Rival calls foul over Microsoft's delivering Security Essentials via Microsoft Update

[MrBrian]

http://www.computerworld.com/s/article/9195079/Rival_calls_foul_over_Microsoft_s_delivering_Security_Essentials_via_Windows_Update

[Cudni]

They wouldn't be rivals otherwise. Seriously though it is only good for the user, that does not have an AV, to have a simple way of obtaining one. Some users might stay with their original choice but a lot will at some stage remove it and use some other AV solution instead. What is important that some AV is there in place.

[King of Rapture]

-{ Quote: "They wouldn't be rivals otherwise. Seriously though it is only good for the user, that does not have an AV, to have a simple way of obtaining one. Some users might stay with their original choice but a lot will at some stage remove it and use some other AV solution instead. What is important that some AV is there in place." }-
Hi Cundi,

Very true!

However, I have my Windows setup to update automatically. Would this install on my machine without my knowing.

It conflicts with Sandboxie.

[Cudni]

What are you doing without an AV ;) ?

it will not download/install automatically as it has to be selected by user as something to download first

[King of Rapture]

-{ Quote: "What are you doing without an AV ;) ?

it will not download/install automatically as it has to be selected by user as something to download first" }-
Hi Cundi,

I have been Avast Free with Microsoft Security Essential. When I purchased Sandboxie about 2 months ago, I had to uninstall it as it would not allow me to start Sandboxie.

Yesterday, I purchased Avast Internet Security for 3 years, for 3 PCs. A special discount given to Wilders' members.

Many thanks for such a good site.

Best regards,

KOR!

[Hugger]

-{ Quote: "Hi Cundi,

Very true!

However, I have my Windows setup to update automatically. Would this install on my machine without my knowing.

It conflicts with Sandboxie." }-

King,
How does MSE conflict with Sandboxie?
I'm using both on my W7 x64 with no noticeable problem.
Thanks.
Hugger

[funkydude]

-{ Quote: "They wouldn't be rivals otherwise. Seriously though it is only good for the user, that does not have an AV, to have a simple way of obtaining one. Some users might stay with their original choice but a lot will at some stage remove it and use some other AV solution instead. What is important that some AV is there in place." }-

Agreed. :thumb:

[culla]

av's are old school and no longer needed with virtualization and imaging ;D

[m00nbl00d]

-{ Quote: "King,
How does MSE conflict with Sandboxie?
I'm using both on my W7 x64 with no noticeable problem.
Thanks.
Hugger" }-

I've just tested both in a virtual machine recently, and they worked fine together. Windows 7 Ultimate 32-bit.

Most likely there's a third-party culprit here.

[vasa1]

-{ Quote: "av's are old school and no longer needed with virtualization and imaging ;D" }-

Ahem! Don't forget us ordinary folks!

[HAN]

Can't say I think it's right at all. AV is not the Windows OS. And, it's not Office. It IS a competing product and using the pipeline that updates only MS products to supply an AV is IMO, the wrong method. Yes, it may be an altruistic gesture/program, but it sure looks like marketing to me.

FWIW, this is not new territory to me for these thoughts. I was adamantly opposed to MSE using Windows Update as it's delivery connection. Now they've "expanded" it to downloading the program? What's next? Their new "sandbox" solution? Or who knows what else?

[funkydude]

-{ Quote: "Can't say I think it's right at all. AV is not the Windows OS. And, it's not Office. It IS a competing product and using the pipeline that updates only MS products to supply an AV is IMO, the wrong method. Yes, it may be an altruistic gesture/program, but it sure looks like marketing to me.

FWIW, this is not new territory to me for these thoughts. I was adamantly opposed to MSE using Windows Update as it's delivery connection. Now they've "expanded" it to downloading the program? What's next? Their new "sandbox" solution? Or who knows what else?" }-

If it's good for the user, so what? What's next? Removing paint because it competes with paint.net? Removing the defrag because it competes with defragmenting programs?

