typodupeerror

## In Test, Windows 7 Vulnerable To 8 Out of 10 Viruses843

Posted by kdawson
from the take-your-shots dept.
As Windows 7's market share passes 3.6%, up from 1.9% the day before launch, llManDrakell notes an experiment they did over at Sophos. They installed Windows 7 on a clean machine — with no anti-virus protection — with User Access Control in its default configuration. They threw at it the next 10 virus/worm samples that came in the door. Seven of them ran; UAC stopped only one baddie that had run in the absense of UAC. "Lesson learned? You still need to run anti-virus on Windows 7."
This discussion has been archived. No new comments can be posted.

## In Test, Windows 7 Vulnerable To 8 Out of 10 Viruses

• #### Not News!! (Score:2, Insightful)

Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get. Especially with the number of good free anti-virus programs available for Windows, there is no excuse not to have one either way. I use Avast Home Edition. It's free (just registration required), fast, and small-footprint. Even if 9/10 viruses would be blocked by UAC, an anti-virus program that blocks the last one is worth it.
• #### Re: (Score:2, Funny)

by Anonymous Coward
Well, if they'd used a fully updated version of Sophos how many would have gotten through?
• #### Re:Not News!! (Score:5, Insightful)

on Tuesday November 03, 2009 @06:17PM (#29969334)

None of the 10 they picked!

• #### Re:Not News!! (Score:5, Informative)

<mils_oRgen@hotmail.com> on Tuesday November 03, 2009 @06:36PM (#29969638)
And I would be willing to bet the same could be said for Security Essentials.

Been running AVG for years, but ever since I installed SE it's caught shit in video files before they've even finished downloading. As well as a couple JavaScript attacks from websites I wouldn't think twice about visiting. I can't even remember the last threat AVG found aside from cookies.
• #### Re:Not News!! (Score:5, Insightful)

<barbara.hudsonNO@SPAMbarbara-hudson.com> on Tuesday November 03, 2009 @05:41PM (#29968714) Journal

Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get

Sure - just that you won't get a virus by running linux. I have yet (in over a decade of tending linux and bsd servers) had a single machine get infected.

Lesson learned - friends don't let friends run Windows.

• #### Re:Not News!! (Score:5, Insightful)

on Tuesday November 03, 2009 @05:46PM (#29968812)

I have yet (in over a decade of tending windows and NT servers) had a single machine get infected.

Lesson learned - Give the same system rights to your windows users as your Linux users have, and they can't get infected even if they wanted to.

• #### Re:Not News!! (Score:5, Insightful)

on Tuesday November 03, 2009 @05:56PM (#29968988) Homepage Journal

Lesson learned - Give the same system rights to your windows users as your Linux users have, and they can't get infected even if they wanted to.

The corollary to that rule is that many applications won't run because they're poorly architected and require administrative rights to run. Oh, sure, you can finagle around with permissions and get many of them to run, but is it really worth the time to work around broken software? (running Windows which itself is broken notwithstanding)

• #### Re: (Score:3, Insightful)

Getting the sound card, network card, and multibutton trackball working on my Linux machine took plenty of finagling too. Just sayin', neither this cast iron pot nor kettle are LeCresuet red - they look black to me...

• #### Re: (Score:3, Informative)

Please remember that the vast majority of hardware and peripherals are designed from the ground up to work with Windows and that most computers are sold with Windows preinstalled and preconfigured.

If you want a similar experience, I suggest buying a computer with Linux preinstalled and preconfigured. I recommend System76 [system76.com]

• #### Re:Not News!! (Score:4, Insightful)

on Tuesday November 03, 2009 @06:20PM (#29969378) Homepage

The Linux community, as a whole, needs to get it's story straight. (Yeah, I'll probably get modded troll, I'm okay with that).

One day I hear Linux has great hardware support. It's not like Linux in the past, we even have *BETTER* hardware support than Windows now.

Then, the next day I hear, 'Well, yeah, Linux doesn't work; but you don't have the right hardware. You need to BUY A NEW FRIGGIN MACHINE if you want to bank on Linux working without spending hours trying to get it to work.

