In Test, Windows 7 Vulnerable To 8 Out of 10 Viruses 843
As Windows 7's market share passes 3.6%, up from 1.9% the day before launch,
llManDrakell notes an experiment they did over at Sophos. They installed Windows 7 on a clean machine — with no anti-virus protection — with User Access Control in its default configuration. They threw at it the next 10 virus/worm samples that came in the door. Seven of them ran; UAC stopped only one baddie that had run in the absense of UAC. "Lesson learned? You still need to run anti-virus on Windows 7."
Not News!! (Score:2, Insightful)
Re: (Score:2, Funny)
Re:Not News!! (Score:5, Insightful)
None of the 10 they picked!
Re:Not News!! (Score:5, Informative)
Been running AVG for years, but ever since I installed SE it's caught shit in video files before they've even finished downloading. As well as a couple JavaScript attacks from websites I wouldn't think twice about visiting. I can't even remember the last threat AVG found aside from cookies.
Re:Not News!! (Score:5, Insightful)
Sure - just that you won't get a virus by running linux. I have yet (in over a decade of tending linux and bsd servers) had a single machine get infected.
Lesson learned - friends don't let friends run Windows.
Re:Not News!! (Score:5, Insightful)
I have yet (in over a decade of tending windows and NT servers) had a single machine get infected.
Lesson learned - Give the same system rights to your windows users as your Linux users have, and they can't get infected even if they wanted to.
Re:Not News!! (Score:5, Insightful)
The corollary to that rule is that many applications won't run because they're poorly architected and require administrative rights to run. Oh, sure, you can finagle around with permissions and get many of them to run, but is it really worth the time to work around broken software? (running Windows which itself is broken notwithstanding)
Re: (Score:3, Insightful)
Getting the sound card, network card, and multibutton trackball working on my Linux machine took plenty of finagling too. Just sayin', neither this cast iron pot nor kettle are LeCresuet red - they look black to me...
Re: (Score:3, Informative)
Please remember that the vast majority of hardware and peripherals are designed from the ground up to work with Windows and that most computers are sold with Windows preinstalled and preconfigured.
If you want a similar experience, I suggest buying a computer with Linux preinstalled and preconfigured. I recommend System76 [system76.com]
Re:Not News!! (Score:4, Insightful)
The Linux community, as a whole, needs to get it's story straight. (Yeah, I'll probably get modded troll, I'm okay with that).
One day I hear Linux has great hardware support. It's not like Linux in the past, we even have *BETTER* hardware support than Windows now.
Then, the next day I hear, 'Well, yeah, Linux doesn't work; but you don't have the right hardware. You need to BUY A NEW FRIGGIN MACHINE if you want to bank on Linux working without spending hours trying to get it to work.
Which is it? It can't be both.
Re: (Score:3, Insightful)
One day I hear Linux has great hardware support. It's not like Linux in the past, we even have *BETTER* hardware support than Windows now.
It does.
Linux supports hardware.
Hardware supports Windows.
Re: (Score:3, Insightful)
The claim I frequently hear is that, in order for Linux to really work as intended, you need to buy a machine with 'Linux supported' hardware.
The other claim I hear is that Linux has vastly superior hardware support than Windows.
When I said it can't be both - I meant that both of the above can't be true. You can buy any PC - even one preloaded with Linux and there is zero doubt in my mind that Windows will be able to run on that hardware.
The fact that you have to hand-pick hardware for Linux means that it
Re:Not News!! (Score:4, Insightful)
"When I said it can't be both - I meant that both of the above can't be true. You can buy any PC - even one preloaded with Linux and there is zero doubt in my mind that Windows will be able to run on that hardware."
Both can be true. I've never seen a non-preloaded windows system where windows supported all the hardware. In every case full hardware support required downloading third party drivers. Ubuntu may or may not support the hardware but if it is going to work at all, it most likely worked out of the box with no additional configuration or third party downloads required. In the few cases where they are needed the system uses detects it and prompts you to download them.