Maybe they should remove the firewall and everything related to security for a fair ground am I right? ;D

[m00nbl00d]

-{ Quote: ""Commercializing Windows Update to distribute other software applications raises significant questions about unfair competition," said Carol Carpenter, the general manager of the consumer and small business group at Trend Micro, on Thursday." }-

Interesting choice of words. Unfair to whom? Not to end-users, I must say. What's unfair is for those security vendors to make deals with computer manufacturers, so they install their trial security software, and force end-users using them, and in most times end-users have no idea they're running a trial security software, and run months and months without a working solution, and find it out already too late, when the system is infected.

So, what is unfair?

[m00nbl00d]

-{ Quote: "If it's good for the user, so what? What's next? Removing paint because it competes with paint.net? Removing the defrag because it competes with defragmenting programs?

Maybe they should remove the firewall and everything related to security for a fair ground am I right? ;D" }-

Hey, fair is fair, let's also take away Windows Explorer - the Windows shell. ;)

Microsoft should only provide the kernel to end-users. Let's all start making our own distributions. :) Hyper.

[BoerenkoolMetWorst]

I think a lot of people are over-reacting. It is only offered as an optional update, when the user has no AV and is delivered through Microsoft Update, not Windows Update.

[Escalader]

When you think about this a bit we all use M$ as our o/s.

We don't have to do this there are options Apple, Linux etc.

Now why would I use an o/s from a vendor I don't trust this makes no sense in an of itself does it?

That said there are tactics M$ has used and does use I don't like the update being on all the time to get updates to MSE and of course forcing IE on me and Windows Explorer on us the way they do. The biggie of course is the fact that for years they provide the vast public with buggy and insecure o/s.

These flaws have created a whole S/W 3rd party industry to fill the gaps. FW's, AV's sandboxes etc.

But you don't need the use free MSE or their FW and leave the update service on if you are prepared to do some work.

You have choices for those if you like! Leave the update off then.

[Hugger]

-{ Quote: "I've just tested both in a virtual machine recently, and they worked fine together. Windows 7 Ultimate 32-bit.

Most likely there's a third-party culprit here." }-

Great. Thanks.

[Daveski17]

Oh those naughty Mickeysoft chaps & their policy of giving away free AV programs ... ::)

Now, if only they gave away a freeware OS! ;)

[King of Rapture]

-{ Quote: "King,
How does MSE conflict with Sandboxie?
I'm using both on my W7 x64 with no noticeable problem.
Thanks.
Hugger" }-
Hi Hugger,

I cannot now remember the SBIE error number. Sandboxie wouldn't start. I had a choice either to uninstall MSE or Avast. I chose to keep Avast.

After experiencing for weeks now, I have found out that one can only install four or less low level software for them to function properly. At present, I have the following low level software installed.

1. Avast Internet Security
2. Sandboxie
3. Returnil

If I remove the Avast firewall and instead install the Outpost Firewall PRO, one of the program stops working. Or, install SpyShelter Premium.

Give it a try and let me know.

[King of Rapture]

-{ Quote: "I've just tested both in a virtual machine recently, and they worked fine together. Windows 7 Ultimate 32-bit.

Most likely there's a third-party culprit here." }-
Hi m00nbl00d,

Please see my above post to Hugger. And, thanks for testing it in a virtual environment. I don't know how much Windows 7 Ultimate 32-bit, differs from the 64-bit.

But since we are in testing mood, can you install on top of MSE and Sandboxie the following programs and see what happens.

1. Avast Antivirus PRO
2. Outpost Firewall PRO
3. SpyShelter Premium.

Kindly lets us know the results. Also, while at it after rebooting try to update Avast Antivirus PRO.

Many thanks,

KOR!

[m00nbl00d]

-{ Quote: "Hi m00nbl00d,

Please see my above post to Hugger. And, thanks for testing it in a virtual environment. I don't know how much Windows 7 Ultimate 32-bit, differs from the 64-bit.

But since we are in testing mood, can you install on top of MSE and Sandboxie the following programs and see what happens.

1. Avast Antivirus PRO
2. Outpost Firewall PRO
3. SpyShelter Premium.

Kindly lets us know the results. Also, while at it after rebooting try to update Avast Antivirus PRO.

Many thanks,

KOR!" }-

Hello,

I'll try it later, when I manage to find a spare time.

