Microsoft Security Essentials - new Beta out 2011-11-30 (updated 2012-07-11)

[IainB]

Just installed it:

From the "About" drop-down:

© 2012 Microsoft. All rights reserved.
System information:
[Security Essentials Version: 4.0.1111.0
Antimalware Client Version: 4.0.1111.0
Engine Version: 1.1.7801.0
Antivirus definition: 1.115.2818.0
Antispyware definition: 1.115.2818.0
Network Inspection System Engine Version: 2.0.7707.0
Network Inspection System Definition Version: 10.7.0.0

EDIT 2011-11-30 1526hrs (NZT):

I should probably mention that I am also using Malwarebyles" Anli Malware 1.51.2.1300, because I discovered in December 2010 that some annoyware/malware can apparently get past MSE. This was on a friend's laptop on which I had installed MSE. He had clicked on a link in some spam email and it hijacked his laptop - switched off MSE and then stayed dominant/resident, even after boot, insisting you pay via credit card for a "security scan". You couldn't do anything with the laptop - it was effectively locked-up.
The only way I could get rid of it was by taking the hard drive out and running Malwarebytes over it as a USB drive. MSE was broken though, and I had to uninstall and then reinstall it before I could get his system back to normal. I also installed the pro (paid) version of MWB, as that does real-time scanning, and even catches bad/suspicious URLs when you are browsing (if you enable that feature).

EDIT 2012-07-11 2251hrs (NZT):
Following a large Windows Update today, it looks as though MSE now includes the OpenCandy adware as "malware" in its virus definition files.
Version details:



See also post below - here.

[cyberdiva]

Hmmm...I'm not surprised that the antimalware client version in the beta is 4, since mine is 3, but my security essentials version is 2 (more specifically 2.1.1116.0).  So why did it jump to 4 in the beta?  Did I miss something major?

As for your friend's experience, I used to read the Malwarebytes Forum reasonably often, and I found that most highly regarded AV programs let stuff through from time to time.  That's one reason Malwarebytes is so popular and highly regarded.  It fills a need regardless of what AV program you have.

[IainB]

The v4 in both cases came with the ß install I guess. It ran as an update from Microsoft.

Yes, I read similar good stuff about MWB, which is largely the reason why I ended up using it. It seems to be very good at what it does.
Belts and braces, I know, but then my training encouraged me to be a bit paranoid about system maintenance, backup and protection - and I have learned from others' bad experiences not to take risks.

[tomos]

He had clicked on a link in some spam email and it hijacked his laptop

-IainB (November 29, 2011, 07:56 PM)

I found that most highly regarded AV programs let stuff through from time to time.

-cyberdiva (November 29, 2011, 11:12 PM)

similar experience here last year with a link (from a google search) and with a very reputable AV. Maybe I should look into Malwarebytes - I presume from what you say Iain that they work well together? (MSE & MWB)

[cyberdiva]

similar experience here last year with a link (from a google search) and with a very reputable AV. Maybe I should look into Malwarebytes - I presume from what you say Iain that they work well together? (MSE & MWB)

-tomos (November 30, 2011, 02:33 AM)

I'm not Iain (I don't even play him on TV) but I've used MSE and MWB together on two computers for quite a while, and they play very well together.  MWB says explicitly that it is intended to be used with an AV program--it supplements that program, it doesn't replace it.  Often one has to list the programs in each other's exclusions area, but sometimes even that isn't needed. 

[tomos]

thanks cyberdiva

[IainB]

Maybe I should look into Malwarebytes - I presume from what you say Iain that they work well together? (MSE & MWB)

-tomos (November 30, 2011, 02:33 AM)

Yes, they seem to work fine together - and without duplication so far. For example, I was helping to restore someone's user directory the other day and had to employ the use of  a password hacking tool to finish the job. MWB made no objection at all, but MSE logged it and reported it as a Hacktool of "Medium" Alert Level and asked me what I wanted to do about it (I opted for ignore).

There's a thought: I hope the new ß does not forcefully override user control in such circumstances.

[IainB]

Just an update on the ß trial: Absolutely no problems. Uneventful and trouble-free.
As for the previous version - no apparent hogging of CPU - seems to go to background processing if the CPU(s) has(have) other work going on.
I was reminded to update this thread after answering the 2nd ß trial survey I have had from M/soft.

[Carol Haynes]

Further info on what has changed at: http://www.zdnet.com...select-testers/11289

Personally I don't like the idea of automatic cleanup without user interaction but I suppose it is good for people who don't know what to do or are likely not to bother to take action.

I have a number of programs on my system that are picked up as suspect because they allow password detection etc. but I know they are safe and I don't want my AV deleting without any warning or notification. Avast used to do that and it was extremely irritating going through quarantine and marking files/folders to ignore in future. I'm not sure that MSE even has the possibility of ignoring files/folders that you know are safe. It also bothers me that false positives could occur without any sort of notification and be really difficult to track down.

[IainB]

See also EDIT 2012-07-11 to Opening Post.

Just a note to say that when I installed the file for ATI Tray Tools (file: attsetup-[Guru3D.com].exe), it installed with no problems. Because I have Windows 7 Firewall Control, I guess I didn't notice that the install file had OpenCandy - which didn't install.
I just discovered today that the file has OpenCandy in it. This is because MSE (Microsoft Security Essentials) just today announced that the file was infected, during a regular scan. I downloaded the file again from Guru3D.com to check, and MSE immediately quarantined it. It didn't quarantine the file the first time I downloaded it (though it was the same version of ATI Tray Tools).

[ Invalid Attachment ]

Anyway, I "allowed the file", so it was released from quarantine.

Microsoft had a humungous Windows Update today, including MSE/virus file updates, so I guess it included a definition file that checks OpenCandy adware as malware.
Good thing too.

-IainB (July 11, 2012, 05:35 AM)