The difference might not be especially troublesome for you today but it will be when that hardware is a few years old. For instance I guarantee when many windows users "upgrade" to vista aka windows 7 their perfectly functional printers/scanners/multi-functions/digital cameras/web cams that are a few years old will have to be replaced to accommodate the upgrade. Ubuntu will continue to support nearly every piece of hardware it supported with the last release on into the future until some compelling TECHNICAL reason makes it infeasible.
Re: (Score:3, Insightful)
I think there is an understandable difference between not meeting the minimum requirements and not being able to use a device because of lack of driver support.
Crysis won't run on seven year old hardware; but that doesn't mean Crysis doesn't support that hardware.
Anyway, I certainly wouldn't disagree with the claim that 'Linux has much better support for seven year old hardware'. My objection is that the hardware support is presented as being both infinitely better than Windows *and* so bad you need specia
Re:Not News!! (Score:5, Insightful)
Please remember that the vast majority of hardware and peripherals are designed from the ground up to work with Windows and that most computers are sold with Windows preinstalled and preconfigured.
How do you design a piece of hardware "from the ground up" to work with a particular OS ?
Re: (Score:3, Insightful)
I recall the days when I would download the newest slackware, install it and spend days getting my X config just right, reconfiguring my kernel an endless number of times to get just the right balance of built in options and building modules, trying to get the hardware to work right and basking in the supreme glory of getting everything to work just right.
Some days I miss that. Other days I boot up Ubuntu and just enjoy the fact that I don't have to do shit and it supports everything but my old canon multif
Wall of Shame (Score:3, Insightful)
Slashdot should have a Wall of Shame for programs that are like this.
Kodak Easy Share is my pick.
Re:Not News!! (Score:5, Informative)
When you have little or no say in what software gets selected for use but are required to maintain local support for the same software as well as maintain the security of the network, it is not a waste of time at all. You do not give users Admin privileges. You give them the permissions they require to do their job and no more. That's basic best practice.
It's really not even that difficult to figure out. Nine times out of ten, the program either wants to write to HKLM\Software\$appname or wants to write to two or three configuration or log files in %programfiles%\$appname. About a quarter of the time (IMX) the documentation contains detailed information about what permissions are necessary. After that it's merely a case of using the various SysInternals monitors to figure out what's causing the problem. Between Xcacls and regini it's not difficult at all to script the changes. I typically maintain a single script which checks for the presence of each application and, if found, applies the necessary permissions changes.
Re:Not News!! (Score:5, Insightful)
Let's be clear here (and the same is true for anyone running Linux), you don't know that none of your machines were infected. You know thatyou never discovered an infection.
Re:Not News!! (Score:5, Insightful)
As a Windows (and Unix) System Administrator dealing with numerous users of the 'average' type, I must say giving users limited rights only work if the programs they need to run can do so within those rights.
We deal with a lot of industry specific software (ie. badly produced software) and many of the users need to have full access to absolutely everything in order for it to work, including mapped drives to the data!
Some of the users I support are absolutely mind-numbingly stupid. You tell them over and over to NOT do something and they do it again. You try and educate them on attachments and safe web browsing, and they don't care! Many of them will try all the risky things at work that they wouldn't do at home - because they know if they screw up their home computers they'll have to pay to get it fixed. At work, I fix them, someone else pays.
Re:Not News!! (Score:4, Insightful)
On Windows you can get along without AV, too. The three main vectors for malware to get on your machine are:
I have followed these practices for about ten years, without ever using AV, and I have never had malware on my machine. Avoiding AV is important to me, because I play fast-paced online games.
That said, 99% of Windows users absolutely should be using AV, because my third point (not clicking dumb) requires technical sophistication most people lack.
TL;DR: You don't need AV if you know what you're doing.
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Sure - just that you won't get a virus by running linux. I have yet (in over a decade of tending linux and bsd servers) had a single machine get infected.
