This just in.....Paul Thurrot and Leo LaPorte are idiots. Cliff Evans, Microsoft UK's security chief, has stated that MSE does indeed have heuristic detection abilities. However, the way I read the article, all things are not rosy as Microsoft has implemented a procedure where MSE will study the behavior of suspicious programs, but it has to contact Microsoft's servers to check against known malware signatures. This, in my mind, seems like a design flaw as laptop users are obtaining new files all the time & they are not always in a position where they have access to the internet.
First the quote from Cliff Evans:
"MSE uses a higher amount of heuristic detection techniques than OneCare, Evans said. The software studies the behaviour of suspicious applications, then reports back to a central server to check the behaviour against that of known malware.
The Dynamic Signature Service technology uses the most recent virus definitions to check applications for risks, rather than relying on the last batch of definitions downloaded, Microsoft said.
The suite also emulates programs before they complete their execution, and looks for behaviour such as carrying out operations without user permission, Owen said. If a program is behaving suspiciously, MSE will ping the Dynamic Signature Service to see whether the program should be submitted for analysis or terminated."
And the article link:
http://news.zdnet.co...0189,39778759,00.htmIt's unknown if MSE will fall back to the current definitions downloaded to analyze if the Dynamic Signature Service server is unavailable. Personally, I'm wondering why if MSE is checking the server for "the most recent virus definitions...rather than relying on the last batch of definitions downloaded" why it doesn't just download the most recent virus definitions, do the analysis locally, and be done with it.