox and windows explorer...for no reason.

So yesterday I uninstalled norton. IMMEDIATELY the computer was faster...I had never noticed to to be slow to begin with, but man, what a difference without that piece of crapola.

DL'ed MSE and wow....no clicking. Runs in the background without being obtrusive. The scan time was fine. I really like this program.

Our older laptop...maybe 5 years old now...very bloaty. We started out with norton then when that ran out went through the gammut of "Free" anti-virus. Everyone lauded AVG but I found it to be very bloaty, very slow, and a resource hog. Tried a few other "free" ones (not gonna pay $70 for something if it's not good). Ended up a few months ago just going back to norton, but will give MSE a few weeks on the new lappy and if it seems good we'll just kiss the $$ we paid for norton on the 2nd laptop and download MSE and see if that improves performance on the older laptop.

Thanks for this review. It seems like an awesome program so far.

[DainBramaged]

45. I try my best to review 'stuff' the DU community can use. This one is a winner.

:fistbump:

[Hawkeye-X]

46. Kicking it so I can install MSE at home

I've noticed that AVG has gotten worse and worse, not catching everything...

Right now I'm in the middle of a 2008 install and strange things are happening with the server.

*sigh*

Hawkeye-X

[Heddi]

48. AVG caused my computer to come to a screeching halt

It was fine when it was first installed, but then it just got....boggy. Going to do a re-start? better pack a fucking lunch.

People told me "Oh, you need to add more memory, it's your computer, not the program"---bullshit. Once I got rid of AVG the computer ran fine, memory was fine. But I'd swear the way some people raved about AVG that the program came to life at night and placed gold coins under people's pillows it was SO FUCKING LAUDED.

Screw that. And screw norton, and symantec. We learned our lesson with McAfee years ago after an upgrade download caused our until-then-running-fine computer to just go...schizophrenic. It was never the same, even after every bit of McAfee evil was removed from the damned computer.

I really like MSE. IT's been over 24 hours and my computer hasn't sounded like a gieger counter at Hiroshima ONCE!!! that has, like, never happened before!!!

[Hawkeye-X]

51. Just nuked AVG and put MSE in its place.

We'll see how well it protects my computer.

If it's good as advertised, I'll be putting it on our clients' computers instead of AVG to see if it speeds up computers. many are complaining their computers are crawling like a snail, and I'm suspecting AVG.

Hawkeye-X

[Statistical]

52. AVG was really good at one time. Before Avast was popular it was one of the best.

Now it is just another bloatware has been.

Avast! or MSE for me.

[Heddi]

49. it sure is. THanks alot for the reviews -

Mr. Heddi used to be a graphic designer in his past life, and used a Mac at work...we even had a mac at home, but years ago (98?) wanted a new computer. Macs were too expensive for our meager budget, but we were able to get a shitty Dell desktop system for a good price (for us). That was his first interaction with windows-based computer systems. It was a bit of a learning curve since he had been mac-only for the previous...?? years (since college).

Well once the learning curve was over he was sold. Hates macs. Only used them for work. Would never consider buying a mac. Has plenty of experience with them...high end, low end, desktop, laptop, etc etc.

Me, I've only ever used them in a limited basis and not enough to form an opinion one way or another.

HOwever, it's nice to see reviews of windows-based products. The laptop I'm using now, that has MSE on it, is a vista machine. Despite all the himming and hawing about Vista, I've never had ONE SINGLE PROBLEM with this computer (aside from Norton). None. Vista has been good. The other puter has XP on it. Fine product. Previous desktop had Windows 98. Again, fine program.

Maybe I don't abuse my computers, software, and hardware the way most people do, but I've never had an issue with Microsoft products. They've done exceedingly well for my needs, and while I'm not an IT Pro, I'm a relatively savvy computer and internet user, can find my way around a registry, etc, with minimal help, etc etc.

I think sometimes people hate MS because it's MS, yanno? I mean, what the hell? If a product works, who cares WHO makes it? If this was an apple product, and it works, I'd be just as much behind it.

Thanks for the Windoze reviews...that's what I was trying to say originally and got distracted :D