Windows Vista and protection from malware

ronjor · Dec 20, 2006

On November 30, Sophos issued its monthly report on the top ten threats reported to them in November of 2006. As a part of this, Sophos also studied Windows Vista's vulnerability to these malware threats. I found the information and press discussion confusing, so I thought I would clarify what this really means for customers.
Click to expand...

Jim Allchin

lucas1985 · Dec 20, 2006

Interesting quotes:

If you are using Microsoft Outlook or a third-party email client that blocks execution of known executable formats, then a user running Windows Vista is not vulnerable to eight of the ten malware threats. In the case of the ninth piece of malware, Bagle-Zip, the malware is able to run because it uses the .ZIP file format which some mail programs do not block. In the case of the tenth piece of malware, Mydoom-O, the malware is sometimes able to run because it randomly chooses the file type to which to distribute its payload and sometimes that file type is an executable inside a .ZIP file, which some mail programs do not block. In both cases, this is a function of the e-mail software, not Windows Vista. That said, even when a user receives a mail infected with Bagle-Zip or Mydoom-O in the .ZIP file format, in order for the malware to affect the system, the user must first explicitly open the .ZIP file and then explicitly run the executable file that's contained inside the .ZIP file -- there is no way for this to happen without two steps of user action. If you happen run a third-party email client that does not block known executable formats, then you may also be vulnerable to Netsky-D.

While Windows Mail blocks running executables even when they are included in a .ZIP file, other email clients could as well if they used a technology available (via APIs) in Windows called Attachment Manager (AM),first introduced in Windows XP Service Pack 2. So what should you do if you use a mail client that doesn’t support AM? Well, the most basic thing to do is to train users in your environment not to click on unknown attachments and, even if they do, to make sure that they don’t run executable files included in ZIP files. This may be hard to do -- and frankly, this is why we built AM protection into Windows. That said, if you use an add-on e-mail client, you should also use anti-virus software that can scan attachments prior to opening them to detect and block malware.
Click to expand...

If you use an add-on email client and you know not to run executables embedded in email attachments, then you will also be safe from these specific threats. And with all that said, if you are like most users and receive e-mail from unknown people, are not really sure even what executables or ZIP files are, run a lot of software and browse the web downloading programs with abandon, then our best advice remains the same: You should 1) stay current with the latest security updates (and in this case I urge you to use the recommended defaults included in Windows Vista); 2) use a firewall (there's a great two-way firewall built into Windows Vista! Or, use a third-party solution that you can buy); and 3) use anti-malware software. I recommend using the combination of Windows Defender and an add-on anti-virus software program such as Windows Live OneCare or one of the many great products available from third parties, such as Sophos.
Click to expand...

So, in these scenarios Vista isn´t more secure than XP. You need hardening and common sense in both OSes.

Log in or Sign up

Windows Vista and protection from malware

ronjor Global Moderator

lucas1985 Retired Moderator

Log in or Sign up

Windows Vista and protection from malware

ronjor Global Moderator

lucas1985 Retired Moderator

Useful Searches