MSE not sure if real time protection is working

[colinw]

As the title says really, is my MSE real time protection actually working ?

I ran an exe file on purpose a few days ago knowing it had some mallware / spyware built into it. I did it to test MSE. But nothing happened.

Now a few days later i decide to run a custom scan on my xp partition, my windows 7 partition and a pen drive. These drives had 4 trojans and two java exploits in total, which MSE cleaned.

But how come the real time protection did'nt pick these up ?

Or even doing a quick scan did'nt pick these up either ?

Help, i don't feel safe anymore

 

[Corrine]

First of all, colinw, why in heavens name would you intentionally run an .exe file you know is bad? Personally, I don't consider that a wise move.

As to why the real-time protection didn't catch the install, much depends on your other settings and the permission you provided during the installation. If you have UAC turned off or allowed the UAC elevation prompt during install, you took it upon your own hands to provide the program with permission. It is also possible that what you installed was not in detection at the time of installation but was subsequently added.

 

[colinw]

Well as i said i wanted to test MSE that's all. I keep hearing how good it is so thought i would test it. My UAC is one notch down from the dafault. But not off.

Anyway i won't be doing it again.

Been running it for several months now and not seen it detect anything, so you begin to wonder if it's working.

 

[Jacee]

Click on the 'settings' tab, then click on 'real time protection'. Are all three boxes checked?
What are you're 'default actions' set at?

 

[hackerman1]

hi !

colinw: "Been running it for several months now and not seen it detect anything, so you begin to wonder if it's working."

well, if you don´t get any viruses / malware, what is there for MSE to detect ?

 

[Greg S]

If there's a problem with it, the tray icon will warn you about it. If it doesn't, Windows Security will.

 

[colinw]

ok thanks guys for the reply's

Its all set to default, so yes all three ticks are on etc.

I will keep an eye on it.

 

[ignatzatsonic]

Click on the 'settings' tab, then click on 'real time protection'. Are all three boxes checked?

Jacee:

Are you implying that real time virus protection is contingent on scans, scheduled or otherwise?

 

[colinw]

Well just a quick update, i don't know whats going here but my usb pen drive had a hidden autorun.inf and svchost.exe file, I done a scan of the pen drive and MSE found nothing wrong.

Then took MSE off and went back to Nod32 which i was running before anyway. And as soon as plugged my pen drive in Nod32 detected these files and deleted them straight away.

So for what ever reason i can't see the MSE realtime working at all ?

I was hoping to stay with MSE but something is wrong.

My settings are all fine, they are just default.

To me it's as though there is no background scanning going on at all.

Weird.

 

[Juxhin]

I personally think MSE sucks cause its a free antivirus and as a free it has a low detection rate.
I sugest you Avira as a free antivirus and kaspersky or avast as a paid one you choose.
And never use 2 antiviruses in the same time.

 

[Capt.Jack Sparrow]

I personally think MSE sucks cause its a free antivirus and as a free it has a low detection rate.
I sugest you Avira as a free antivirus and kaspersky or avast as a paid one you choose.
And never use 2 antiviruses in the same time.

I bet there would be a lot of Users who would disagree with that statment including me

 

[pillainp]

I personally think MSE sucks cause its a free antivirus and as a free it has a low detection rate.
I sugest you Avira as a free antivirus and kaspersky or avast as a paid one you choose.
And never use 2 antiviruses in the same time.

I bet there would be a lot of Users who would disagree with that statment including me

And me. Its been a great experience so far.

The "It's free so it can't be good" argument is absolutely not valid, at least in MSE's case.

@colinw:

Why don't you try the EICAR test?

If every time you create a file containing the test string (create a text file, paste the string and try to save it as "EICAR.COM" (quotes must be included, as otherwise notepad will save it as EICAR.COM.txt), you will get an Access Denied message from MSE, if RT protection is running fine.

If this does not work, maybe try uninstalling and re-installing MSE?

Download the EICAR test file from here. Multiple versions are available. If you choose to download the COM (either as such or in the zipped file) version, MSE should not let you do so at all.

If you choose the text file version, scroll down the document till you get to the test string, select it and copy it to a new empty text document, and try to save it as mentioned above.

Let us know how this goes.

 

[colinw]

I personally think MSE sucks cause its a free antivirus and as a free it has a low detection rate.
I sugest you Avira as a free antivirus and kaspersky or avast as a paid one you choose.
And never use 2 antiviruses in the same time.

I bet there would be a lot of Users who would disagree with that statment including me

And me. Its been a great experience so far.

The "It's free so it can't be good" argument is absolutely not valid, at least in MSE's case.

@colinw:

Why don't you try the EICAR test?

If every time you create a file containing the test string (create a text file, paste the string and try to save it as "EICAR.COM" (quotes must be included, as otherwise notepad will save it as EICAR.COM.txt), you will get an Access Denied message from MSE, if RT protection is running fine.

If this does not work, maybe try uninstalling and re-installing MSE?

Download the EICAR test file from here. Multiple versions are available. If you choose to download the COM (either as such or in the zipped file) version, MSE should not let you do so at all.

If you choose the text file version, scroll down the document till you get to the test string, select it and copy it to a new empty text document, and try to save it as mentioned above.

Let us know how this goes.

Hi pillainp

Thanks for that, yes i tried that test and it worked fine.

So why does MSE not see a hidden autorun.inf and svchost.exe file on a pen drive, even after i scan it ?

And why did it not detect and clean my trojans and java exploits which i had on two partitions. ?

Thanks for that anyway, at least it proves it is working.

 

[pillainp]

You're welcome.

Do you have any special permissions in effect on any of those drives?

 

[colinw]

Hi Pillainp,

No not really. I have a dual boot laptop with xp on one partition for work, and win 7 64 bit on another partition for home, and then one more partition for everything else.

thanks

 

[colinw]

I have attached a screenshot showing the files that MSE did'nt pick up at all via the real time checking. Only picked them up by scanning my partitions.

Ignor the top two on the list, that was the test i done earlier where real time did actually work.

Thanks

 

[pillainp]

Was that pen drive NTFS formatted?

Maybe you should also try Microsoft Answers' MSE discussions.

[Mods please delete link if pointers to other forums are unacceptable]

 

[colinw]

no fat32

 

[colinw]

ok thanks i will have a look on the link.

Thanks for your all your help anyway.

 

[Tews]

Instead of putting yourself through all this angst, why not find an AV program that you trust??