Jan 3rd, 2008
Making sense of Microsoft malware protection
In case you haven’t noticed, in the last few years Microsoft has released a number of different client protection tools. First it was Windows Defender, then OneCare, and now we are seeing a big push on the Forefront product line. In fact, there are a number of tools that provide overlapping client protection.
Here’s a breakdown of Microsoft’s client protection offerings in an attempt to help you understand what might be best for you:
Malicious Software Removal Tool
The free Malicious Software Removal Tool cleans up computers infected with the most common or most active malware threats. Microsoft updates the tool with each monthly patch cycle therefore you must always download the latest version . The tool simply cleans up common malware that might already be on your system.
The tool does not provide malware protection, only addresses the most prevalent threats, and does not scale well and therefore is not a great long-term security solution. It does, however, provide a quick cleanup that might be necessary in some cases.
The OneCare Safety Scanner is a free online tool that scans for and removes viruses and spyware and then performs a few system checks. These system checks include a disk cleanup, defragmentation check, and registry cleanup. The tool also performs a port scan on your system to check for open ports.
The OneCare Safety Scanner is a quick and easy solution for inexperienced consumers and it’s a great place to send your neighbors who call you asking for help getting rid of some malware.
Internet Explorer 7 provides better overall security than previous versions of IE and has several new security features. IE7 includes a phishing filter to warn of potential fishing attempts, better spyware protection, and a pop-up blocker.
Windows Defender–now included as part of Windows Vista–provides spyware protection and cleanup. Although it works well for consumers and business users, it does not provide any centralized management.
Windows Live OneCare is a combination software and paid online service that provides virus, spyware, and phishing protection. It keeps your hard drive defragmented and clean from unnecessary files, cleans the registry, and makes sure you always have the latest patches from Microsoft installed. It also provides regular backups of your important files to a second location, such as another hard drive or a CD-ROM.
Windows Live OneCare tries to run continuously and quietly so it is a great solution for consumers.
Microsoft Forefront Client Security is the most comprehensive, most configurable, and best manageable client security product. If you manage more than a dozen systems, you would definitely benefit from the centralized management and control features that Forefront provides. You can control Forefront Client Security settings through Group Policy and it integrates well with WSUS for distributing signature updates to client systems.
So what does this all mean? Well this is how I would break it down:
- If you are a consumer, visit the OneCare Safety Scanner site periodically and do a scan. If using XP or Windows 2003, install Windows Defender and IE7. Keep up-to-date with Automatic Updates.
- If you are a consumer and don’t mind spending some extra money, go with the full OneCare service.
- Small organizations with limited IT support should have users visit the OneCare Safety Scanner site periodically and do a scan. If using XP or Windows 2003, install Windows Defender and IE7. Keep up-to-date with Automatic Updates.
- Larger organizations should use Forefront Client Security, Windows Defender, and IE7. Use WSUS or another patch management product to keep systems up-to-date.
