Microsoft Security Essentials rated best free antivirus for Windows

[JonM33]

Slightly old news but still worth noting...

Microsoft Security Essentials rated best free antivirus for Windows

In AV Comparative's most recent report on malware removal, MSE was the only free antivirus rated Advanced+. That ranking placed it alongside big names like Norton, Kaspersky, and F-Secure. Security Essentials also beat out technician favorite ESET, which managed only an Advanced rating.

It's also worth noting that only three antivirus apps - Norton 2010, eScan, and Security Essentials - scored marks of good or better in removal of malware and removal of leftovers. So not only has MSE beaten free competitors like AVG (version 8.5 tested, not 9.0), Avira, and Avast, it also posted test scores equal to or better than a dozen antivirus programs you'd have to pay for.

 

[BCXtreme]

I concur. For a free, simple solution for the average home user, nothing beats MSE.

 

[etalmar]

MSE is very good. Worked very well on my 64-bit OS, although it did slow my system down to a degree, as it caused several programs to "hang" while it scanned them as they were launching.

The only other issue I encountered with MSE was it flagging my USB drive as a "malicious worm" (Worm:Win32/Autorun.GY!inf) - which from Microsoft's Malware Protection Center Site explains that - "It should be noted that 'autorun.inf' files on their own are not necessarily a sign of infection, as they are used by legitimate programs."

Other than a little system slowdown and false positive alert about my USB drive, it seems to be a good program that is more comprehensive than Windows Defender.

 

[JonM33]

MSE is very good. Worked very well on my 64-bit OS, although it did slow my system down to a degree, as it caused several programs to "hang" while it scanned them as they were launching.

The only other issue I encountered with MSE was it flagging my USB drive as a "malicious worm" (Worm:Win32/Autorun.GY!inf) - which from Microsoft's Malware Protection Center Site explains that - "It should be noted that 'autorun.inf' files on their own are not necessarily a sign of infection, as they are used by legitimate programs."

Other than a little system slowdown and false positive alert about my USB drive, it seems to be a good program that is more comprehensive than Windows Defender.

I'd question why you have a USB device with an autorun.inf file on it. That's a bit out of place. An autorun.inf file merely points to an executable, and that's a big issue.

The Malware Protection Center actually shows no information on that but Win32/Autorun.GY finds a nasty result on the web: Worm:Win32/Autorun.GY is a malicious virus. Remove it in 60 seconds with these simple instructions

Doesn't sound like a false positive to me.

 

[BCXtreme]

MSE is very good. Worked very well on my 64-bit OS, although it did slow my system down to a degree, as it caused several programs to "hang" while it scanned them as they were launching.

The only other issue I encountered with MSE was it flagging my USB drive as a "malicious worm" (Worm:Win32/Autorun.GY!inf) - which from Microsoft's Malware Protection Center Site explains that - "It should be noted that 'autorun.inf' files on their own are not necessarily a sign of infection, as they are used by legitimate programs."

Other than a little system slowdown and false positive alert about my USB drive, it seems to be a good program that is more comprehensive than Windows Defender.

I'd question why you have a USB device with an autorun.inf file on it. That's a bit out of place. An autorun.inf file merely points to an executable, and that's a big issue.

The Malware Protection Center actually shows no information on that but Win32/Autorun.GY finds a nasty result on the web: Worm:Win32/Autorun.GY is a malicious virus. Remove it in 60 seconds with these simple instructions

Doesn't sound like a false positive to me.

You're right, that is a little unusual. Unless etalmar put it there intentionally, which is possible.

Etalmar, did you specifically place an autorun.inf file on that drive? If not, have you ever plugged it into another computer that could have been infected without your knowledge?

 

[Corrine]

Hi, etalmar,

I agree with JonM33 and BCXtreme. It doesn't sound like a f/p to me either. Microsoft is not the only vendor that detects that worm. See W32/Autorun.worm.gen.za!1f65e215c852.

I suggest that you first disable autorun, see this tutorial: AutoPlay - Enable or Disable AutoRun - Windows 7 Forums. Following that, update MSE and scan the USB drive and allow MSE to quarantine the file.

 

[etalmar]

Originally Posted by JonM33 - The Malware Protection Center actually shows no information on that but Win32/Autorun.GY finds a nasty result on the web:" Worm:Win32/Autorun.GY is a malicious virus. Remove it in 60 seconds with these simple instructions

Beg to differ ...

The Malware Protection Center link can be found here .. Encyclopedia entry: Worm:Win32/Autorun.gen!inf - Learn more about malware - Microsoft Malware Protection Center

And I quote ...

"Worm:Win32/Autorun.gen!inf is a detection for 'autorun.inf' files that may be used by worms when spreading to local, network, or removable drives."

​

"When copying themselves to a drive, these worms also create a file named 'autorun.inf' in the root of the targeted drive. The 'autorun.inf' file contains execution instructions for the operating system which are invoked when the drive is viewed using Windows Explorer, thus executing the copy of the worm."

​

"It should be noted that 'autorun.inf' files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs."​

 

[JonM33]

You are linking to Worm:Win32/Autorun.gen!inf and not Worm:Win32/Autorun.GY!inf, which you originally referenced in your first post. Which one is it?

When you look at the notes for Win32/Autorun.gen!inf you see some very dangerous information:

Worm:Win32/Autorun.gen!inf is a detection for 'autorun.inf' files that may be used by worms when spreading to local, network, or removable drives.

