Microsoft Security Essentials shakes up consumer antivirus

[mkis]

My computers are already adequately protected - avast, mbam, OA or Outpost, mvps with Hostman - and there may be resource conflict when MSE is added. I think not but time will tell.

The screenshot is of MS event viewer, category is system.
From a computer that I am currently working on. I thought I would load MSE anyway.

I havent powered up the R50 (spec below). But will do so before evening (currently 10.30am).

[YoKenny]

@mkis

I prefer Event Log Explorer™ to look at the system logs

Event Log Explorer™ is an effective software solution for viewing, monitoring and analyzing events recorded in Security, System, Application and another logs of Microsoft Windows NT/2000/XP/2003 operating systems. Event Log Explorer greatly extends standard Windows Event Viewer monitoring functionality and brings many new features.

http://www.eventlogxp.com

It reqires a Free Personal license for personal non-commercial use. It doesn't allow you to connect more then 3 computers. It comes with limited technical support over Forum. Free license valid for a half year. After the expiration, you can renew your free license.

I do not see all of those MSE 5007 events in my System log but I clean the logs regularly.

[mkis]

Hi YoKenny. I havent had time to follow this up yet as I've been busy with other things. The ID event 5007 were on a computer I was working on and havent been back to as yet (had a problem with downloads, but was get a general software tidy up first). I hope to be back there later today. A quick peek at the R50 tells me that no 5007 entries there. Anyway, bookmarked yr post to come back look at tonight some time. 

[mkis]

I went out for the day to do a few things about town and left the R50 running with a web page open.

The first screen shot is self explanatory - MS event viewer, category is system.
The three antimalware entries comprise the update of Microsoft Securityt Essentials.

The second screenshot is the update event itself - the record is highlighted in the first screenshot.

[YoKenny]

Looks like the system is working normally now.

[Pondus]

One thumb up for MS Security Essentials in early tests
Detection fair but clean-up lacking, reports AV-Test.org

http://www.theregister.co.uk/2009/10/01/ms_security_essentials_review/

[spg SCOTT]

There's a blog post now:

avast! blog >> And what about Microsoft Security Essentials—MSE?

[mkis]

Looks like the system is working normally now.

The R50 always work normal when left on internet for period of time - I think this time more than 8 hours. When unhooked from internet but left turned on, the laptop will periodically still attempt to update. This will return a error message in the event logs - a 'soft' error message, there is no error message returned to the screen ('hard' error message, I gather how it is termed). Also the connector to laptop on the power cord only fits loosely, so if it catches anywhere the cord slips out and once the battery runs down a bit MSE turns itself off and I have to restart it. This hasn't helped things much. I try to keep an eye on it.


The ID 5007 events were happening on a different computer that I was working on. I did have some problems with download of programs - firstly mbam (which downloaded ok now), then OpenOffice (which I still havent loaded as yet), and lately with avast when I attempted to uninstall and re-install (initial problem was a red ring around 'a' icon in system tray). Install of a version of avast saved on another computer went okay but no avast icons in sys tray - after appearing initially but no bubble message. I think saved version about 3-4 weeks old. I downloaded and saved latest version to a good computer and installed that successfully (so far). In the meantime I had installed MSE as a stop measure and I think I will leave it installed. The computer has avast, OA firewall (paid), mvps with Hostman, and runs the Firefox 3.5.3 browser, which I always like to have running on at least one computer. The computer seems okay now but I aim to still troubleshoot when I have time - unsure as yet about downloads issue.

Because I have a few computers that are left turned off for periods of time, especially when I am busy, I often need to bring everything up to date when I do turn them on. Looks to me as if I occasionally run into problems during these update procedures. I cannot say for sure, but my gut feeling is that there are likely to be problems with MS updates that carry through to other apps and programs. MS auto updates can sometimes but not always run erratically. I'm still working on this issue when I have time. Sometimes the computers have not been run for 4-6 weeks or more, but will now change with this computer as I want to run the default Firefox browser more consistently from now on. And looks like MSE will be staying onboard as well.

[mevcit]

don't know what to think of that, I tried he EICAR test with MSE yesterday with Avast completely deactivated. Files as well as archives were detected, which is fine (although not in RAM obviously, can't ask too much, MSE's really basic...)...what I didn't think of is the EICAR zip file left some stuff in my temporary folder. How I realized that is when running CCleaner, and analyzing the content of the temp folder triggered a new alert of MSE related to the EICAR archive. The archive itself wasn't there anymore but temps files generated by it yes, and the MSE alert mentioned that, just that. So I clicked on "clean computer", lol several times after re-triggering the alert with CCleaner analysis...and there was no way MSE would delete or quarantine those temp files...why, I have no idea. It could have been the remnants of any virus, the behavior would have been the same...

adding: now I just noticed another issue while testing EICAR with Avast, will post that in another thread...

That's because it's a zip file. MSE detects such type of archive files in real time but when it comes to cleaning, it says "not found" on the removal window and the window becomes green (it should emphasize more on the "not found" note, IMO). Some browsers create extensionless temp files but it doesn't matter, the file still is a zip file. As I've said, MSE detects malicious things inside the archive, and at cleaning stage it just doesn't reach inside of it but seeing the archive file as a single file. That may be the cause why it says "not found". So the archive file is still there. Other than that no problems with non-archived files. Actually archive files are totally harmless and I prefer the way MSE does rather than deletion of the whole archive.

[Hermite15]

yeah, not such a big deal as like you said archives unless extracted are harmless; and any AV would trigger alerts and actions if the user extracted them while they contain malicious stuff. Remain the rare cases where an archive has the ability to extract itself without any user intervention. AV should still work but I'd rather be warned before any extraction to HDD happens.

[mevcit]

Actually I don't know what archive types it does scan in real time before extraction, I can be certain about more known types like zip, rar, 7zip, etc. Yes there are self-extractors but I don't know how MSE reacts, also installers have many archived files and as far as I know MSE doesn't scan them until they are run, for the sake of system resources of course. avast! has the ability to scan all archive file types (can be set via the enhanced user interface), but for the standard shield that would be a big system hog.

As a result MSE warns us about common archive types that contain malicious items, that's OK. Have a nice day.

Mevlüt.

[tkrbrian]

i removed avst home :'( to give MSE a try to see if its really that good. first it started to load spywareblaster real late so i had to remove that too and  now all i am using for my laptop acer with 3gb ddr3 ram is this product. to see how it works i surf the darkest side of the net so far no problem. i am not using any other firewall or security relate product real time only malwarebytes free its vista32bit. on my desk top i still use avast with other security related software like iobit 360, winpatrol,spywareblaster etc. i hope avast5 is really good or they might loose some loyal friends. i have been using avast home for years. iam waiting for avast5 MSE also loads programs real fast .....and i do use sandboxie  when ever i feel like.

[Marc57]

@ tkrbrian, If you add spywareblaster to MSE's exclusion list it will load just fine.

[tkrbrian]

thanks dude can i do the same with vista firewall control and other real time protection software too?? although vista firewall control works the startup sucks.....

[roro]

This has probably been answered, but do I have to disable Avast in order to use MSE?  It sounds as if there would be a conflict with both running.  If Avast is disabled will my email not be scanned by MSE? 
I have used Avast for years and want to stick with it if possible.

RoRo