... that you know of.
Re:Not News!! (Score:4, Funny)
You don't need a virus if you have Linux. Just upgrade to the next version. That will take down your machine way quicker than getting a virus...
Re: (Score:3, Insightful)
I never claimed that ISS or Apache were operating systems. You might want to brush up on your reading skills :-)
What I *did* claim was that the whole "there are more exploits because it's more popular" argument is simply not true - Apache serves much more traffic than IIS, and yet the study showed it was much less vulnerable, so the "more popular" argument isn't supported by evidence.
According to that argument, there should be more exploits the more popular instances of EVERY class of software, from ope
Re: (Score:3, Insightful)
The original person made the unsupported claim that Windows market share was solely responsible for it having more viruses and trojans. Only ONE counter-example, no matter how old, is sufficient to burst that bubble.
Correlation does not mean causation. In this case, the larger market share might correlate with the larger number of viruses, but there is no causation agent. To put it more plainly, increased market share does NOT in some way create more bugs, or the products with the smallest market share
Re:Not News!! (Score:4, Insightful)
Re:Not News!! (Score:5, Insightful)
Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get.
Yeah? Can you point to ONE virus in the wild that has ever bitten any Mac or Linux user? Trojans don't count. Install Linux on your Windows box and you do NOT need any antivirus (unless you boot into the Windows side), provided you're not stupid enough to run an executable from an untrusted source.
Re: (Score:3, Informative)
Yeah? Can you point to ONE virus in the wild that has ever bitten any Mac or Linux user?
Yes, I know it's from 2006. But it answers your question: http://www.internetnews.com/dev-news/article.php/3601946 [internetnews.com]
Re:Not News!! (Score:5, Informative)
The funny thing is the article you cite doesn't mention any virus for Linux or OS X that is in the wild. It talks about malware, which it claims is increasing, but does not list any specific item. It doesn't say if any of the malware is a virus or if any of it is propagating in the wild. You've failed in that regard.
Re:Not News!! (Score:5, Informative)
Re:Not News!! (Score:4, Informative)
Re: (Score:3, Insightful)
Trojans don't count
Why on Earth not ? The bulk of Windows "viruses" are, in fact, trojans.
Install Linux on your Windows box and you do NOT need any antivirus (unless you boot into the Windows side), provided you're not stupid enough to run an executable from an untrusted source.
I've spent nearly 15 years running Windows using this principle, without an AV problem, and - unsuprisingly - have yet to be infected by anything.
The problem is not the OS.
Re:Not News!! (Score:5, Informative)
Exactly.
From GP:
Well there go the vast majority of Windows viruses, too.
In fact, from the test they did...
- didn't run
Troj-Bredo-M
W32/Autorun-ATK
Troj/Banker-EUT
-- Ran
Troj/FakeAV-AFY
Mal/EncPk-KY
Mal/EncPk-KP
Troj/Agent-LIW
Troj/FakeAV-AFX
Troj/Zbot-JN
W32/Autorun-ATC
So 6/10 were definite Trojans (Troj/). I.e. some piece of software saying it's all sorts of good stuff, but in reality is a virus.
Then there's the Autoruns - last I knew, autorun, even on Vista, by default doesn't open a darn thing. So I guess either they changed Autorun settings, or they simply told Windows to run the program (a virus).
Lastly, the Mal/EncPk ones. They're deemed malware because they're packaging and encryption signatures that often get used by malware authors (even though they have legitimate uses, blabla). What do they envelop?
Mal/EncPk-KY: sadly sophos' site doesn't detail, but other sites will tell you that this, too, is a Trojan with Bredolab blargh.
Mal/EncPk-KP: "About this threat: The Trojan arrives as an attachment in fake e-card messages, with text as follows"
So that's 8/10 trojans, and 2/10 that might as well be classified as such unless I'm wholly mistaken about autorun.
Again GP:
That's the real issue - and one that applies to any operating system.