But, now that you mention that, I do remember that when I first tried Sandboxie, near 2 years ago, to install it to family members, and Sandboxie's driver wouldn't load if a few applications installing low-level drivers would be installed. Uninstalling one of them would make Sandboxie load again. Back then, my test was between Sandboxie, AVG IS, AVG Identity Protection and Outpost. Installing Sandboxie first would do the trick, if I well remember; I haven't rebooted the system back then, though, so it could had been a trick to my eyes.

[Terarus]

Carpenter was clearer. "We're concerned that Microsoft may be using its OS-based market leverage to box out other choices. If that were to happen, it would not be good for consumers or the industry, and would warrant a second look."

Each and every company will exploit the advantages they have. In microsoft's case its their dominant position in the o/s market. To say its an anticompetitive act is perhaps a bit of an exaggeration. After all, MSE controls much less a market share compared to all other vendors and it does not charge money for the service it provides. Its not reaping in profits (however, the govt will butt in if it does attempt to) - all this will do is force vendors to provide cheaper and/or better services to consumers. Consumers will gain.

We're not seeing the same thing as internet explorer, a forced update on users. Its purely optional and you can hide it away from the update screen. I don't see any problems with this move. Other vendors do similar things, which new laptop or desktop purchase (cept the one you make yourself) doesnt come with some sort of trial? Its pre-installed and the manufacturer wont let you untick it most of the time. The average joe is going to stick with what they get, and if their system comes pre-installed with norton, trend micro or mcafee etc etc; they'll pay for it.

[Noob]

LOL, it's their software and their offering a good and free product :D

And they shouldn't worry if their product is good enough ;D (Suite-More features, better protection etc.)::)

[m00nbl00d]

Isn't this a lot hate ???

-{ Quote: "1. MSE is not a good solution to the malware problem. While the argument of protecting users who do not have AV is commendable, the reality is that MSE only installs on computers with a valid Windows OS license (paid to Microsoft)." }-

OK. And, how exactly do the paid versions of their products run? Either pirated or paid... I wonder which % is what. And, those who run pirated, for how long do they run it, until Panda kills it ???

So, what is the logic here ???

There is more: http://pandalabs.pandasecurity.com/microsoft-just-doesn%e2%80%99t-get-it%e2%80%a6-security-is-about-diversity/

Advise: Just make your damn products better by the day, rather than criticizing a free and pretty great antimalware product!

-Edit-

I love this one, though.

-{ Quote: "5. Secure the Operating System itself. Even though Microsoft has made significant improvements in securing the OS in recent years, there is still a long way to go as witnessed by the constant zero-day vulnerabilities that are published every month, such as the incredibly dangerous LNK vulnerability that Stuxnet exploited. Microsoft’s security resources should work on making the OS more secure, not just putting a band-aid on it. Who knows, maybe someday if Microsoft manages to really make their OS secure, antivirus products won’t be needed anymore. But until that day comes, Microsoft should make a serious development effort to secure the OS from the ground up and not limit the security tools currently available to its users." }-

Yes, indeed. I'm pretty sure Panda is eagerly awaiting for that day. ;)

[King of Rapture]

-{ Quote: "Hello,

I'll try it later, when I manage to find a spare time." }-
Hi m00nbl00d,

Many thanks, would love the results of your testing.


-{ Quote: "But, now that you mention that, I do remember that when I first tried Sandboxie, near 2 years ago, to install it to family members, and Sandboxie's driver wouldn't load if a few applications installing low-level drivers would be installed. Uninstalling one of them would make Sandboxie load again. Back then, my test was between Sandboxie, AVG IS, AVG Identity Protection and Outpost. Installing Sandboxie first would do the trick, if I well remember; I haven't rebooted the system back then, though, so it could had been a trick to my eyes." }-
Very true that Sandboxie should be the first one to be installed. However, if too many low level drivers are installed, Sandboxie would again stop working.

Happened to me once!

[ALookingInView]

-{ Quote: "It is only offered as an optional update, when the user has no AV and is delivered through Microsoft Update, not Windows Update." }-
Yep. Good luck to Panda and Trend Micro should they choose to cry in court.

-{ Quote: "And they shouldn't worry if their product is good enough ;D" }-
This.

