Free Microsoft Program To Battle Spyware Has Some Serious Flaws
Microsoft, whose Windows operating system has been plagued by viruses, spyware and other security problems in recent years, last week began rolling out some free software to help users cope with those threats.
The software giant introduced a "beta," or preliminary, version of a free product designed to block, detect and remove spyware. A free antivirus program is planned for later release.
Unfortunately, the company's first free security program has some serious flaws and lapses. I've been testing Microsoft's antispyware software, called simply Microsoft AntiSpyware , and I can't recommend it, in its present form, over the leading third-party antispyware program I have favored, Webroot's Spy Sweeper.
To be sure, the new antispyware program is not a finished product. It was acquired just last month when Microsoft bought a small software company, and Microsoft engineers had only a few weeks to tweak it before releasing the beta. Company officials insist they intend to fix the program's problems based on feedback from beta users, and I take them at their word. But some of the flaws in this first release are especially disturbing because they make it appear that the company may be subtly using its security software to promote its other products, at the expense of competitors.
Before getting into the details, let me say a word about Microsoft's role in protecting consumers against malicious software and other invasions of their computers. Some critics argue that Microsoft should stay out of the security-software business so as not to use its Windows monopoly to unfairly compete with third-party security vendors. But I have never believed it was inherently wrong for Microsoft to add core functions to Windows, even if they competed with add-ons sold by other companies. And I regard security as a core function. To me, the need to protect Windows users, especially consumers and small businesses without IT staffs, trumps any antitrust considerations.
Microsoft AntiSpyware , which can be downloaded at
www.microsoft.com/spyware, has a clean, clear user interface. Like Spy Sweeper, it runs in the background on your computer, blocking various spyware invasions. It can also automatically scan your PC on a schedule to detect and root out spyware.
I found the program easy to use, though downloading it was a bit of a hassle because Microsoft tries to get you to verify that your copy of Windows isn't pirated, which can force you to dig up your Windows serial number. You can avoid this step and still download the program, but you have to pay careful attention to the download options.
The software offers two kinds of scans: a quick, five-minute version, and a longer version that took about half an hour on my test machine. But the scans missed some spyware found by Spy Sweeper. In particular, Microsoft missed "tracking cookies," small files deposited by Web companies, often without your knowledge or permission, that track your online activities. The Microsoft program deliberately doesn't look for these. Microsoft officials say they are concerned that some legitimate cookies, such as those that store Web-site login information, could be unfairly labeled as spyware. They promise to add tracking-cookie detection in the future.
Even worse is the way the program handles another spyware problem, the hijacking of Web-browser home pages and search pages. This is a spyware technique in which the home and search pages in a Web browser are replaced by pages selected by a spyware company, and it's nearly impossible for a user to restore his or her own selections.
The usual way of handling this, with programs like Spy Sweeper, is to detect the page changes and to restore the user's original choices. But the Microsoft program tries to replace the spyware pages with home and search pages from MSN, Microsoft's own online service. This smacks of the same kind of coercion the spyware authors are using.
Microsoft insists it isn't trying to drive people to MSN. It says it can't tell if a user's own choice of a home or search page was "secure," so it defaults to setting the home and search pages to a site it knows is secure, its own MSN site. But the user's choice should rule here, not Microsoft's.
Not only that, but Microsoft AntiSpyware does nothing at all to protect users of the rival Firefox Web browser from home- and search-page hijacking. It detects and corrects such hijacking only in its own Internet Explorer Web browser. The company says it is trying to focus on things that affect "the largest number of customers," and it notes that the vast majority of users rely on IE. But this, too, smacks of favoritism toward Microsoft products.
Microsoft notes that the home-page restoration feature eventually learns your preferences and stops trying to insert the MSN pages. And it says it is considering changing the program's behavior in future releases to handle hijackings differently, and possibly to include Firefox.
It's good that Microsoft is finally offering users tools to protect their Windows computers. But it's going to have to do much better, and it's going to have to avoid the perception that it's using security as a tool to promote or favor its own products.