Not saying Windows isn't less secure.. on the other hand, I don't remember Microsoft suggesting that UAC was a 100% solution against viruses. Just against those that try to do admin-y things when you yourself aren't running as admin. That's usually the thing people point out with Linux "it can't infect the rest of the system". Well that's great - but that won't stop it from, for example, turning your machine into a spam zombie as long as the user is allowed to send e-mail.
Re:Not News!! (Score:5, Insightful)
I can't, but google can:
[...]
http://images.google.nl/search?q=osx+virus+in+the+wild [google.nl]
I guess you did not bother to actually check the search results, right?
Because I can't find any report about a real virus in the wild.
Oh, by the way, Google says Barack Obama is a Jew:
http://www.google.com/search?rls=en&q=barrack+obama+jew [google.com]
(Hint: He's not.)
The Mac threat is non-zero but overblown. (Score:4, Informative)
Hitting Google is apparently easier than doing research. I went through the articles on your "osx+virus+in+the+wild" link, and what I found on the first pages was...
None of these (except possibly Inqtana-A) would be a threat to semi-competent users, and the only article that isn't from 2006 is the garbled wiki page.
Now if you want some actual research on Mac OS X viruses, you can check a vendor's site:
http://www.sophos.com/security/analyses/viruses-and-spyware/search-results/?search=OSX&action=search&x=0&y=0 [sophos.com]
Interestingly, what the site won't tell you is that most (if not all) of these viruses are phantom menaces; you have to Google each one yourself for that kind of detail. Many are proof-of-concept never seen in the wild, and most exploit holes already patched in the OS. All are trojans that require serious PEBKAC to run, even the only two known "worms" for the plantform -- Inqtana and Tored.
Inqtana [macworld.com], a virus one that got some notoriety and media attention is an example of all three -- a proof of concept (with an expiration date) that attacked an old hole in the Bluetooth stack and which required victims to consent to accept the download from an infected machine. Tored [ca.com] was an email worm that required you to execute an attachment on a very stupid looking spam email payload. Both are basically glorified trojans -- nothing on par with Conficker.
Now, trojans aren't complete non-issues, but savvy computer users currently have very little to fear from running a Mac w/o AV software since there are currently no self-instantiating viruses for the platform in the wild. Don't download pirated software (and risk something like iWorkS which hides itself in installers for certain programs), and don't trust installers where none should be present.
Re:Not News!! (Score:5, Insightful)
Why would you need an anti-virus if you have a router whose firewall is worth a damn, have a browser that doesn't develop un-patched exploits like college kids develop acne and you don't click and run every damn executable bit of code you see on web site?
If you have a good firewall and secure applications, the only remaining way to get a virus is if you download it and run it yourself.
Virus and virus-checker free for over 8 years.
Re:Not News!! (Score:5, Insightful)
Out of curiosity, how exactly do you verify that you are infection free without a scanner? Sure, you probably don't have anything overt, like a botnet hijack, but what about less obvious things like rootkits?
You should probably take your magical ninja virus detection powers and do some consulting for those poor bastards who run Norton....
Re:Not News!! (Score:4, Interesting)
Re:Not News!! (Score:4, Insightful)
On that note, if a virus did sit idly doing nothing for years on end, why would I care that I had it?
That would already make it 10X better than running McAfee to avoid getting it.
Re:Not News!! (Score:5, Informative)
Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get.
Yep, I've been "asking for what I get", and getting what I ask for, by running Macs without anti-virus for almost 25 years now.
I use Avast Home Edition. It's free (just registration required), fast, and small-footprint.
Yeah, I'll pop that right onto my Macs, especially after reading these five-star reviews [cnet.com]. Five reviews with one star each makes five stars, right?
Re: (Score:3, Insightful)
I don't know about MacOSX malware in the wild (although any system can get trojaned), but if you've been running for 25 years that includes the old OSs, and they did have viruses. Some of them, like WDEF, were pretty virulent, and my habit of carrying my own Disinfectant diskette proved very useful. Were you just really, really careful what you exposed your system to?