Which is it? It can't be both.

• #### Re: (Score:3, Insightful)

One day I hear Linux has great hardware support. It's not like Linux in the past, we even have *BETTER* hardware support than Windows now.

It does.
Linux supports hardware.
Hardware supports Windows.

• #### Re:Not News!! (Score:5, Insightful)

<drsmithy@nosPam.gmail.com> on Tuesday November 03, 2009 @07:46PM (#29970950)

Please remember that the vast majority of hardware and peripherals are designed from the ground up to work with Windows and that most computers are sold with Windows preinstalled and preconfigured.

How do you design a piece of hardware "from the ground up" to work with a particular OS ?

• #### Re: (Score:3, Insightful)

I recall the days when I would download the newest slackware, install it and spend days getting my X config just right, reconfiguring my kernel an endless number of times to get just the right balance of built in options and building modules, trying to get the hardware to work right and basking in the supreme glory of getting everything to work just right.

Some days I miss that. Other days I boot up Ubuntu and just enjoy the fact that I don't have to do shit and it supports everything but my old canon multif

• #### Wall of Shame (Score:3, Insightful)

The corollary to that rule is that many applications won't run because they're poorly architected and require administrative rights to run

Slashdot should have a Wall of Shame for programs that are like this.

Kodak Easy Share is my pick.

• #### Re:Not News!! (Score:5, Informative)

on Tuesday November 03, 2009 @06:09PM (#29969194)

When you have little or no say in what software gets selected for use but are required to maintain local support for the same software as well as maintain the security of the network, it is not a waste of time at all. You do not give users Admin privileges. You give them the permissions they require to do their job and no more. That's basic best practice.

It's really not even that difficult to figure out. Nine times out of ten, the program either wants to write to HKLM\Software\$appname or wants to write to two or three configuration or log files in %programfiles%\$appname. About a quarter of the time (IMX) the documentation contains detailed information about what permissions are necessary. After that it's merely a case of using the various SysInternals monitors to figure out what's causing the problem. Between Xcacls and regini it's not difficult at all to script the changes. I typically maintain a single script which checks for the presence of each application and, if found, applies the necessary permissions changes.

• #### Re:Not News!! (Score:5, Insightful)

on Tuesday November 03, 2009 @06:01PM (#29969058) Journal

I have yet (in over a decade of tending windows and NT servers) had a single machine get infected.

Let's be clear here (and the same is true for anyone running Linux), you don't know that none of your machines were infected. You know thatyou never discovered an infection.

• #### Re:Not News!! (Score:5, Insightful)

on Tuesday November 03, 2009 @06:01PM (#29969060)

As a Windows (and Unix) System Administrator dealing with numerous users of the 'average' type, I must say giving users limited rights only work if the programs they need to run can do so within those rights.

We deal with a lot of industry specific software (ie. badly produced software) and many of the users need to have full access to absolutely everything in order for it to work, including mapped drives to the data!

Some of the users I support are absolutely mind-numbingly stupid. You tell them over and over to NOT do something and they do it again. You try and educate them on attachments and safe web browsing, and they don't care! Many of them will try all the risky things at work that they wouldn't do at home - because they know if they screw up their home computers they'll have to pay to get it fixed. At work, I fix them, someone else pays.

• #### Re:Not News!! (Score:4, Insightful)

on Tuesday November 03, 2009 @06:23PM (#29969424) Homepage

On Windows you can get along without AV, too. The three main vectors for malware to get on your machine are:

1. Direct network connections - mitigated by firewall/NAT router
2. Browser exploits - mitigated by avoiding IE and using adblock
3. Clicking dumb (running executables that come in from email or the web) - mitigated by not installing shit unless you know exactly what it is you're installing

I have followed these practices for about ten years, without ever using AV, and I have never had malware on my machine. Avoiding AV is important to me, because I play fast-paced online games.

That said, 99% of Windows users absolutely should be using AV, because my third point (not clicking dumb) requires technical sophistication most people lack.

