Think Windows's Built-In Antivirus Will Keep You Safe? You're Wrong

[Petrovic]

It's true that Windows 8 and 8.1 come with antivirus protection built in, but you can't rely on it to protect you against malware attack. Results from independent labs and our own hands-on tests show that you really need a third-party antivirus utility.

Microsoft has dabbled in the antivirus business for longer than you might imagine. Back in 1993, MS-DOS 6 included an antivirus licensed from Central Point. That antivirus was later acquired by Symantec and integrated into the Norton Securityproduct line. Over the years we've seen Microsoft Anti-Virus for Windows, Microsoft Security Essentials, and Microsoft Windows Defender. Unfortunately, Microsoft's free antivirus tools will not protect your computer from modern malware.

It's important to distinguish the version of Windows Defender found in Windows 8 and 8.1 from the same-named component in Windows 7 and Vista. Before Windows 8, Defender only promised protection against spyware. You needed Security Essentials for full-scale antivirus protection. The modern Windows Defender offers the same protection as Microsoft Security Essentials; in fact, you can't even install MSE on Windows 8.

Full Article

I agree

 

[BoraMurdar]

Neil, who wrote this nonsense, is famous for praying Norton (Symantec is probably paying him to write this crap also), that he even needed to mention Norton in this "review" of Windows Defender. Not saying Norton is bad, it's pretty solid.
It's a shame that this guy, who is an expert, needs to write this bul****

If you are careless, no AV can protect you. Period

 

[Petrovic]

Neil, who wrote this nonsense, is famous for praying Norton (Symantec is probably paying him to write this crap also), that he even needed to mention Norton in this "review" of Windows Defender. Not saying Norton is bad, it's pretty solid.

& other editor choice - Mcafee, Webroot, Bitdefender? - crap? Defender - solid?

 

[BoraMurdar]

& other editor choice - Mcafee, Webroot, Bitdefender? - crap? Defender - solid?

Sorry?

 

[Jimmy HendriX]

concuerdo with Petrovic, windows defender or microsoft security essentials does not serve to protect the computer against unknown malware.

 

[Alexstrasza]

Microsoft Security Essentials/Windows Defender is commonly used as the basis for all other AVs testing. It only provides the barest minimum of protection.

However, if you do not follow safe surfing then no security solutions in the world will save you from infections.

 

[Ink]

Just scanned with Malwarebytes Anti-Malware and found 2264 threats. Moral of the story: Do not use Windows Defender.

Article by PCMag is garbage. Here is proof:

The modern Windows Defender offers the same protection as Microsoft Security Essentials; in fact, you can't even install MSE on Windows 8

Yes, because it's already integrated. Whoever wrote this is an idiot.

 

[nsm0220]

Microsoft needs to add zero day protection on MSE otherwise its useless as one av i don't like

 

[BoraMurdar]

Microsoft needs to add zero day protection on MSE otherwise its useless as one av i don't like

Why?

Spoiler: Surprise

UAC? Windows Smart Screen?

 

[Deleted member 21043]

The fact that Norton was mentioned at all in this article does raise suspicions about the writer trying to "promote" the product. The article should have been about Microsoft and their security products, not including Norton.

Why?

Spoiler: Surprise

UAC? Windows Smart Screen?

I agree with BoraMurdar - UAC and Windows Smart Screen are there for "zero-day protection". They do work, and as long as the user doesn't aimlessly execute anything they find online it should work well.

Cheers.

 

[Ink]

No comment.

Maybe you didn't understand.

Zero malware infections with Windows Defender since I first used Microsoft Security Essentials v1.

 

[Deleted member 21043]

Microsoft could easily make an Antivirus product which kicked every other Antivirus and Antimalware product out the market instantly. I've said it before, and I'll say it again... They own Windows. They could setup some hidden functions in the Windows API to do all sorts and just make sure no one else finds out about them. They could setup a behavioural blocking protection component which loaded kernel mode drivers (they would be running under SYSTEM. Windows services also run under SYSTEM however they are not as secure as a driver, they could be easily stopped by malware).

In this kernel mode drivers, they could do all sorts. Such as hooking all Nt* functions. Hooking NtLoadDriver (when another driver is loading), NtDeleteValueKey (when a registry value is being deleted - this could be used as some sort of protection feature in HIPS, so the user can be alerted when a process is trying to delete a value), NtOpenProcess (they could use this to prevent access to certain processes), NtTerminateProcess (commonly used API to try to terminate a process on the system),...

Did you know, most Antivirus software already hook these. For example, I am sure they would hook NtTerminateProcess for example.

In the driver, they then:

return STATUS_ACCESS_DENIED;

Ever tried to terminate a process in Task Manager and had a alert saying "Access denied"? It means you've been: STATUS_ACCESS_DENIED ... Well at least now you know why you get this.