Re: (Score:2)
Please tell me where I can get some of that cycle eating software for my solaris 9 sparc workstation.
100% of those viruses would have not worked on a better OS.
Re:Not News!! (Score:4, Funny)
Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get.
HAH! What else? Should Slashdotters buy boxes of condoms, just in case?
Actually, that is sort of news (Score:4, Informative)
Over the past 5 years, that's the only time I've ever run a virus check. It came up with 0 viruses. I conclude that the likelihood of me getting a virus on a mac is still small compared to my XP box, which every time I run a virus check flags *something* new as wrong/suspicious. Sometimes I can even tell if the something is innocuous or dangerous...
Slashdot likes to say that anecdotal evidence is meaningless (which of course it is), but when a sufficiently large collection of anecdotes all say the same thing, we call that consensus. The general consensus is (I believe) that Macs are a lot less likely to be infected than Windows boxes, so your 'Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get' statement is in fact news to me.
Simon
Re:Not News!! (Score:5, Insightful)
No, people who run shit they shouldn't are asking for what they get.
I don't run a real-time scanner, it's too much of a resource hog, I do let AV do an overnight scan once a week though. I've done this for years and never had a virus. Why? Because I don't run shit I know may not be safe to run. I do not open attachments I was not expecting to recieve.
It's not as if AV software is even that effective anyway, even when it does detect threats half the time it fails miserably at dealing with it and just gives the option of deleting, and sometimes some AV software doesn't even manage that. The paradigm used for AV software is that which has been used for a couple of decades, and it never even worked particularly effectively back then, let alone now that viruses have evolved whilst AV software really hasn't. Again, the best option is really to cover all the attack vectors - don't run executables you don't trust, don't have Javascript enabled on sites you can't be sure are safe, don't open attachments you weren't expecting and so on.
What's new? (Score:2, Funny)
Re: (Score:3, Insightful)
Well, yes seeing as the whole purpose to upgrade is to be able to have little or no security issues, and no need for AV.
Cancel or allow, so what, it is bypassed, so I will just stick with XP seeing as I already have my license and already have my Av on it.
M$ needs to come out with an OS that has no possibility of being owned by a virus, sort of like linux does, linux only has rootkits. Sysinternals is good for rootkit detection and is owned (now) by M$, so if they could tweak their OS to be more like linux,
Not suprising (Score:3, Informative)
For one, they watered down UAC. Second, UAC won't do anything if the virus simply attaches itself to your user account, instead of the whole system. UAC is supposed to help keep malware gaining admin rights and infecting your system, not to stop it from running.
Re: (Score:3, Informative)
For one, they watered down UAC
I did in fact RTFA, and they did NOT "water it down"; they ran it in its default configuration.
MS did by default (Score:4, Informative)
So in Vista, UAC had only two settings: On and off. When it was on the system functioned with real separate privileges. You had to escalate to perform administrative actions. Ok well people bitched and whined and bitched and whined about that since you had to do it for things like changing file permissions or accessing system control panels. Thus Microsoft relented and watered it down for 7, having two settings in between on and off. It is set to one of those by default. More or less it asks for permissions for a program trying to get admin access, but not a user initiated operation.
Re:MS did by default (Score:5, Informative)
That's why some things still require two steps. The 'first click' causes explorer (or whatever part of Windows you're dealing with) to automatically elevate and switch to a high integrity level. But since that click could have been injected by unprivileged malware, rather than an actual mouse click, the program then requires a 'second click' confirmation. Since it's running at a high integrity level now, that second click can only come from other high privilege programs or drivers. One special case is the UAC settings control panel... that places itself into a high integrity level immediately so that malware can't inject keystrokes to turn off UAC.
