ie8 fix
madison

Hardware 2.0

Adrian Kingsley-Hughes

Do you STILL trust Microsoft to build antivirus support into Windows 8?

By | October 1, 2011, 7:18am PDT

Summary: Is building an antivirus package into Windows a bad idea?

Microsoft is building antivirus support directly into Windows 8. But following a blunder the other day that caused the Google Chrome browser to be identified malware, do you still trust Microsoft to deliver effective protection?

The problem was outlined in a blog post over on the Google Chrome Blog yesterday:

Earlier today, we learned that the Microsoft Security Essentials tool began falsely identifying Google Chrome as a piece of malware (”PWS:Win32/Zbot”) and removing it from people’s computers.

Microsoft has more details:

On September 30th, 2011, an incorrect detection for PWS:Win32/Zbot was identified and as a result, Google Chrome was inadvertently blocked and in some cases removed. Within a few hours, Microsoft released an update that addresses the issue. Signature versions 1.113.672.0 and higher include this update. Affected customers should manually update Microsoft Security Essentials with the latest signatures. After updating the definitions, reinstall Google Chrome. We apologize for the inconvenience this may have caused our customers.

False positives do happen. I’ve covered a few examples on this blog over the years, and depending on what’s identified as malware, it can be pretty devastating. When McAfee mistakenly identified the system file svchost.exe as malware back in April 2010, this prevented Windows from even loading up properly. I heard from a number of people who had no idea what had happened to their PCs and had to completely reload their OS and applications.

One antivirus package installed on every Windows 8 system will mean that millions of people could be vulnerable to a dodgy update. As much as I like the idea of having an antivirus package installed on Windows by default, the thought of the widespread damage to millions of PCs that a single bad update could cause also worries me greatly.

This mistake on Microsoft’s part might suggest that it isn’t ready to deploy its security solution to all Windows users just yet and that it needs to put in place a better mechanism for testing updates before they are deployed.

Poll

Do you STILL trust Microsoft to build antivirus support into Windows 8?

Note: I use Microsoft Security Essentials and Google Chrome on a number of systems and wasn’t affected by this problem.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology.

Disclosure

Adrian Kingsley-Hughes

All opinions expressed on Hardware 2.0 are those of Adrian Kingsley-Hughes. Every effort is made to ensure that the information posted is accurate. If you have any comments, queries or corrections, please contact Adrian via the email link here. Any possible conflicts of interest will be posted below. [Updated: February 23, 2010] - Adrian Kingsley-Hughes has no business relationships, affiliations, investments, or other actual/potential conflicts of interest relating to the content posted so far on this blog.

Biography

Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology -- whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera.

Adrian has authored/co-authored technical books on a variety of topics, ranging from programming to building and maintaining PCs. His most recent books include "Build the Ultimate Custom PC", "Beginning Programming" and "The PC Doctor's Fix It Yourself Guide". He has also written training manuals that have been used by a number of Fortune 500 companies.

Adrian also runs a popular blog under the name The PC Doctor, where he covers a range of computer-related topics -- from security to repairing and upgrading.

140
Comments

Join the conversation!

Just In

Google Chrome is a branded spyware
BRomeroT@... 13th Apr
Come on!!! Google Chrome is a branded spyware, so the infection detection was perfect happy
Funny. Almost every other anti-virus software maker had the same type of snafu happening to them already. What makes Microsoft different is at least they fix the problem as soon as possible and it comes free with the OS.
@madfry Well if thats true.. and i don't think so, then every (other) antivirusbuilder has a problem..

energie vergelijken
@Energieprijzen

Why yes they do,
for example Kaspersky internet security 2012 deleted the MSN plus uninstaller, and flagged it as a maleware (and it still does!!!) which cause me a great deal of frustration ( i had to re install it disable my av, then uninstall it then disable av startup because uninstaller continues after reboot etc.

And i still use Kaspersky 2012
And believe me KAS is one of if not the best AVs out there and it still has false positives
Not to mention AVG was notorious for this, I had many false positives.
0 Votes
+ -
Microsoft's case is different. We got Chrome deleted here and the conclusions aren't pretty:

1) MS doesn't let you enable just that one file, they insist on removing the file or allowing this kind of virus forever and everywhere. That's not good.

