Skip to main content

Sophos: Win 7 UAC Ineffective Against Malware

Yesterday Chester Wisniewski of Sophos said that, despite Microsoft's claims that Windows 7 is more secure than its predecessors, the new operating system disappointed in recent tests just like earlier versions. Wisniewski and the security firm claim that the User Account Control feature in Windows 7--when set at the default configuration--failed to catch eight out of ten pieces of malware.

But even though Windows 7 is more secure than Vista and XP, consumers will still need to install anti-virus software to catch all the nasties according to Wisniewski. "Windows 7 users need not feel left out," he said. "They can still participate in the ZBot botnet with a side of fake anti-virus. Windows 7 is no cure for the virus blues, so be sure to bring your protection when you boot up."

eWeek contacted Microsoft about the Sophos test. As normal, the company avoided the question in its typical pseudo-government-type-fashion and highlighted other features of Windows 7 that offer improved security. "Windows 7 retains all of the development processes, including going through the Security Development Lifecycle, and technologies that made Windows Vista the most secure Windows operating system ever released," a Microsoft spokesperson said.

Wisniewski's reports that the test did not include additional, installed anti-virus software. Instead, the company tested Windows 7 with UAC on and UAC off. Two malware samples used in the test would not run in Widows 7: Troi/Bredo-M sn Troi/Banker-EUT. Out of the remaining eight, one malware sample provided a prompt.

As we all say, the best defense against maleware starts at the person sitting behind the keyboard.

  • lenell86
    nothing new to report, everyone knows windows fails without a proper AV/Firewall...
    Reply
  • anamaniac
    "As we all say, the best defense against maleware starts at the person sitting behind the keyboard."

    First off, thank you.
    Second off, how hard is it to use a spell checker?

    Running no AV and going just fine myself. For 11 months now.
    My bros comp is running the Microsoft AV. Be nice if Win7 actually came with their OneCare (or whatever it's called).
    Reply
  • cyprod
    Wow, imagine that. A guy who works for an AV company says Windows 7 needs AV software.
    Not going to argue the correctness of the statement, but just saying...
    Reply
  • zelannii
    File under "Duh".

    We all know Windows has a farly useless security model on its own, with so many holes to fill the only fix is to rewrite it from scratch and give up on backward compatabiltiy.

    Also as others have pointed out, considder the source! Just the same as Symantec and Trend slammed microsoft's free AV as being weak (even though it stopped more of the top 100 ITW viruses than their own product).
    Reply
  • Camikazi
    anamaniac"As we all say, the best defense against maleware starts at the person sitting behind the keyboard."First off, thank you.Second off, how hard is it to use a spell checker?Running no AV and going just fine myself. For 11 months now.My bros comp is running the Microsoft AV. Be nice if Win7 actually came with their OneCare (or whatever it's called).You know if MS were to add OneCare of Security Essentials to default install they would get sued just like they did for bundling IE.
    Reply
  • Scotteq
    Hmmm.. I wasn't aware that User Access Control was being touted as a replacement for Anti-Virus. Let me check on that...



    Nope - UAC has not been advertised as a replacement for proper AV protection. Next non-story, please.
    Reply
  • hellwig
    Windows 7 needs AntiVirus? No way, the latest OS is 100% secure and can never get a virus, so no AntiVirus needed!

    Oh wait! That's Apple's stance on OSX, not Microsoft's. My bad.

    I'm pretty sure Microsoft acknowledges the need for Antivirus. Hell, when I installed the Win7 RC, it directed me to a website that offered various 3rd-party antivirus packages. And if I'm not mistaken, Microsoft has started releasing its own AV software too, right?

    I mean, who ever said Windows doesn't need AntiVirus? Only someone who never connects their computer to any kind of network and never plugs in a flash drive or other portable storage into their machine.
    Reply
  • audioee
    Remember, most problems with computers happen between the chair and the keyboard.

    A computer is only as smart as the person using it.
    Reply
  • htoonthura
    well... i see pc with sophos infected so many times. so stop bashing windows.
    Reply
  • doomtomb
    A Sophos test showed that Windows 7 users stiil need additional anti-virus software.
    Kevin Parrish, it's called spell check. When you publish an article on a popular tech news website, maybe you should think about using it.
    Reply