They can also do other things such as a "Application Control". This could involve support for allowing a program to execute without access to terminate a process, without internet access, without read/write access and the ability to have a log made if wanted of all the attempts it makes.

For example, a keylogger may use GetAsyncKeyState (API). Hooking this can help detect a keylogger in real-time with their behavioural protection.

Digital Signatures was a great idea, but it has a few flaws. Anyone can purchase one, and now it's used a lot in Adware. There should be some new identification like Digital Signatues, but with a slight change - the people wanting a signature have to have their application checked for any malicious components, and any "suspicious" actions, such as installing additional software without user rights. Malware writers already figured out how to "steal" them now, too.

In fact, I recon Microsoft could do everything I mentioned here in a AV product in less than a day or two. Like I said, they own Windows, they surely know more about how it works then the others...

As far as heuristic analysis goes... Microsoft surely know what is good and bad code. They could make great heuristics and have them adapted for new zero-day threats.

Although, I do see some reasons as to why they wouldn't hook functions to try to find malicious behaviour... Users may not always like it and it may cause false positives. As well as this, I can't even think to imagine what the other vendors would be feeling if they were kicked out of the AV industry just like that with no chance of competition.

UAC is a very importat feature in Windows. Without Admin priveleges, you won't be doing anything like loading drivers into kernel mode. Why do you think Antivirus installers need UAC at one point or another? It's so they can do things like load kernel mode drivers. They may also do things like create scheduled tasks to allow them to run without Administrative rights (the user-mode processes). So keeping it enabled is a WISE decsion.

Did you know, Microsoft already made protection against rogue drivers. There is a feature on 64-bit systems called PatchGuard. It works by denying access to load a driver without it being digitally signed. However, it can actually be disabled with some tweaking by malware writers... But, it does help. Unless you were a programmer wanting to make kernel mode drivers, I doubt you'd have known about PatchGuard.

Spoiler: Want to see some C code?

PatchGuard disables the ability for SSDT hooking. SSDT stands for System Service Descriptor Table.

typedef struct SystemServiceDescriptorTable {
PULONG ServiceTableBase;
PULONG ServiceCounterTableBase;
ULONG NumberOfServices;
PUCHAR ParamTableBase;
}SSDT,*PSSDT;

There is so much I could go into detail about and explain. Point being, Microsoft could make Windows Defender/MSE great if they wanted too, far from what it is now. UAC, SmartScreen, PathGuard... They are all there to protect the user, and they work, to an extent.

For experts who really know what they are doing, it's enough. For people who are click happy and don't know what they are doing need to run and try to hide if they want to use Windows Defender/MSE because it won't be enough.

Cheers.

 

[MrXidus]

I dumped 3rd party antivirus software back when I made the move to Windows 8 when it released.

Since then I have been using Windows Defender and have been infection free for 5 years in total (3 years under Windows Defender.)

The best protection is what lies between the screen and the keyboard, safe web practices, being self aware and on alert to what you let onto your PC and run has kept me virus/malware free all these years, not any standalone antivirus application, just myself.

Keep UAC enabled, ensure Windows & other applications up to date, check files against VirusTotal & Anubis, Click-to-play Flash etc.
Download installers from sites such as Softpedia, FIleHippo, Majorgeeks to avoid adware wrapped installers like CNET uses, always be sure to uncheck the optional offer boxes when installing an application, Unchecky can even do that for you though I do it manually to be sure. Adblockers also serve as a security measure against hijacked/rogue ads.

There's more one can do but I won't get into all that, you've got MalwareTips at your fingertips and plenty of threads for information.

Though I of course have precautions as not even the most security aware user is perfectly safe since there are constantly new exploits & holes being discovered and always new malware and threats in the wild and not just the ones white hats or grey hats reveal.

Safe browsing habits can only go so far and there's always a risk of something slipping through.

- VTHash
(A simple right click and quick look at VirusTotal results, handy and easy but limited in file size, good enough for smaller files)

- Fortnightly scheduled scans with Malwarebytes & Hitman Pro.
(A second opinion always helps, though neither of these have found a threat in years)

- Backup & System Images: 2x 3TB EXHDD in RAID 1 for all my files and media of importance for safe keeping.
(With the rising threats of ransomware and crypto-based threats this is essential and does good for peace of mind)

(Free software such as TinyWall and Windows Firewall Control for much better use out of Windows Firewall)

Will Windows Defender protect a reckless user or average joe who downloads/runs potentially unsafe/dangerous executables or does unsafe web practices, doesn't keep their applications up to date, does warez, rushes through installs and never unchecks optional offers boxes, clicks and visits hazardous websites, short weak passwords, outdated flash/java and more, getting phished etc?

Likely no, depending if MSE/WD have a signature and catches the threat /assuming the user doesn't click allow and skip on the UAC/SmartScreen prompt but that's just for executables.