TL;DR: You don't need AV if you know what you're doing.

• #### Re: (Score:3, Informative)

This article is little more than FUD aimed at Windows. This just in, FIRE HOT! I run without AV, and I haven't had a virus in years. The few things that ALMOST happened, were caused by exploits within Flash or Shockwave. Vista stopped those cold. Yes, VISTA. How do I know I am virus free? Because I know how to scan my system without installing AV. I know how my system should perform, and I know how to see what's running. I periodically check the health of my system by checking what's currently being acce
• #### Re: (Score:3, Insightful)

Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get

Sure - just that you won't get a virus by running linux. I have yet (in over a decade of tending linux and bsd servers) had a single machine get infected.

... that you know of.

• #### Re:Not News!! (Score:4, Funny)

on Tuesday November 03, 2009 @06:11PM (#29969240)

You don't need a virus if you have Linux. Just upgrade to the next version. That will take down your machine way quicker than getting a virus...

• #### Re:Not News!! (Score:4, Insightful)

on Tuesday November 03, 2009 @05:41PM (#29968722)
Anyone that installs Anti-Virus on their PC and expects it to protect them from their own stupidity deserves what they get.
• #### Re:Not News!! (Score:5, Insightful)

on Tuesday November 03, 2009 @05:42PM (#29968732) Homepage Journal

Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get.

Yeah? Can you point to ONE virus in the wild that has ever bitten any Mac or Linux user? Trojans don't count. Install Linux on your Windows box and you do NOT need any antivirus (unless you boot into the Windows side), provided you're not stupid enough to run an executable from an untrusted source.

• #### Re: (Score:3, Informative)

Yeah? Can you point to ONE virus in the wild that has ever bitten any Mac or Linux user?

Yes, I know it's from 2006. But it answers your question: http://www.internetnews.com/dev-news/article.php/3601946 [internetnews.com]

• #### Re:Not News!! (Score:5, Informative)

on Tuesday November 03, 2009 @06:24PM (#29969442)

The funny thing is the article you cite doesn't mention any virus for Linux or OS X that is in the wild. It talks about malware, which it claims is increasing, but does not list any specific item. It doesn't say if any of the malware is a virus or if any of it is propagating in the wild. You've failed in that regard.

• #### Re:Not News!! (Score:5, Informative)

on Tuesday November 03, 2009 @06:03PM (#29969086)
Remote Shell trojan [securiteam.com] (which despite the name is self replicating and therefore a virus). Designed specifically to be spread by users running trustworthy executables without the need for admin rights. And yes, it did infect a number of systems 'in the wild'
• #### Re:Not News!! (Score:4, Informative)

<barbara.hudsonNO@SPAMbarbara-hudson.com> on Tuesday November 03, 2009 @06:53PM (#29970022) Journal
Not really. First, the most it could do is infect your own files, not the system. Second, you would have to run it - it can't spread by itself. Do people running linux run strange executable binaries that people send them? No. It's not like Windows, where reading your email can infect your machine.
• #### Re: (Score:3, Insightful)

Trojans don't count

Why on Earth not ? The bulk of Windows "viruses" are, in fact, trojans.

Install Linux on your Windows box and you do NOT need any antivirus (unless you boot into the Windows side), provided you're not stupid enough to run an executable from an untrusted source.

I've spent nearly 15 years running Windows using this principle, without an AV problem, and - unsuprisingly - have yet to be infected by anything.

The problem is not the OS.

• #### Re:Not News!! (Score:5, Insightful)

<bakadamage-slashdot@yahoo.com> on Tuesday November 03, 2009 @05:42PM (#29968740) Homepage Journal

Why would you need an anti-virus if you have a router whose firewall is worth a damn, have a browser that doesn't develop un-patched exploits like college kids develop acne and you don't click and run every damn executable bit of code you see on web site?

If you have a good firewall and secure applications, the only remaining way to get a virus is if you download it and run it yourself.

Virus and virus-checker free for over 8 years.

