Windows Defender just saved me

I was getting ready to install a program when a warning message pops up and tells me a trojan downloader has been identified. It asks me if I want to remove it, I click yes, it does it's thing. Whew, dodged one there.

I had Vista for about 3 years, not one time did I ever get a warning from Defender......I've had 7 for exactly one week and already it's actually defending my machine from something. It's nice when things work like they're supposed to.

rkf76 said:

I was getting ready to install a program when a warning message pops up and tells me a trojan downloader has been identified. It asks me if I want to remove it, I click yes, it does it's thing. Whew, dodged one there.

I had Vista for about 3 years, not one time did I ever get a warning from Defender......I've had 7 for exactly one week and already it's actually defending my machine from something. It's nice when things work like they're supposed to.

Click to expand...

RKF


If you like defender you will love Microsoft Security Essential. It uses the same engine as defender is free and does a boat load more things than defender.



Ken J

zigzag3143 said:

rkf76 said:

I was getting ready to install a program when a warning message pops up and tells me a trojan downloader has been identified. It asks me if I want to remove it, I click yes, it does it's thing. Whew, dodged one there.

I had Vista for about 3 years, not one time did I ever get a warning from Defender......I've had 7 for exactly one week and already it's actually defending my machine from something. It's nice when things work like they're supposed to.

Click to expand...

RKF

If you like defender you will love Microsoft Security Essential. It uses the same engine as defender is free and does a boat load more things than defender.

Ken J

Click to expand...

I don't know much about it to know if I like it or not but I know it just saved me a while ago so I definitely like that! Thanks for the heads up on Security Essential....I just d/l all the current versions of Windows Live programs the other day but that one isn't one of them. Is it a beta program? Think I'd be good to d/l and use it?

No, Security Essentials is Microsofts Anti-Virus. Not to be confused with Live Essentials. They are different.

It also works well with Windows Firewall & Defender. Highly recommended by many around this forum as well.




http://www.microsoft.com/security_essentials/

It's actully called Microsoft Security Essentials, not windows

Windows Security Essentials..sounds like a rogue AV, lol.

Nem said:

Windows Security Essentials..sounds like a rogue AV, lol.

Click to expand...

There is one rouge named "Security Essentials"

I think that this is why it is important as members to post the appropriate safe download link as Wishmaster has done.

Windows Defender is now practically the same thing as MSE, although Microsoft might not want you to know that.

Two things are different - it doesn't report itself as an antivirus solution (the formal reason might be its bundling with Windows I guess, if it formalized itself as such, the AV vendors wouls start frantically phoning their law firms).
The other thing is it updates, by default, a bit more rarely.
Another possible difference might be that MSE can analyze code, while WinDef can't do that, but that's conjecture.

Now for the smoking gun for my thesis:


So - same malware engine. Reads containers, even rars. Zaps on sight. Zaps trojans.

riala said:

Windows Security Essentials is class!

A lot better than any free Anti-virus on the market, and the best thing is it's FREE and you cant go wrong with Microsoft updates. It's found all my Trojans that I keep for tests that a lot of other Anti-virus software could not find. I use Windows Security Essentials along with Norman Malware Cleaner stand alone .exe, it does not install on your system and is very good at its job.
The only downside to WSE is that it uses a lot of memory, about 80MB but I did not really see and degrade in system performance like other Anti-virus software.

I recommend WSE all the way.

Click to expand...

This in itself is a matter of personal opinion. I just don't see how anyone can say with certainly that my "insert product name" is the best. There are way too many variables to come to that conclusion. What works for you may not work for me for various reasons. With that being said I think it is best to give the user the different options and let them decide what's best for them.

Yes MSE is a good choice but saying with certainly that it is the best is a reach.

Thanks guys, I went ahead and downloaded MSE and did a scan and found no issues. It doesn't seem to slow my machine either like other AV have in the past, so far so good!

Great to hear it is working out for ya!

Jacee said:

It's actully called Microsoft Security Essentials, not windows

Click to expand...

I was curious about my interpretation of Teerex' post and contacted "PA Bear" to confirm what I was thinking and provided a link to this thread. Interestingly, he told me that there are some areas where the Microsoft pages either call or translate it to "Windows Security Essentials". He also pointed out that in the 2.0 Beta, it is referred to as "Security Essentials", without either Windows or Microsoft.

Sure enough, even though the Beta GUI shows "Microsoft Security Essentials" at the top, when looking at the about window, it refers to "Security Essentials Version" not "Microsoft Security Essentials Version" as in Version 1.

Teerex said:

Windows Defender is now practically the same thing as MSE, although Microsoft might not want you to know that.

Two things are different - it doesn't report itself as an antivirus solution (the formal reason might be its bundling with Windows I guess, if it formalized itself as such, the AV vendors wouls start frantically phoning their law firms).
The other thing is it updates, by default, a bit more rarely.
Another possible difference might be that MSE can analyze code, while WinDef can't do that, but that's conjecture.