2) It doesn't matter if they messed up the update deliberately... although - THEY SHOULD HAVE TESTED THE UPDATE ON CHROME AND OTHER SOFTWARE IN WIDE USE.

3) The mere presence of such a giant conflict of interest is an incontestable reason against using MS AV software or an OS which embeds it, especially for mission critical tasks.
@Energieprijzen Yes as a matter of fact every other anti virus builder does indeed have a problem with false positives.

@sambors You seem to be more upset over the fact that Google Chrome was temporarily deleted than the fact that it was a false positive and was fixed the same day. Personally I'd much rather have a false positive and have Chrome deleted and the issue fixed with a same day update than it miss something and my system gets infected.
@Adrian: do you still trust Apple in readily acknowledging the existence of malware for Mac?
0 Votes
+ -
And other companies don't?
spdragoo@... 3rd Oct
@sambors

Had they done it deliberately, *every* user of MSE that had Chrome installed would have lost Chrome.

However, as with the blog's author, I had *zero* problems with it. MSE was running the entire time, & *nothing* happened to Chrome on my PC. And I even started my PC up twice that day: once in the morning before work, once in the evening after work. Two opportunities to be affected, & nothing happened.

Big flap over *nothing*, IMHO.
@Energieprijzen

Yes, it is true. The same thing has in fact happened to all other A-V firms. More than once. I can testify to that one in court. Some of those events took days, weeks, and in at least one case, months, , before a fix was issued.
@madfry
The main objection to Microsoft building their own AV is that they also are building the OS. If Windows was built with care from the beginning then AV software would be of no use today, like on every other OS.
@Mikael_z,
"If Windows was built with care from the beginning then AV software would be of no use today, like on every other OS."

If that was the case, care to explain why Mac OS includes a malware blocker since Snow Leopard?
http://www.zdnet.com/blog/security/apple-adds-malware-blocker-in-snow-leopard/4104
@Mikael_z Exactly, defense should be in the blood.
@Mikael_z You really think so? Don't know weather to just call you a noob or a fool. Think noob will do happy
@Mikael_z

You obviously don't know much about the Real World. It doesn't work the way you think it does...

First of all, there are over 1.2 billion Windows users, compared to around 80 million Mac users and 12 million Linux users.

Second, most malware these days get onto systems due to social engineering and not flaws in the OS. Others get onto the system due to flaws in non-OS software (like, uhm, pretty much all of Adobe's software).

So yea, a statement like...

"If Windows was built with care from the beginning then AV software would be of no use today, like on every other OS"

...shows you are completely clueless.
@madfry

It's not free, it's included in the price.
@Alan Smithie So when I bought Windows 7 I also bought Microsoft Internet Security? Did I just imagine that separate free download? All Microsoft is doing is incorporating that free software into the OS... so yeah it is free.
@Pete "athynz" Athens

Actually, no. The fact is that Microsoft Internet Security is an add-on program that is included in the price of your purchase of Windows 7.

Just like Windows Media Player and Internet Explorer are overseas where they are not allowed to be bundled in with the OS.
0 Votes
+ -
You are correct.
Mister Spock 2nd Oct
@madfry
Did not McAfee have a major issue not too long ago? And Symantec, as well as Kaspersky?

And these are "big name" companies.

I believe that the blogger is "troling for hits", if I have used the phrase correctly.

plain
@Mister Spock

Did you follow the links? And he did mention McAfee in his article (unless it was edited since this comment).
@madfry Exaclty what I was going to say.

Also, it is Microsoft's operating system, so it should be their job to ensure that it is as secure as possible.
@madfry - Microsoft is one big threat to all users of their OS. Everytime there is a problem with the PC then can you blame Microsoft. You pay a lot of money for a OS that is only half build when it hit the street ! Vista is the best example on the earth to that statement. You have to download 4+ GB updates after you have installed the OS ! After that will you have to download about 0.5 GB updates each week.

Do you really mean that you like Microsoft to put some quarter build AV inside the OS ?
I pass Win8 if that happens. Microsoft like to control the market and this is the best way to overtake the PC with your own accept and even make you pay for the OS too !
@iTrucker funny, most updates i see are less than 10 mb. not 500. When they install, they typically replace other files, meaning the increase in actual size is minimal. You seem to be angry that you have to pay for things that other people have built. try building your own OS.
@iTrucker sure, you can blame Microsoft if you want, but that doesn't mean it actually is Microsoft's fault. I've had plenty of difficulty with third party software and drivers that were the problem, not Microsoft.
@iTrucker You said, "You have to download 4+ GB updates after you have installed the OS ! After that will you have to download about 0.5 GB updates each week."