Re: (Score:3, Informative)
Also, on this topic...
http://www.istartedsomething.com/20090611/uac-in-windows-7-still-broken-microsoft-wont-fix-code-injection-vulnerability/ [istartedsomething.com]
You can elevate arbitrary code in Windows 7 to admin privileges with the Windows 7 default settings, no UAC questions asked, and MS won't fix that.
Re: (Score:3, Informative)
I'm shocked! (Score:5, Insightful)
Next you'll be telling me that 8 out of 10 people who have unprotected sex with HIV-positive, syphilitic, sore-encrusted prostitutes will contract some sort of venereal disease.
Re:I'm shocked! (Score:4, Funny)
And the other 2 with their left hand.
Re:I'm shocked! (Score:5, Funny)
What about ambidextrous people. I'm just asking.
Re:I'm shocked! (Score:4, Funny)
Damn it, just make up your mind people!!!
Re:I'm shocked! (Score:5, Funny)
Think of it from the wife's perspective.
They've been good and faithful for ten years, and BAM, syphyllis, HIV, and herpes.
Because they KNEW their husband wasn't a dirty cheating bastard.
Can tell you're not married. No woman who's been married for 10 years still has sex with her husband.
Re: (Score:3, Informative)
Depends on what you mean by "self propagating"? There are a number that run on macs with MS office. There were quite a few for OS9 and earlier.
Ah... Found a few references for os x virus's.
http://www.sophos.com/virusinfo/analyses/osxleapa.html [sophos.com] (spreads via ichat)
http://www.sophos.com/virusinfo/analyses/osxinqtanaa.html [sophos.com] (spreads automatically via bluetooth)
http://www.sophos.com/virusinfo/analyses/shrenepoa.html [sophos.com] (spreads to other macs on the same network)
http://www.sophos.com/virusinfo/analyses/osxinqtanab.ht [sophos.com]
Was it ever in doubt? (Score:2, Funny)
So, for (1) Windows 7 is very similar to Vista, with a lot of code reuse, and (2) the people who develop viruses target *almost exclusively* windows, so how would the need to run an antivirus on a new version of windows ever be something you would doubt?
Interesting market share stat there (Score:5, Funny)
Windows 7 had 1.9% market share before launch?
Re: (Score:2)
Businesses with volume license subscriptions had access to Win7 before it was publicly launched.
Error in summary (Score:2, Flamebait)
""Lesson learned? Don't run Windows 7."
Oh, wait, that would challenge the iron law of commercial software reviews, of not considering alternatives.
Re:Error in summary (Score:5, Insightful)
High quality! (Score:5, Funny)
Re:May require admin privileges anyway (Score:5, Informative)
So you are somewhat right, but mostly wrong. Malware could trick a trusted program into bypassing UAC and autoelevating, but after elevation the malware won't be able to interact with the trusted program anymore. And since all the trusted programs require a second user interaction before doing anything after elevation, tricking a part of Windows into auto-elevating doesn't help malware at all.
X64? (Score:2)
So which version of Windows 7 was tested? TFA does not specify. Was it X64?
Ridiculous counting (Score:2)
-Only 8 of the 10 successfully ran on Windows 7, the other 2 failed to even start
-Of the 8 that successfully started, 1 was blocked by UAC
Firewall? (Score:2, Interesting)
Was the Windows Firewall up? If not, how many of these viruses would've made it through the default Windows Firewall settings? Or were these all of the "double click this attachment" variety?
Re: (Score:3, Insightful)
Agreed, to know whether this is scary would require me knowing whether these were drive-by exploits or require me being stupid enough to run their virus.
I'm pretty confident in my ability to avoid the social networking sort of viruses. It's the drive-by exploits that I'm concerned about.
Re: (Score:3, Interesting)
Sophos was testing Windows 7 in its default configuration. I don't know if the Firewall is enabled on a default install, but I suspect it probably is based on the defaults in XP Service Pack 3. If it's not, then the firewall is going to be irrelevant to a good number of users who are also likely to run Windows without AntiVirus on board. If it is, then it's not providing any protection to speak of, apparently.