• #### Re:Not News!! (Score:5, Insightful)

<jcavanagh617 AT gmail DOT com> on Tuesday November 03, 2009 @05:52PM (#29968922)

Out of curiosity, how exactly do you verify that you are infection free without a scanner? Sure, you probably don't have anything overt, like a botnet hijack, but what about less obvious things like rootkits?

You should probably take your magical ninja virus detection powers and do some consulting for those poor bastards who run Norton....

• #### Re:Not News!! (Score:4, Interesting)

on Tuesday November 03, 2009 @06:04PM (#29969118)
How do you tell if you have one *with* a scanner? Root kits by definition do not show up, thats why they are called root kits.
• #### Re:Not News!! (Score:5, Informative)

on Tuesday November 03, 2009 @05:43PM (#29968764)

Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get.

Yep, I've been "asking for what I get", and getting what I ask for, by running Macs without anti-virus for almost 25 years now.

I use Avast Home Edition. It's free (just registration required), fast, and small-footprint.

Yeah, I'll pop that right onto my Macs, especially after reading these five-star reviews [cnet.com]. Five reviews with one star each makes five stars, right?

• #### Re: (Score:3, Insightful)

I don't know about MacOSX malware in the wild (although any system can get trojaned), but if you've been running for 25 years that includes the old OSs, and they did have viruses. Some of them, like WDEF, were pretty virulent, and my habit of carrying my own Disinfectant diskette proved very useful. Were you just really, really careful what you exposed your system to?

• #### Re: (Score:2)

Please tell me where I can get some of that cycle eating software for my solaris 9 sparc workstation.

100% of those viruses would have not worked on a better OS.

• #### Re:Not News!! (Score:4, Funny)

on Tuesday November 03, 2009 @05:43PM (#29968770)

Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get.

HAH! What else? Should Slashdotters buy boxes of condoms, just in case?

• #### Actually, that is sort of news (Score:4, Informative)

on Tuesday November 03, 2009 @05:47PM (#29968832) Journal
I'm running several macs, both at home and at work, and the only time I've ever run an anti-virus on any of them was at the request of my ISP last month - there was a report of a virus originating from my home IP address. I downloaded and ran the latest ClamAV, and of course there was no virus on the machine, it was a spoofed IP address...

Over the past 5 years, that's the only time I've ever run a virus check. It came up with 0 viruses. I conclude that the likelihood of me getting a virus on a mac is still small compared to my XP box, which every time I run a virus check flags *something* new as wrong/suspicious. Sometimes I can even tell if the something is innocuous or dangerous...

Slashdot likes to say that anecdotal evidence is meaningless (which of course it is), but when a sufficiently large collection of anecdotes all say the same thing, we call that consensus. The general consensus is (I believe) that Macs are a lot less likely to be infected than Windows boxes, so your 'Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get' statement is in fact news to me.

Simon
• #### Re:Not News!! (Score:5, Insightful)

on Tuesday November 03, 2009 @05:50PM (#29968888)

No, people who run shit they shouldn't are asking for what they get.

I don't run a real-time scanner, it's too much of a resource hog, I do let AV do an overnight scan once a week though. I've done this for years and never had a virus. Why? Because I don't run shit I know may not be safe to run. I do not open attachments I was not expecting to recieve.

It's not as if AV software is even that effective anyway, even when it does detect threats half the time it fails miserably at dealing with it and just gives the option of deleting, and sometimes some AV software doesn't even manage that. The paradigm used for AV software is that which has been used for a couple of decades, and it never even worked particularly effectively back then, let alone now that viruses have evolved whilst AV software really hasn't. Again, the best option is really to cover all the attack vectors - don't run executables you don't trust, don't have Javascript enabled on sites you can't be sure are safe, don't open attachments you weren't expecting and so on.

• #### What's new? (Score:2, Funny)

Is this supposed to be a surprise?
• #### Re: (Score:3, Insightful)

Well, yes seeing as the whole purpose to upgrade is to be able to have little or no security issues, and no need for AV.
Cancel or allow, so what, it is bypassed, so I will just stick with XP seeing as I already have my license and already have my Av on it.