[safeguy]

-{ Quote: "I think a lot of people are over-reacting. It is only offered as an optional update, when the user has no AV and is delivered through Microsoft Update, not Windows Update." }-

:thumb: :thumb: :thumb:

It's optional...it's not pre-included or forced down your throat as compared to trialware that's bundled into your system or a stamp of "recommendation" by your friendly salesman geek at that laptop sales shop in which the noob user may blindly take upon as the words of wisdom and say "let's head down and buy that shiny piece of box and be cure from all evils". (Take note I'm not saying that is bad...I'm just trying to make a point here with such a tone. No offense)

I wonder why people make such a big fuss out of this. Why the surprise when MS offers an optional security software for free to customers who have purchased a license to use their OS?

If you don't like it, don't install it. Just to clear any doubts or allegations that may be thrown at me: I don't use MSE and I'm not a MS fanboy .

-{ Quote: "Interesting choice of words. Unfair to whom? Not to end-users, I must say. What's unfair is for those security vendors to make deals with computer manufacturers, so they install their trial security software, and force end-users using them, and in most times end-users have no idea they're running a trial security software, and run months and months without a working solution, and find it out already too late, when the system is infected.

So, what is unfair?" }-

Very true. Unless you've not seen it, then you'd have no problems in identifying the truth behind this statement.

Most of us here know that there are alternatives to MSE in the marketplace for AVs. There are others out there who don't know much about security but at the very least still knows a few brand names like Norton or McAfee (for example purposes only) These guys won't be "duped" by such a *marketing" if you deem it this act by MS to be as such. But imagine those folks who knows nothing at all about all these? Would you rather them have MSE being offered to them optionally or to let them run free without nothing? (and we've not mixed in other security software categories/concepts into the mix here yet)

One can argue like Luis Corrons in that MS should...:

-{ Quote: "Microsoft should continue giving their AV for free. The point is that they should make *all AVs* available for free via WU, not only theirs. By doing so it will benefit consumers as they will have more options to choose from. (http://pandalabs.pandasecurity.com/microsoft-just-doesn%e2%80%99t-get-it%e2%80%a6-security-is-about-diversity/comment-page-1/#comment-12706)" }-

But that brings into the table another problem. The problem of "free AV vs paid AV." I dare bet you that those brands/companies that solely offer paid solutions won't be too happy about the decision. To which point does MS have to go to please every single AV vendor out there? Include them all just to be 'fair' to all parties and at the same time benefit the end-user? Really? Do you really think that the end-user would bother figuring out which among the many would suit them? Why should they? Why can't they just pick one of the few (and heck 'free') and be done with it? Has the ultimate problem been solved by such a move?

And like I've noted earlier, we have not even mentioned OTHER security software like light virtualization software, HIPS, anti-executable, what-else-you-can-think-of....just to be fair to all parties. Come on....diversity and making every single user aware of all those options is a good thing, isn't it?::) After all, not everyone is in favor of AV software....some people think it's outdated technology so we do have to consider those users too just to be fair. Am I not right?:P

To take the horses words into his mouth:

-{ Quote: "No security solution is perfect, and no technology is enough, that’s why we keep improving (http://pandalabs.pandasecurity.com/microsoft-just-doesn%e2%80%99t-get-it%e2%80%a6-security-is-about-diversity/comment-page-1/#comment-12675)" }-

Same goes for MS and whatever they're doing. So, why the double standards? I see...the worry here may be of 'monopoly' or 'monocultures' but let's face it this way: MS OS itself is in one form or another and perhaps arguably a monoculture (http://en.wikipedia.org/wiki/Monoculture_%28computer_science%29) in it's own class. I don't see security software vendors complaining about that...

I wouldn't argue against Luis Corrons being right that "Microsoft just doesn’t get it… Security is about diversity (http://pandalabs.pandasecurity.com/microsoft-just-doesn%E2%80%99t-get-it%E2%80%A6-security-is-about-diversity/)"...he/she has got very valid points there I truly agree and respect to. However, Luis Corrons also has to bear in mind that:

"Security isn't just about diversity, other factors play a role too"....

I don't think we need to discuss those other factors...or do we?

[m00nbl00d]

@ safeguy

I hope I'm understanding your question. You're asking whether or not such people should be without MSE or with it?

My answer is with it, of course. Why would they run without an antimalware app, if that's the sort of protection they would only know how to operate? I never said they shouldn't use MSE. I said I don't understand what's the fuss with all these security vendors. What do they fear?