One of the tests failed, not because Windows provided protection, but because the virus itself w
Re:Firewall? (Score:5, Interesting)
Side thought: Of course, this WAS written by Sophos, an AntiVirus marketer. One could hardly expect them to choose viruses/worms that cast "naked Windows 7" in a good light, now could they?
Re:Firewall? (Score:5, Informative)
The things "non-admin" stops are the important things, like installing drivers, installing rootkits, installing LSPs, hooking system files, patching system files, etc etc etc. THOSE are all that matters. If you have a computer set up for the family to use with a non admin account (on XP), the point isnt that you think itll prevent them from getting crapware, its that the crapware wont affect other parts of the system (hopefully).
Its also a hell of a lot easier to remove viruses installed with non-admin priveleges-- the difference is night and day. Non admin viruses usually just stick a single entry (maybe 2) in the startup list, and SysInternals Autoruns or HijackThis cleans that in about 15 seconds. Admin-installed viruses tend to take on the order of 15-30 minutes of manual removal, or booting into linux, or running combofix, or some combination of the 3, and if you screw up once and miss a file the whole thing reinstalls.
FWIW Im an IT consultant (part of my job is helpdesk) and I have yet to deal with a nasty virus / rootkit on Vista. XP on the other hand, I've seen viruses that took 45 minutes to remove even with tools like SDFix, the SysInternals suite, and launching ubuntu to manually remove the infected DLLs sorting by date.
In other exciting news... (Score:5, Funny)
Re:In other exciting news... (Score:5, Funny)
...software written for Linux runs on Linux
After years of experience, I can say that this is not always the case.
Re: (Score:3, Insightful)
...software written for Macs...
You lost me here. Is there a Wikipedia entry you could point to?
More data needed (Score:4, Insightful)
Re: (Score:3, Informative)
And another thing the "article" (and by "article" I mean "infomercial") didn't mention was how many of those malware apps successfully *infected* the machine.
Out of the 10, 2 threw an error and crashed, 8 "ran". Whats his criteria for "ran". I'm betting that means "didn't crash and burn horribly with an error message shown to the user."
I looked up the details on the first virus sophos listed (troj/fakeAV) here [ca.com] and apparently one of its actions is to add a link to the all users start menu folder here:
%Docu
Is this really surprising? (Score:5, Insightful)
Viruses use security holes to get onto PCs in the first place - once the virus is running on the PC, it's got free reign. There can be absolutely no security vulnerabilities on a system and the virus usually still do what it wants if it's preloaded onto the system.
You don't need administrative privileges to do many things that viruses want to do (eg. send mail, monitor keypresses). They ran the test by loading the virus onto the machine, then letting it execute. That doesn't demonstrate that the system is full of holes - it demonstrates that the system is very good at backwards compatibility!
The newfie virus? (Score:3, Funny)
In Test, Kdawson Posted 10 out of 10 FUD Stories (Score:5, Informative)
Seriously, this guy is almost pathological in his determination to distribute as much FUD as possible about Windows.
Taco: Fire this retard. The stuff he posts is NOT news for nerds. It is thinly veiled, and ineffective, smear pieces. Real stories about OS problems are interesting. Kdawson's FUD isn't.
newsflash... (Score:3, Informative)
Or you can just continue trolling. The choice is yours.
Big surprise (Score:5, Funny)
Missing the point of the article (Score:5, Insightful)
This article is not saying Windows 7 is insecure. You couldn't even come to that conclusion if you look at what they did. They ran untrusted code known to contain viruses on a Windows 7 machine. UAC only blocked those that tried to perform administrative tasks, which is what its job is. They did not try to do remote infection.
I could write a virus attached to an executable that deleted your favorites file or all of the documents in your user's document folders. This would still be a nasty virus and would not be classified as an administrative activity, thus not triggering UAC. This would not indicate any flaw in the OS or it's level of security. This is no different from any other platform, running as admin or not, if you run untrusted code, it will be able to do anything your logged in user can do.