M$needs to come out with an OS that has no possibility of being owned by a virus, sort of like linux does, linux only has rootkits. Sysinternals is good for rootkit detection and is owned (now) by M$, so if they could tweak their OS to be more like linux,

• #### Not suprising (Score:3, Informative)

on Tuesday November 03, 2009 @05:36PM (#29968644)

For one, they watered down UAC. Second, UAC won't do anything if the virus simply attaches itself to your user account, instead of the whole system. UAC is supposed to help keep malware gaining admin rights and infecting your system, not to stop it from running.

• #### Re: (Score:3, Informative)

For one, they watered down UAC

I did in fact RTFA, and they did NOT "water it down"; they ran it in its default configuration.

• #### MS did by default (Score:4, Informative)

on Tuesday November 03, 2009 @05:54PM (#29968940)

So in Vista, UAC had only two settings: On and off. When it was on the system functioned with real separate privileges. You had to escalate to perform administrative actions. Ok well people bitched and whined and bitched and whined about that since you had to do it for things like changing file permissions or accessing system control panels. Thus Microsoft relented and watered it down for 7, having two settings in between on and off. It is set to one of those by default. More or less it asks for permissions for a program trying to get admin access, but not a user initiated operation.

• #### Re:MS did by default (Score:5, Informative)

on Tuesday November 03, 2009 @06:18PM (#29969340) Homepage
Not quite. Microsoft added a cryptographic whitelist of programs that are automatically allowed to elevate. Certain parts of Windows are then allowed to automatically elevate (like file properties dialogs, the control panel, etc...). Since there's no way to distinguish the source of events, NT 6.x also enforces mandatory access controls, and places programs with administrator privileges in a high integrity level, which prevents low integrity processes from interacting with them.

That's why some things still require two steps. The 'first click' causes explorer (or whatever part of Windows you're dealing with) to automatically elevate and switch to a high integrity level. But since that click could have been injected by unprivileged malware, rather than an actual mouse click, the program then requires a 'second click' confirmation. Since it's running at a high integrity level now, that second click can only come from other high privilege programs or drivers. One special case is the UAC settings control panel... that places itself into a high integrity level immediately so that malware can't inject keystrokes to turn off UAC.
• #### Re: (Score:3, Informative)

Also, on this topic...

You can elevate arbitrary code in Windows 7 to admin privileges with the Windows 7 default settings, no UAC questions asked, and MS won't fix that.

• #### Re: (Score:3, Informative)

Yeah, I tried the linked proof of concept on the RELEASED version of Windows 7 (the site only references beta and RC versions), and it didn't work. Either it prompted, or it failed to acquire admin or high integrity rights. I notice the site hasn't been updated for build 7600 (the RTM version), even though it's been available for some time. Even if MS patched the specific thing the proof of concept was using but failed to fix the underlying problem, they still need to release an updated version to be taken
• #### I'm shocked! (Score:5, Insightful)

on Tuesday November 03, 2009 @05:36PM (#29968646)

Next you'll be telling me that 8 out of 10 people who have unprotected sex with HIV-positive, syphilitic, sore-encrusted prostitutes will contract some sort of venereal disease.

• #### Re:I'm shocked! (Score:4, Funny)

on Tuesday November 03, 2009 @05:39PM (#29968678)
This is /. 8 out of 10 people here will only ever have sex with their right hand.
And the other 2 with their left hand. :)
• #### Re:I'm shocked! (Score:5, Funny)

on Tuesday November 03, 2009 @05:49PM (#29968864) Journal

• #### Re:I'm shocked! (Score:4, Funny)

on Tuesday November 03, 2009 @06:34PM (#29969606)
We won't be talking about those slimy ambidextrous people.
Damn it, just make up your mind people!!!
• #### Was it ever in doubt? (Score:2, Funny)

So, for (1) Windows 7 is very similar to Vista, with a lot of code reuse, and (2) the people who develop viruses target *almost exclusively* windows, so how would the need to run an antivirus on a new version of windows ever be something you would doubt?