And, the same company (Panda) some time ago in an enterview to Softpedia stated this:

-{ Quote: "Pedro Bustamante: The goal of Panda Cloud Antivirus is to be the only anti-malware protection you need for your computer. At the end of the day it’s about knowing and processing huge amounts of malware rather than requiring two different products that do the same thing. (...)" }-

Source: http://news.softpedia.com/news/Softpedia-Exclusive-Interview-Panda-Security-142289.shtml

Taking this here

-{ Quote: "Monocultures are a hacker’s paradise. If pushing MSE via Windows/Microsoft Update is very successful it will end up creating a monoculture of hundreds of millions of users having the same antivirus product. Right now hackers have to worry about bypassing multiple antivirus products and protection layers every time they release a new piece of malware. Having to bypass only one AV product makes their life so much easier. This alone will allow hackers to push more new malware that bypasses MSE exclusively and infect many more users with every new variant. Alternatively, reverse engineering of MSE and related Windows components will boom, potentially discovering zero-day vulnerabilities which could cause infections in tens of millions of PCs with a single attack. Monoculture in Operating Systems is in and by itself bad. Monoculture in security is A VERY BAD THING." }-

From the article I previously mentioned: http://pandalabs.pandasecurity.com/microsoft-just-doesn%E2%80%99t-get-it%E2%80%A6-security-is-about-diversity/

So, it's bad if it's MSE, but not if it's Panda?

Please, note that I never mentioned that the full article was bs. Some stuff is valid and I do agree, but rather than trying to bash one other product, they should be improving their, specially considering that in the same testing they mentioned MSE got 15, they got 9 place. So, their product, according to the testing they mention, should not even be considered a valid third option to fight malware.

By the way, I'm in favor for a global Microsoft repository from where people could download apps without concerns of being rogue, digitally signed, etc but how would that work for some software developers, including open-source software? I sure would love seeing it happening, but will it ever ???

[funkydude]

You either have an eagle eye or a sharp memory m00nbl00d, that's nicely spotted there, good post. :)

-{ Quote: "I sure would love seeing it happening, but will it ever ???" }-

Well, it was rumoured not long ago that Windows 8 will have an app store, now Mac has gone and confirmed Lion will have an app store, so rumour or not, I think you can expect one from MS also.

It's sort of a repository I guess?

[safeguy]

@moonblood

In this case, I'm on your side. Both of us are on the same boat. We have the same stand/views over this matter. I wasn't questioning your statement but rather backing it up (in agreement/support of what you said) with my similar views.;)

My question of double standards was not targeted towards you...it was targeted towards the author (Luis Corrons) of the post "Microsoft just doesn’t get it… Security is about diversity (http://pandalabs.pandasecurity.com/microsoft-just-doesn%E2%80%99t-get-it%E2%80%A6-security-is-about-diversity/)".;) I have made a similar comment there (http://pandalabs.pandasecurity.com/microsoft-just-doesn%e2%80%99t-get-it%e2%80%a6-security-is-about-diversity/comment-page-1/#comment-12726) if you hadn't noticed...

-{ Quote: "Monocultures are a hacker’s paradise." }-

Just to add spice to the discussion, I'll like to link to this in regards to "monoculture"...

The Monoculture Hype (http://www.ranum.com/security/computer_security/editorials/monoculture-hype/index.html)

@funkydude

As for the repository idea, I don't think MS would consider it practical for them to implement it on their side seeing the huge software library that's up on the web right now. At least not in the near future I guess. However, even if they manage to bring it on, we would have to expect certain groups of people that won't be pleased with such a movement as in their eyes, it's another attempt by MS to gain further hold of 'monopolism'.

But that's not really much of a deal seeing that Windows users still can make use of 3rd-party mirror sites like CNET, Softpedia, FileHippo, MajorGeeks, etc Admittedly, they aren't perfect and there have been cases of malicious downloads/files observed but at least, they're better than nothing.

