Windows AntiSpyware revamped, now "Windows Defender"

aidan_walsh

http://www.eweek.com/article2/0,1759,1882440,00.asp?kc=EWRSS03119TX1K0000594

Microsoft Corp.'s Windows AntiSpyware technology has been renamed "Windows Defender" and has been expanded to detect and remove rootkits, keystroke loggers and other forms of malware.

The revamped application will be bundled into the Windows Vista operating system, but users will be free to choose a competing spyware protection product from a redesigned Windows Security Center.

Jason Garms, group program manager for Microsoft's anti-malware technology team, made the announcement in a blog entry that also included confirmation that rootkit detection will be fitted into the product.

As previously reported, Microsoft will use rootkit detection technology from its Strider Ghostbuster research project.

Strider Ghostbuster is a prototype tool developed by Microsoft's Cybersecurity and Systems Management Research Group.

"Our solution has really been about more than just the standard definition of spyware," Garms said.

"We've always said we will provide visibility and control, as well as protection, detection and removal from other potentially unwanted software, including rootkits, keystroke loggers and more."

"Making the engineering change from 'Windows AntiSpyware' to 'Windows Defender' took a lot of careful coordination across our team to ensure that the strings in the UI got changed, the help files all got updated, registry keys, file names and properties, as well as a couple of images all got changed," Garms said.

The revamped product will be fitted with a new user interface and a significant change to the way malware signature updates are delivered.

"The engine is now moved to a system service, and signatures are delivered over Windows Update. The detection mechanisms have also been radically improved by applying to spyware threats all the great detection technology we use in our anti-virus engine," Garms added.

Although the changes are being geared for Windows Vista, Garms said the enhancements will also be available to existing Windows XP users via a software refresh.

In Vista, users will be allowed to disable or turn off Windows Defender and install a third-party anti-spyware application.

The Vista Security Center will also be able to detect if an anti-spyware application such as Windows Defender is running and operating normally.

Uh-oh, spaghettios... How well is this news likely to sit with the current vendors, I wonder? Great news that its been expanded further than "traditional spyware", but does it do anything current programs don't?

I don't like the idea of relying on Windows Update to push the updates, a lot of people don't use WU as it is, thus leaving them more likely to be open to attack than users of an automatically updating application (of course, a lot of people don't use anything at all, so much of a muchness really). Are sigs only going to be pushed once a month, then? Hardly going to be keeping users on the cutting edge, are they?

Also, no Windows 2000 support?