• #### Interesting market share stat there (Score:5, Funny)

on Tuesday November 03, 2009 @05:39PM (#29968682)

Windows 7's market share ... 1.9% the day before launch

Windows 7 had 1.9% market share before launch?

• #### Error in summary (Score:2, Flamebait)

""Lesson learned? Don't run Windows 7."

Oh, wait, that would challenge the iron law of commercial software reviews, of not considering alternatives.

• #### Re:Error in summary (Score:5, Insightful)

on Tuesday November 03, 2009 @09:29PM (#29972118) Homepage
On what OS can you run viruses written for that OS, which will not run? RTFA; they ran virus.exe on Windows 7 and were gobsmacked that they ran. This is FUD and/or a slashvertisement for Sophos..
• #### High quality! (Score:5, Funny)

on Tuesday November 03, 2009 @05:42PM (#29968728) Homepage
So 8/10 viruses don't require administrator permissions and conform to Windows development standards. If only the rest of the software industry had such high standards.
• #### X64? (Score:2)

So which version of Windows 7 was tested? TFA does not specify. Was it X64?

• #### Ridiculous counting (Score:2)

For those of you as confused by the numbers as I was:

-Only 8 of the 10 successfully ran on Windows 7, the other 2 failed to even start
-Of the 8 that successfully started, 1 was blocked by UAC
• #### Firewall? (Score:2, Interesting)

Was the Windows Firewall up? If not, how many of these viruses would've made it through the default Windows Firewall settings? Or were these all of the "double click this attachment" variety?

• #### Re: (Score:3, Insightful)

Agreed, to know whether this is scary would require me knowing whether these were drive-by exploits or require me being stupid enough to run their virus.

I'm pretty confident in my ability to avoid the social networking sort of viruses. It's the drive-by exploits that I'm concerned about.

• #### Re: (Score:3, Interesting)

Sophos was testing Windows 7 in its default configuration. I don't know if the Firewall is enabled on a default install, but I suspect it probably is based on the defaults in XP Service Pack 3. If it's not, then the firewall is going to be irrelevant to a good number of users who are also likely to run Windows without AntiVirus on board. If it is, then it's not providing any protection to speak of, apparently.

One of the tests failed, not because Windows provided protection, but because the virus itself w

• #### Re:Firewall? (Score:5, Interesting)

on Tuesday November 03, 2009 @06:17PM (#29969326) Journal

Side thought: Of course, this WAS written by Sophos, an AntiVirus marketer. One could hardly expect them to choose viruses/worms that cast "naked Windows 7" in a good light, now could they?

• #### Re:Firewall? (Score:5, Informative)

on Tuesday November 03, 2009 @07:22PM (#29970540)
I thought it was common knowledge that viruses dont need admin to do a large number of things? I could swear this comes up every time arguments about whether linux can get viruses start. Viruses dont need admin to auto run (users can have per-user settings on that), send packets, send email, launch popups, install BHOs, install firefox addons, read files, etc etc etc.

The things "non-admin" stops are the important things, like installing drivers, installing rootkits, installing LSPs, hooking system files, patching system files, etc etc etc. THOSE are all that matters. If you have a computer set up for the family to use with a non admin account (on XP), the point isnt that you think itll prevent them from getting crapware, its that the crapware wont affect other parts of the system (hopefully).

Its also a hell of a lot easier to remove viruses installed with non-admin priveleges-- the difference is night and day. Non admin viruses usually just stick a single entry (maybe 2) in the startup list, and SysInternals Autoruns or HijackThis cleans that in about 15 seconds. Admin-installed viruses tend to take on the order of 15-30 minutes of manual removal, or booting into linux, or running combofix, or some combination of the 3, and if you screw up once and miss a file the whole thing reinstalls.