[m00nbl00d]

-Edit-

I forgot one thing. What does Luis Corrons mean with -{ Quote: "Microsoft should continue giving their AV for free. The point is that they should make *all AVs* available for free via WU, not only theirs. By doing so it will benefit consumers as they will have more options to choose from." }-

I'm giving emphasis to *all AVs*. Does he mean all AVs, including trial crap versions ??? Or, just the free AVs ??? Then again, I guess those who have no free versions would start complaining... Right ???

What about free anti-spyware/antimalware apps, like Malwarebytes Antimalware, SUPERAntispyware, SpywareBlaster, Spybot - Search & Destroy, Lavasoft Ad-aware, etc ???

Oh, I see... MSE isn't just an antispyware. I guess that's why no one (that I'm aware of) ever made a fuss about Microsoft providing for free, and as an installed product, Windows Defender. Maybe they haven't seen it as a threat to their business, but now they see MSE as one, and are perhaps right ???

[m00nbl00d]

-{ Quote: "@moonblood

In this case, I'm on your side. Both of us are on the same boat. We have the same stand/views over this matter. I wasn't questioning your statement but rather backing it up (in agreement/support of what you said) with my similar views.;)

My question of double standards was not targeted towards you...it was targeted towards the author (Luis Corrons) of the post "Microsoft just doesn’t get it… Security is about diversity (http://pandalabs.pandasecurity.com/microsoft-just-doesn%E2%80%99t-get-it%E2%80%A6-security-is-about-diversity/)".;) I have made a similar comment there (http://pandalabs.pandasecurity.com/microsoft-just-doesn%e2%80%99t-get-it%e2%80%a6-security-is-about-diversity/comment-page-1/#comment-12726) if you hadn't noticed...



Just to add spice to the discussion, I'll like to link to this in regards to "monoculture"...

The Monoculture Hype (http://www.ranum.com/security/computer_security/editorials/monoculture-hype/index.html)
[...]

" }-

Yes, I'm aware of that, though it was a bit confusing at first, I must say. :)

[m00nbl00d]

-{ Quote: "Hi m00nbl00d,

Many thanks, would love the results of your testing.



Very true that Sandboxie should be the first one to be installed. However, if too many low level drivers are installed, Sandboxie would again stop working.

Happened to me once!" }-

Just a reminder I haven't forgotten about this. I made a mess with my virtual machine snapshots, and I'm reinstalling everything I had back, then I will make a new snapshot and try it out.

Tomorrow by this hour or so, I'll report it. :)

[m00nbl00d]

-{ Quote: "Hi m00nbl00d,

Please see my above post to Hugger. And, thanks for testing it in a virtual environment. I don't know how much Windows 7 Ultimate 32-bit, differs from the 64-bit.

But since we are in testing mood, can you install on top of MSE and Sandboxie the following programs and see what happens.

1. Avast Antivirus PRO
2. Outpost Firewall PRO
3. SpyShelter Premium.

Kindly lets us know the results. Also, while at it after rebooting try to update Avast Antivirus PRO.

Many thanks,

KOR!" }-

OK.

This is what I came up with, but first allow me to say that, unfortunately due to limitation of monthly traffic I haven't downloaded SpyShelter Premium nor avast! Antivirus Pro, otherwise my Internet connection speed would decrease a lot. lol

I already had COMODO Firewall (I couldn't find where I had saved Outpost executable when I downloaded it when the latest version came out :() and avast! Antivirus Free edition (result would end up being the same, because what would really matter is the low-level driver installatiom).

So, instead of SpyShelter, I installed AVG AV 2011 Free which I already had downloaded to other testing.

This is what I did:

I installed AVG AV 2011 Free first - I forgot to install Sandboxie first - otherwise it wouldn't install above avast!. Then, I installed avast! and Microsoft Security Essentials v2 beta. All latest versions.

I installed Sandboxie. Loaded fine. So far, including Sandboxie, we can count 4 low-level drivers.

I installed COMODO Firewall and rebooted the system. Sandboxie loads fine.

So, we have 5 low-level drivers. Sandboxie runs properly.

Updating seems not to be an issue, for what I could see.

I'll see if I can find where Outpost installer is later on, and try with it. I do remember issues between these two, though, which would result in Sandboxie's driver not load. But, this happened in the past and I believe was solved.

[AlexC]

Think that they are protecting their SO, and the benefit is for the final user :thumb:

Anyway the update is optional.