微软反间谍软件存在严重缺陷
微软(MICROSOFT)的Windows操作系统最近几年一直备受病毒、间谍软件和其他安全问题的困扰，微软从上周开始推出一些免费软件，帮助用户应对这些威胁。
该软件巨头推出了一个免费产品的试用版，该产品可拦截、探测并移除间谍软件。微软不久还将会推出一个免费的反病毒软件。
不幸的是，该公司首个免费安全软件存在一些严重缺陷和漏洞。我对微软的反间谍软件Microsoft AntiSpyware进行了测试，我不推荐使用目前的这个产品，我还是喜欢在市场居领先地位的第三方反间谍软件Webroot的Spy Sweeper。
当然，新的微软反间谍软件还不是一款最终产品。微软是上月收购一家小软件公司时才获得该软件的，微软的工程师在推出试用版前仅用了几周时间进行改进。微软管理人士坚称，他们打算根据试用用户的反馈解决软件存在的问题，我认为他们此言不虚。但是试用版存在的一些缺陷让人不胜其烦，因为该公司似乎利用该安全软件暗中推广其它产品，以此打击竞争对手。
在详细测评该软件前，我先简单评论一下微软在保护消费者免遭恶意软件袭击和其他电脑侵入行为方面发挥的作用。一些批评人士认为，微软应该远离安全软件业务，以免利用其Windows的垄断地位与第三方安全软件供应商展开不公平竞争。但是我从不认为微软为Windows增加核心功能从根本上来说是错误的，即便这些核心功能与其他公司的附加软件存在竞争。我认为安全是一个核心功能。对我而言，保护Windows用户的需要，特别是消费者和没有IT员工的小公司，超过对反垄断因素的考虑。
Microsoft AntiSpyware可以在
www.microsoft.com/spyware上下载，它的使用界面简洁明了。像Spy Sweeper一样，它在你的电脑后台运行，拦截各种间谍软件的侵入。它还可以自动扫描你的电脑查找并移除间谍软件。
我发现这个软件很方便使用，尽管下载时比较费劲，因为微软试图校验你的Windows是否是盗版，它会要求输入Windows序列号。你可以跳过这一步进行下载，但是你必须留心下载选项。
该软件提供两种扫描方式：快速的5分钟扫描和更长时间的扫描，后者在我的测试机上用去了大约半个小时的时间。但是扫描没有探测到Spy Sweeper发现的一些间谍软件。特别是，微软没有探测出“tracking cookies”，这些小文件是一些网络公司常常在你不知情或未许可的情况下放进去的，用来跟踪你的上网活动。微软软件有意不去寻找这些文件。微软管理人士表示，他们担心一些合法cookies，诸如储存网页登录信息的cookies可能也会被误认为间谍软件。他们承诺未来将增加探测tracking cookies的功能。
而关于另外一种间谍软件问题－－网络浏览器首页和搜索页面被劫持，该软件的处理方式则更加糟糕。在受到这种间谍软件攻击后，浏览器的首页和搜索页面被间谍软件公司选择的页面替代，用户几乎不可能恢复自己的设置。
通常处理此类问题的办法是，借助Spy Sweeper等类型的软件探测出页面的变动并恢复用户的原始设置。但是微软的软件则将间谍软件的页面替换成微软自身网站MSN的首页和搜索页面。这与间谍软件如出一辙。
微软坚持认为它没有试图强制人们访问MSN。该公司表示，它不能辨别用户自己设置的首页和搜索页面是否是安全的，因此它将首页和搜索页面的默认设置设为一个它所知的安全网站，即它自身的MSN网站。但是在这里，用户的选择应该第一位的，而不是微软的选择。
不仅如此，Microsoft AntiSpyware没有采取任何措施保护竞争对手Firefox的用户首页和搜索页面不被劫持。它只能探测并纠正IE中的劫持行为。该公司称，它尽量将重心放在影响大部分消费者的事物上面。但是这有些偏袒微软产品的意思。
微软指出，首页恢复功能最终会了解你的偏好并停止插入MSN页面。它表示，正考虑在未来改变处理劫持的方式，并可能会将Firefox包括在内。
微软终于向用户提供保护Windows电脑的工具是一件好事情。但是它需要做得更好，它需要避免给人留下利用安全推广或偏袒自身产品的印象。