FWIW Im an IT consultant (part of my job is helpdesk) and I have yet to deal with a nasty virus / rootkit on Vista. XP on the other hand, I've seen viruses that took 45 minutes to remove even with tools like SDFix, the SysInternals suite, and launching ubuntu to manually remove the infected DLLs sorting by date.
• #### In other exciting news... (Score:5, Funny)

on Tuesday November 03, 2009 @05:46PM (#29968818)
New tests show that software written for Windows runs on Windows! Copycat studies have also shown conclusively that software written for Macs run on Macs and software written for Linux runs on Linux! More at 11.
• #### Re:In other exciting news... (Score:5, Funny)

on Tuesday November 03, 2009 @06:38PM (#29969700) Homepage

...software written for Linux runs on Linux

After years of experience, I can say that this is not always the case.

• #### Re: (Score:3, Insightful)

...software written for Macs...

You lost me here. Is there a Wikipedia entry you could point to?

• #### More data needed (Score:4, Insightful)

on Tuesday November 03, 2009 @05:53PM (#29968934) Homepage Journal
Did the account set up on Vista / Win7 have an administrator role, or was it a "normal user" account? By not disclosing that, Wisniewski is only giving us half the story.
• #### Re: (Score:3, Informative)

And another thing the "article" (and by "article" I mean "infomercial") didn't mention was how many of those malware apps successfully *infected* the machine.

Out of the 10, 2 threw an error and crashed, 8 "ran". Whats his criteria for "ran". I'm betting that means "didn't crash and burn horribly with an error message shown to the user."

I looked up the details on the first virus sophos listed (troj/fakeAV) here [ca.com] and apparently one of its actions is to add a link to the all users start menu folder here:

%Docu

• #### Is this really surprising? (Score:5, Insightful)

on Tuesday November 03, 2009 @05:58PM (#29969014)

Viruses use security holes to get onto PCs in the first place - once the virus is running on the PC, it's got free reign. There can be absolutely no security vulnerabilities on a system and the virus usually still do what it wants if it's preloaded onto the system.

You don't need administrative privileges to do many things that viruses want to do (eg. send mail, monitor keypresses). They ran the test by loading the virus onto the machine, then letting it execute. That doesn't demonstrate that the system is full of holes - it demonstrates that the system is very good at backwards compatibility!

• #### The newfie virus? (Score:3, Funny)

on Tuesday November 03, 2009 @06:06PM (#29969152)
In other news, running "sudo rm -rf /" as may cause migraines in up to 90% of linux administrators.
• #### In Test, Kdawson Posted 10 out of 10 FUD Stories (Score:5, Informative)

on Tuesday November 03, 2009 @06:07PM (#29969160)

Seriously, this guy is almost pathological in his determination to distribute as much FUD as possible about Windows.

Taco: Fire this retard. The stuff he posts is NOT news for nerds. It is thinly veiled, and ineffective, smear pieces. Real stories about OS problems are interesting. Kdawson's FUD isn't.

• #### newsflash... (Score:3, Informative)

... you can use your preferences to choose which authors you do or do not want to see stories from. If you dislike KDawson's choice of stories so much, you can opt to not display them. Hell, you have a lower UID than I do, and this feature has been available for the entire time I have been a member here. Why you don't know about it is beyond me; why you opt not to use it is even more of a mystery.

Or you can just continue trolling. The choice is yours.
• #### Big surprise (Score:5, Funny)

on Tuesday November 03, 2009 @06:11PM (#29969234)
Antivirus software vendor has reached the conclusion that you still NEED antivirus software.
• #### Missing the point of the article (Score:5, Insightful)

on Tuesday November 03, 2009 @06:14PM (#29969276)

This article is not saying Windows 7 is insecure. You couldn't even come to that conclusion if you look at what they did. They ran untrusted code known to contain viruses on a Windows 7 machine. UAC only blocked those that tried to perform administrative tasks, which is what its job is. They did not try to do remote infection.

I could write a virus attached to an executable that deleted your favorites file or all of the documents in your user's document folders. This would still be a nasty virus and would not be classified as an administrative activity, thus not triggering UAC. This would not indicate any flaw in the OS or it's level of security. This is no different from any other platform, running as admin or not, if you run untrusted code, it will be able to do anything your logged in user can do.