That seems to be a lot, but it isn't too far off the update schedule that you get with Ubuntu or Red Hat... Don't know about Apple's newest, but there are regular updates on Mac OS's that I am familiar with.

The complaints based on having updates available are specious B.S. If you had an electronics store in certain parts of Chicago or NYC would you complain to the builder of the building that you had to keep upgrading security as the crooks got more creative with their theft and break in attempts... even though the builder was supplying the upgrades for free?
@notme403@...

it isn't too far off the update schedule that you get with Ubuntu or Red Hat

You have to keep in mind that Ubuntu and RH updates contain a lot of third party stuff. If there's an update to the Apache web server, you're going to get it from Ubuntu.




happy
@madfry I think that the problem is the perception of it being sinister since Microsoft competes with Chrome. If Symantec Antivirus nukes McAfee AV, then that looks bad. If MS's AV product nuked Photoshop, I don't think anyone would jump to any conclusions.
0 Votes
+ -
@davidr69

But like Chrome, IE is free to download -- there's no separate charge for it & you have to elect to upgrade it yourself (unless you've set your Windows Update to automatically download & install all updates).

Market share may be nice, but since *no one* is charging for their browsers anymore, no one makes money by having the #1 browser. About the only thing you get is "bragging rights", I suppose...but that & a $5 bill might get you a Starbucks coffee...
0 Votes
+ -
You missed the point
goyta 3rd Oct
@madfry, when the same kind of mistake happens with other antivirus software, only its users will be affected in a very fragmented market. But if at some point in the future 70% of the world's PCs and other devices are running Windows 8, among them another 70% are running the built-in antivirus (it could be more, given the experience of when IE and Outlook Express first came bundled to Windows 98), and a catastrophic update comes that renders Windows itself useless, HALF of the world's PCs will be compromised and the losses could amount to billions. There is no comparison to the impact of a blunder by McAfee, Kaspersky, Symantec or whatever. It would be several orders of magnitude worse and could have unthinkable consequences.
@goyta
Chrome not starting because of a false positive is an easily fixed solution. svhost.exe not starting is not fixed easily. My computer relies on the OS, not the browser to operate. I'll be happy if MS includes AV by default. Of course, they will make it removeable so as to not cut the AV companies completely out (maybe:))
@madfry I agree. Regular AV developers often take forever to fix their blunders. I can forgive MS for this one quite easily happy
It's one tiny mistake that Microsoft fixed pretty fast. There are other AVs that perform these mistakes all the time and neglect to fix them (coughAVGcough).
I have seen too many machines infected that were running Microsoft's Security Essentials Software and Avira has caught the infection so I don't even bother with their product, instead I opt for 3rd party support.
0 Votes
+ -
None is perfect
LiquidLearner 1st Oct
@Peter Perry

I've seen pcs with avira that Symantec cleaned, pcs with Symantec that mse cleaned, etc. With good security policies in place mse is often good enough. If you find the holy grail of antivirus let me know.
@LiquidLearner Maybe you have, but in my opinion MSE is the worst of the bunch.
@Pter Perry

That's fine, as long as we realize yours is just an opinion, too.

& LiquidLearner is right: there's *no* AV suite out there that catches 100% of the infections. Since they don't play nice with each other, & since many of them (*cough*Norton*cough*) make it nearly impossible to remove it when you're done, you don't even have the option of doubling up on AV protection either. So if some people get good results with MSE, & some people get bad results, I'm more inclined to believe that it's the *people* causing the problems than the AV program.
@spdragoo@...