When copying themselves to a drive, these worms also create a file named 'autorun.inf' in the root of the targeted drive. The 'autorun.inf' file contains execution instructions for the operating system which are invoked when the drive is viewed using Windows Explorer, thus executing the copy of the worm.

That's not a false positive. The other part about "autorun.inf" files are not an indication of an infection means just that. If you load a CD or DVD you will see an autorun.inf file.

What makes it a true positive is the fact that a virus signature matched the particular autorun.inf file on your USB drive to a known virus. Other AV programs identify it as the following.

• INF/Frethog (CA) Worm.Win32.AutoRun.rja (Kaspersky)
• Mal/AutoInf-B (Sophos)
• INF.Autorun.Gen (VirusBuster)
• Trojan.AutorunINF.Gen (BitDefender)

 

[etalmar]

You are linking to Worm:Win32/Autorun.gen!inf and not Worm:Win32/Autorun.GY!inf, which you originally referenced in your first post. Which one is it?

I copied and pasted the info from MSE's alert box that popped up, so if there is any conflicting info about the specific name, that is why. The link was provided by MSE for additional information, but I'm not surprised that Microsoft would offer conflicting data.

No disrespect intended, but this matter is really not an issue to me. My new OS is working fine with no problems, so let's just forget I even mentioned about the "false positive" alert from MSE and call it a day.

Thanks very much for offering to help me, but for now, I am leaving well enough alone. I've always been a proponent of the "If it ain't broke, then leave it the hell alone" theory and when I mentioned the autorun alert from MSE, I wasn't asking for help with removing it. I was simply stating what it supposedly found on my USB drive.

 

[EpicThorn]

I have been using MSE for a while now, and have nothing but praise for it. Microsoft have done quite a good job with it, and so they should, they know their OS better than anyone else.

Regards,
Thorn

 

[Corrine]

Hi, etalmar,

In the event you do use the USB stick on someone else's computer or at a public site (i.e., WiFi), I suggest that you first disable autorun (Tutorial at AutoPlay - Enable or Disable AutoRun - Windows 7 Forums).

 

[eldinv]

I have been using MSE for a while now, and have nothing but praise for it. Microsoft have done quite a good job with it, and so they should, they know their OS better than anyone else.

Regards,
Thorn

Agree, they got it right for a change. I love MSE. Now if I could just have Desktops and Wobbly Windows like in Linux, I would terminate my Linux box FOREVER.

 

[Petey7]

I've been looking for something like this. My parents just ordered a new laptop from Dell that has McAfee installed, and I'm trying to convince my dad that they would be better off using MSE. This is exactly the kind of thing that would convince him, especially after a hassle he had with McAfee about a year ago.

 

[Corrine]

Hi, Petey7.

Please make sure your parents know that McAfee will be good for a trial period only (usually 6 months) and will need to either be replaced by something else or a license paid for.

 

[Petey7]

Corrine, Dell now pre-installs the best and newest version of McAfee on most home computers, with no option to not get an AV. Some of the money paid towards the laptop pays for a 15 month license (or longer if selected). We've had McAfee before and had a number of issues with it. My dad figures that since it's already paid for, why not just leave it on there. I seriously doubt that McAfee will do a good job keeping the PC safe and I know it is a major resource hog like no other.

 

[JonM33]

Hi, Petey7.

Please make sure your parents know that McAfee will be good for a trial period only (usually 6 months) and will need to either be replaced by something else or a license paid for.

I would just have them remove it altogether. McAfee is a nasty resource hog that will slow down even the fastest of computers. The CIO at a company I used to work for would literally scream every time the McAfee scan started. He'd quickly Ctrl+Shift+Esc and end the entire process so he could actually get control of his PC again.

 

[etalmar]

That's not a false positive. What makes it a true positive is the fact that a virus signature matched the particular autorun.inf file on your USB drive to a known virus.

I found this comment on another site, whereby the person had the same experience with MSE, yet the response was that most likely it was a simple false positive .. "all MSE did was get rid of some flash driver that enables autorun and thought it was a threat."

False Positive? MSE detected Autorun.inf "virus" ... - Norton Community

Regardless of the true nature of the MSE autorun alert, I have decided to disable "Use AutoPlay for all media and devices" in my control panel, just as a precautionary measure.

 

[JonM33]

That's not a false positive. What makes it a true positive is the fact that a virus signature matched the particular autorun.inf file on your USB drive to a known virus.

I found this comment on another site, whereby the person had the same experience with MSE, yet the response was that most likely it was a simple false positive .. "all MSE did was get rid of some flash driver that enables autorun and thought it was a threat."

False Positive? MSE detected Autorun.inf "virus" ... - Norton Community

Regardless of the true nature of the MSE autorun alert, I have decided to disable "Use AutoPlay for all media and devices" in my control panel, just as a precautionary measure.

That doesn't seem related at all to what you identified in your original post. There is a lot of malware that utilizes an autorun.ini file on a removable drive.

Best option, as you have done, is to disable AutoPlay altogether.

 

[hybridfan]

Why don't MS include MSE in Windows 8, seems a bit silly you have to be online to download it and where do the majority of viruses come from?...

 

[Corrine]

Why don't MS include MSE in Windows 8, seems a bit silly you have to be online to download it and where do the majority of viruses come from?...

For one reason, Microsoft offers Microsoft Forefront Client Security for corporate customers. Another the same reason that Microsoft now has to provide an option in Europe for selecting an alternate browser.