The point of the article is that people should not pretend UAC *is* virus protection. Microsoft doesn't market it as virus protection, and people shouldn't be under the impression that UAC prevents viruses from running.
Re: (Score:3, Informative)
I could write a virus attached to an executable that deleted your favorites file or all of the documents in your user's document folders. This would still be a nasty virus and would not be classified as an administrative activity, thus not triggering UAC. This would not indicate any flaw in the OS or it's level of security. This is no different from any other platform, running as admin or not, if you run untrusted code, it will be able to do anything your logged in user can do.
It's not a virus if it doesn't replicate, it's a Trojan. Virii often using administrative functions and/or OS bugs to spread and hide. UAC should at least make some difference but it's unclear if it makes any.
Re: (Score:3, Informative)
Valid point but......the plural of virus is viruses. No need to capitalize trojan either, unless you're referring specifically to The Trojan Horse or the brand of condom.
http://en.wikipedia.org/wiki/Plural_form_of_words_ending_in_-us#Virus [wikipedia.org]
It depends on how you read the article... (Score:3, Funny)
You still need to run anti-virus on Windows 7 (Score:5, Funny)
You still need to run anti-virus on Windows 7
There's a classic example of abductive reasoning. I do not have to run anti-virus on Windows 7 because I don't, nor do I ever plan to run Windows 7.
Lesson learned? (Score:3, Informative)
"Lesson learned? You still need to run anti-virus on Windows 7."
Or you could start by turning up the UAC level.
People complain that UAC in Vista was too intrusive, so MS turned it down by default. Now people are complaining that it doesn't do enough.
Stupid test? (Score:5, Insightful)
But UAC works perfectly fine at frustrating me! (Score:3, Informative)
Just recently had to edit the Host file. (Local DNS file).
Could not save it because of UAC, and didn't get a UAC prompt either, had to give up and disable UAC first.
hmm (Score:3, Insightful)
Or, alternately, DON'T INTENTIONALLY RUN VIRUSES ON YOUR COMPUTER. Geeze.
And in other news . . . (Score:3, Informative)
You still need seat belts in cars with airbags, fire departments for neighborhoods with fire resistant code compliance, and ambulances even if a doctor lives next door.
I mean, really . . . this is stupid.
why is this news though? (Score:3, Informative)
Typical slashdot bias... (Score:4, Funny)
This is proof slashdot is biased, do you notice how slashdoters like to pick on Windows? You'd never see an article talking about people having problems with Ubun... wait... fuck...
It's the defaults (Score:3, Insightful)
They could have at least tested it with Security Essentials . . . it's freely available to Windows users.
And yet the post at the Sophos blog says: "On October 22nd, we settled in at SophosLabs and loaded a full release copy of Windows 7 on a clean machine. We configured it to follow the system defaults [emphasis mine] for User Account Control (UAC) and did not load any anti-virus software." The point is that they installed Windows with the defaults like 99.999% of the users out there would do.
My mom is probably a typical Windows user, and when she eventually installs "the new Windows", I'm willing to bet she'
Re: (Score:3, Informative)
The facilities are there, in Windows registry and group policy for instance (Software restriction policy, I believe it is called). Some networks might even use those settings, but in general it's FAR FAR too much hassle (especially for a home user). Some software firewalls even work this way already too - I know that pay-for versions of ZoneAlarm come with signature checking of the most popular apps and allow users to black/white list them from accessing the Internet/local network.
The problem is that peop
Re: (Score:3, Informative)
A machine without AV is vulnerable to viruses!
News at 11!
Talk about a useless piece of FUD...
My Linux, Solaris, HP-UX, and OpenBSD machines don't run antivirus software. Yet they have never had a virus.
It's not the 'machine' that gets the virus, it's the badly written operating system.
Re:Best anti-virus next? (Score:4, Insightful)
So...what's the best anti-virus software for Windows 7?
Disconnect it from the network.. You asked..