The point of the article is that people should not pretend UAC *is* virus protection. Microsoft doesn't market it as virus protection, and people shouldn't be under the impression that UAC prevents viruses from running.

• #### Re: (Score:3, Informative)

I could write a virus attached to an executable that deleted your favorites file or all of the documents in your user's document folders. This would still be a nasty virus and would not be classified as an administrative activity, thus not triggering UAC. This would not indicate any flaw in the OS or it's level of security. This is no different from any other platform, running as admin or not, if you run untrusted code, it will be able to do anything your logged in user can do.

It's not a virus if it doesn't replicate, it's a Trojan. Virii often using administrative functions and/or OS bugs to spread and hide. UAC should at least make some difference but it's unclear if it makes any.

• #### Re: (Score:3, Informative)

Valid point but......the plural of virus is viruses. No need to capitalize trojan either, unless you're referring specifically to The Trojan Horse or the brand of condom.

• #### It depends on how you read the article... (Score:3, Funny)

on Tuesday November 03, 2009 @06:15PM (#29969300)
It could also just as easily read: "Two out of every ten virus writers deploy their work without testing it first."
• #### You still need to run anti-virus on Windows 7 (Score:5, Funny)

on Tuesday November 03, 2009 @06:32PM (#29969578)

You still need to run anti-virus on Windows 7

There's a classic example of abductive reasoning. I do not have to run anti-virus on Windows 7 because I don't, nor do I ever plan to run Windows 7.

• #### Lesson learned? (Score:3, Informative)

on Tuesday November 03, 2009 @06:52PM (#29969992) Homepage

"Lesson learned? You still need to run anti-virus on Windows 7."

Or you could start by turning up the UAC level.

People complain that UAC in Vista was too intrusive, so MS turned it down by default. Now people are complaining that it doesn't do enough.

• #### Stupid test? (Score:5, Insightful)

on Tuesday November 03, 2009 @07:06PM (#29970264) Journal
They got some malware, and ran it. If these malware did not need elevated privileges, they are expected to run. You download a bash script from the net that goes "\rm -rf ~" and then complain that your \$home is hosed? I am not sure the test is fair. Did the malware get root privileges? Did they do any damage that simple plain process with user privilege could not do? Unless such things happened, this test amounts to nothing more than testing backward compatibility of some old binaries in new OS. Duh.
• #### But UAC works perfectly fine at frustrating me! (Score:3, Informative)

on Tuesday November 03, 2009 @07:10PM (#29970334)

Just recently had to edit the Host file. (Local DNS file).
Could not save it because of UAC, and didn't get a UAC prompt either, had to give up and disable UAC first.

• #### hmm (Score:3, Insightful)

<nomadicworldNO@SPAMgmail.com> on Tuesday November 03, 2009 @07:28PM (#29970644) Homepage
You still need to run anti-virus on Windows 7."

Or, alternately, DON'T INTENTIONALLY RUN VIRUSES ON YOUR COMPUTER. Geeze.
• #### And in other news . . . (Score:3, Informative)

on Tuesday November 03, 2009 @08:05PM (#29971226)

You still need seat belts in cars with airbags, fire departments for neighborhoods with fire resistant code compliance, and ambulances even if a doctor lives next door.

I mean, really . . . this is stupid.

• #### why is this news though? (Score:3, Informative)

on Tuesday November 03, 2009 @09:11PM (#29971982) Homepage
I dont recall seeing MS claim win7 was virus proof...
• #### Typical slashdot bias... (Score:4, Funny)

on Tuesday November 03, 2009 @09:33PM (#29972170)

This is proof slashdot is biased, do you notice how slashdoters like to pick on Windows? You'd never see an article talking about people having problems with Ubun... wait... fuck...

#### Related LinksTop of the: day, week, month.

"Someone's been mean to you! Tell me who it is, so I can punch him tastefully." -- Ralph Bakshi's Mighty Mouse

Working...