Now for the smoking gun for my thesis:
View attachment 94478

So - same malware engine. Reads containers, even rars. Zaps on sight. Zaps trojans.

Click to expand...

Hi, Teerex.

I started to reply to your post earlier and, as I indicated to Jacee, wanted to confirm my understanding first.

First, if you go to the Malware Protection Center at https://www.microsoft.com/security/portal/Definitions/ADL.aspx and compare the change logs between the "antimalware" for MSE and the "antispyware" for Windows Defender you will see a drastic difference between the two.

Second, it is as I suspected, that Windows Defender detected the .rar as a PUP (potentially unwanted program), indicating that the keygen.exe is a trojan downloader.

My advice to you is to stick to legal downloads from the vendor sites. Your screen copy is another example of the dangers of using P2P programs. With P2P file sharing, what means do you have of identifying or authenticating the source of the download? In addition, a file can be distributed among many hosts, and peers will provide for download the sections that they have already downloaded. This results, as in your case, with a distribution in which malicious bits are mixed with with good files.

A couple of interesting articles:

• http://www.microsoft.com/protect/data/downloadfileshare/filesharing.aspx
• http://blogs.technet.com/mmpc/archive/2008/10/06/the-cost-of-free-software.aspx

Third, as described at Frequently asked questions about malicious software | Microsoft Security Essentials, Windows Defender does not have an anti-virus component:

What's the difference between Microsoft Security Essentials and Windows Defender? Microsoft Security Essentials is antimalware software, which means that it's designed to detect and help protect your computer against a wide range of malicious software, including viruses, spyware, and other potentially unwanted software. Windows Defender, which is automatically installed with your Windows operating system, is software that detects and stops spyware. To learn more about Windows Defender, visit the Windows Defender Web site.

Click to expand...

rkf76 said:

Thanks guys, I went ahead and downloaded MSE and did a scan and found no issues. It doesn't seem to slow my machine either like other AV have in the past, so far so good!

Click to expand...

Returning the thread to you, rkf76. I'm glad to know you are happy with MSE.

Corrine said:

Hi, Teerex.

I started to reply to your post earlier and, as I indicated to Jacee, wanted to confirm my understanding first.

First, if you go to the Malware Protection Center at https://www.microsoft.com/security/portal/Definitions/ADL.aspx and compare the change logs between the "antimalware" for MSE and the "antispyware" for Windows Defender you will see a drastic difference between the two.

Second, it is as I suspected, that Windows Defender detected the .rar as a PUP (potentially unwanted program), indicating that the keygen.exe is a trojan downloader.

My advice to you is to stick to legal downloads from the vendor sites. Your screen copy is another example of the dangers of using P2P programs. With P2P file sharing, what means do you have of identifying or authenticating the source of the download? In addition, a file can be distributed among many hosts, and peers will provide for download the sections that they have already downloaded. This results, as in your case, with a distribution in which malicious bits are mixed with with good files.

Click to expand...

Hi Corrine, yes I saw the difference, I was just making the point that Windows Defender is in the business of removing malware which is not strictly 'spyware'. It obviously is a poorer cousin of MSE, but still - a cousin. I use it as a valuable second opinion to NIS 2010/2011, where it has proven its worth many times.

As per the malware in question, I was intentionally hunting malware p peeps, I set a bad example, don't follow it) This trojan downloader did not arrive by p2p, nor was I looking for illegal downloads, unless if looking for malware is looking for illegal downloads (you might have a point there actually ). This trojan came from a site based in Russia. Each 'keygen.exe' offered there was a malware dropper. I reported the site to Norton and Microsoft. First detection was a SONAR (behavioral) detection by Norton on first sight, 8 hours later both NIS and Windows Defender had signature based detection.

This time around, Defender caught the file as soon as the download finished, thereby upstaging poor NIS 2011 by a fraction of a second and I showed you the result of that.

What? Defender actually found something? This is breaking news :shock:

Thanks for the update, Teerex. I'm relieved to know you weren't looking for a "free" license.

If you look at the link I provided, you will see that the difference in definitions between the two programs is quite astounding though.

DarkEnergy said:

What? Defender actually found something? This is breaking news :shock:

Click to expand...

Oh, back in the days there was a time when Defender did a better job than Symantec, in some cases.





Thank God, since then Symantec has really improved with behavioral detection, overall detection and simply blocking bad stuff from even showing up in your browser, or downloading.

MSE verses Norton

I recently upgraded my computer from Vista to Windows 7. I have a 32-bit x86 and while with Vista,had problems with IE8. So I switched to Firefox and right now I am searching if buying the Norton,when my subscription runs out,or tried MSE.Is anyone out there can help me decide by experiece,if you had with the two programs?