For experts who really know what they are doing, it's enough. For people who are click happy and don't know what they are doing need to run and try to hide if they want to use Windows Defender/MSE because it won't be enough.

I agree and in the end it's down to the user educating themselves on safe practices, should be second nature not to run an unknown file without first making sure it's safe.

I've cleaned numerous PCs over the years all with different security software such as Norton, Kaspersky, ESET, BitDefender, Avast Free, McAfee and others and still the user managed to infect themselves and complained why their PC is performing slow thinking that their AV was meant to provide 100%.

In my opinion:

It will always be down to the user to safe guard his or her PC from threats and not just think their antivirus will do all the work.

No antivirus can provide 100% protection to a user that is both reckless or dangerous in what they browse and download/run.

"Microsoft said users should use third-party applications, as it will never be the best option. In an interview, the company admits it has turned its AV app into a "baseline program," and that the app will "always be on the bottom" of the AV software rankings, where it has languished in the last two years after a few years on top.

Microsoft also adds that "the company is just sharing its virus tracking findings (Malware Protection Center) with the security industry so they can develop better antivirus programs."

If I were to switch to 3rd party I'd personally pick Emsisoft, the most attracting part for me being it's very minimal data sharing.

But since I've managed to stay 5 years infection free I have no need for 3rd party even though I agree they're often better than WD.

Everyday criminals look for anyway and new ways possible to exploit money digitally and it's only going to get more sophisticated.
Takes more than just an antivirus application to guard against that, one should instead focus on covering every angle.

Thanks.

 

[software182]

Very nice article !

 

[jamescv7]

I'm using Windows Defender on 8.1 and not surprise on same line from many articles.

We all know its a baseline protection only but it doesn't mean 50% only? Not really, in a compiled user reviews from YT and others then WD can manage to block even most zero day malware; but what's the problem? Microsoft focus on traditional signatures but varies on response time and not totally focus much unlike other fully AV companies where combine other components (HIPS or BB) to blend protection.

Yes it does poor on the test but in real life, common sense and awareness will save you; Basic prevalence of malware like in autorun based attacks can really prevent by WD but playing with zero day malware then expect it.

But why we need AV again? So that upon our mistakes there will be an automatic flag operation on doing our silly mistakes; We can test AV properly on a isolated environment but not on production system if mistakes do happen.

However SmartScreen integrated/IE browser does really good and accurate from detecting threats which users considered to use.

 

[FreddyFreeloader]

Only reason I quit using MSE is having to manually update it to have the most recent signatures. Otherwise, it works just fine for normal, non-click happy users who don't download every attachment in their spam folder.

 

[Petrovic]

Traditional signature-based antivirus technology is rapidly heading toward obsolescence.
But even the fastest and most comprehensive signature matching will not catch zero-day
and targeted attacks for which no signatures exist.

 

[BoraMurdar]

MalwareTips...
Not WhichIsBetterAntiVirusTips

We exist to help inexperienced members in order to protect themselves in digital world. MalwareTips is to teach users not to execute everything they see, to keep UAC and Smart Screen enabled, to keep Windows and Apps updated, to keep their Browser up to date, to keep their AV updated, to avoid warez, to watch carefully for checkboxes when installing programs to be adware free, to disable autorun, to backup important data, have an adblocker, etc.

The real problem would be if you want to visit some webpage you visit everyday, strange new page opens,your up to date browser doesn't warn you, it drops malware which is automatically executed, bypassing UAC, Smart Screen, and really damage your computer, stole your data etc.
Probability? Really Small
Probability that it will happen to you? Even Smaller

You probably and mostly will not catch a zero day malware except if you are searching for one!

Members needs to know and remember, you have that

Spoiler: power

to protect yourself, you are to one with brains, not the AV. AVs cannot think, they do what they are coded to.

 

[hjlbx]

Very unfortunately, typical user thinks they can install "top-rated" anti-virus and that's it... that they are absolutely protected - no matter what they do with their system.

Extremely unrealistic expectations, improper use of security software, and a bunch of bad habits - mainly out of ignorance - lead to infections and bitter disappointment.

It's plain to see on every single security and anti-virus vendor forum:

"I installed AV - xyz Super Duper... paid good money too! The salesperson told me its reported as the best by PCMag!

My PC is running at a crawl, there are constant pop-ups, I can't get anything done. My PC is acting really weird - strange messages, peculiar windows, odd app behaviors, random high hard disk activity and network is bezerk. Now I notice the firewall has been disabled - and I'm not sure for how long.

Can I get some help here?"

That's the reality of the typical user.

* * * * *

Disciplined, good (educated) computing habits can prevent 99.9 % of all infections for the typical home user... even with a "minimalist" security set-up.

 

[Semprul]

Windows Defender + Malwarebytes + Brain = enough for my protection