Lie about Norton. I have NEVER in the past 10 years had ANY problems installing Norton unless a virus messed with it.
@Peter Perry
Good for you. The fact is, this isn't a security Panacea (there is none) it's simply a procedure to create a new default state - if you do nothing to Windows it will still be running MS's antivirus, antimalware and firewall by default. And while none of these is full absolute protection, their a better foundation than the far to common 1 month Antivirus trial.
@brendan@... Avira and Malwarebytes is actually a very good combination.
@brendan@...
Well said. Peter Perry just hates MS.
0 Votes
+ -
a base av is good
LiquidLearner 1st Oct
There will still be better out there. But having something basic is good. That's a fairly mild false positive. I've seen McAfee decide that mad.exe was a threat, I've seen Symantec shut down all communication on a domain controller with ips. There is a trade off. One client of mine just uses deepfreeze instead of antivirus because of issues he's had with several programs.
The user has anti-virus software running from the get-go and Microsoft will automatically, and transparently, update both the software and signatures.

If a user prefers an alternate anti-virus product or no anti-virus, then he/she can disable MSE, install the anti-virus software of their choice or go "commando".

I would rather see Microsoft enable AppLocker or Software Restriction Policy (via gpedit.msc), in a user-friendly way, for all editions of Windows 8 as I believe that application (and dll) whitelisting is more effective against malware than signature-based solutions.

A link to some anti-virus signature snafus:

http://en.wikipedia.org/wiki/Antivirus_software#Problems_caused_by_false_positives

Microsoft is not alone.

Edited to include Software Restriction Policy whitelisting via gpedit.msc per LiquidLearner's post, below.
@Rabid Howler Monkey

At least this mess up, didn't delete a critical system file. I would rather re-install a browser than the entire OS.
@Cylon Centurion
Is that the A|B choice? I'd prefer neither.

AV software is a compromise, it will never be perfect. It will tend to be reactive, which means behind a curve. There is no single use case which simplifies testing and if there was, the ones who provide our colloquy will find their systems locked down to the point of uselessness. Mistakes will be made. We are backing up and setting restore points, right?
0 Votes
+ -
@Rabid Howler Monkey

Although in a way metro accomplishes this with the market installs. App locker rocks on a network though. I'd like pro and higher to support it so you don't need enterprise to get it.
@Rabid Howler Monkey

" Microsoft is not alone."

But Microsoft's operating system IS alone.

PS. Exactly what is it that you are defending?
@Return_of_the_jedi wrote:
"Microsoft's operating system IS alone.

Apple Mac OS X Snow Leopard and Lion currently check for malware definition updates daily:

http://www.macrumors.com/2011/09/26/apple-updates-anti-malware-tools-to-address-new-trojan-threat/

Apple, since Mac OS X Snow Leopard, has built anti-malware capabilities into their desktop OS. If you're interested, the malware definition file is named 'Xprotect.plist'. Still, Mac OS X remains far safer than Windows.

It would appear that Desktop Linux (along with the BSDs) is standing apart from Windows and Mac OS X. Desktop Linux, with it's market share below 2%, is not even in the sights of the malware miscreants.
0 Votes
+ -
@Return_of_the_jedi

The discussion (& the blog's topic today) is about whether the recent minor snafu of *MSE* accidentally nuking Chrome on *some* PCs should affect Microsoft's plan to include it in Windows 8. Rabid Howler Monkey was pointing out that Microsoft's MSE product is far from the only AV software that's run into problems.

I particularly found the reaction of Pegasus Mail to Norton's AV tool falsely identifying them as malware -- not once, but on 3 separate releases -- to be particularly hilarious.
Yes, having this from the get go in Windows 8 is a good thing... Faaar too many people don't bother with a base AV after buying their machines, and 9 times out of 10 those free trial AVs that junk up their systems, expire, leaving them in the dark.

Hopefully, this prevents OEMs from installing junk AV services on Windows 8 machines.

But, I'm in the same boat; I have both Chrome and MSE installed, and yesterday came and went without so much as a pop up.
@Cylon Centurion

Hopefully, this prevents OEMs from installing junk AV services on Windows 8 machines.

If so, they are going to make up that lost revenue somewhere. Watch your wallet.



happy
0 Votes
+ -
Yes
Michael Alan Goff 1st Oct
Are they perfect? No, they're far from perfect. But any defense is a good defense, especially when the average computer literacy of the common user is going down as time goes on.

That is the downside of the proliferation of computers, I'm afraid. As more people get their hands on them, more idiots who would never get an antivirus also increases.
0 Votes
+ -
Google Chrome is a branded spyware
BRomeroT@... 13th Apr
Come on!!! Google Chrome is a branded spyware, so the infection detection was perfect happy

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix