Support Ended for Windows Live OneCare and Safety Scanner

It is hard to believe that it has been two and one-half years since sales of Windows Live OneCare were discontinued and Microsoft announced it was discontinuing Windows Live OneCare.  When the announcement was made, Microsoft indicated that support was continuing for existing subscribers.

The end of support has now arrived.  Updates ended for Windows Live OneCare on April 11, 2011.  Active subscribers were sent several in-product and email communications advising them of the ending subscription and support dates. In addition, depending on your subscription end date, billing support ends on or before June 30, 2011.

Accompanying the demise of Windows Live OneCare is the Windows Live OneCare Safety Scanner.  Much like Windows Live OneCare, which included non-security features such as printer sharing and automated PC tune-up, in addition to scanning for viruses, spyware and potentially unwanted software, the Safety Scanner included "Tune Up" and "Clean Up" scans.

If you still have Windows Live OneCare installed on your computer, prior to replacing it with a new antivirus software, consider using the Windows Live OneCare Backup Restore Tool to recover backed up files.

The replacement for the Windows Live OneCare Safety Scanner is the Microsoft Safety Scanner, a no-frills scanner to help remove viruses, spyware, and other malicious software. 

Additional information you may find helpful:

• How to Use the New Microsoft Safety Scanner
• Understanding Microsoft Anti-Malware Software

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Windows Live OneCare Ending, Morro No-Cost Replacement

Microsoft announced today that the company is discontinuing Windows Live OneCare (WLOC), although support will continue for current WLOC subscribers until the subscriptions expire. WLOC is an all-in-one suite that includes a number of non-security features that most subscribers ignored (i.e., printer sharing and automated PC tune-up).

I am wondering if the indication in the PressPass announcement that "Morro" will be a stand-alone download providing malware protection for the Windows XP, Windows Vista and Windows 7 operating systems implies that Morro will supplement or replace Windows Defender. Since Morro won't be available until the second half of 2009 (perhaps introduced with Windows 7?)


PressPass Announcement:

Code-named “Morro,” this streamlined solution will be available in the second half of 2009 and will provide comprehensive protection from malware including viruses, spyware, rootkits and trojans. This new solution, to be offered at no charge to consumers, will be architected for a smaller footprint that will use fewer computing resources, making it ideal for low-bandwidth scenarios or less powerful PCs.
. . .

“Because uptake of standard anti-malware is low around the world, particularly in developing nations, the availability of basic protection for anyone who wants it is all the more important,” said Roger Kay, founder and president of Endpoint Technologies Associates. “By offering such basic protection at no charge to the consumer, Microsoft is promoting a safer environment for PCs, service providers and e-commerce itself, since it is through unprotected PCs that the worst threats are introduced to the system as a whole.”

“Morro” will be available as a stand-alone download and offer malware protection for the Windows XP, Windows Vista and Windows 7 operating systems. When used in conjunction with the ongoing security and privacy enhancements of Windows and Internet Explorer, this new solution will offer consumers a robust, no-cost security solution to help protect against the majority of online threats.

Hat tip: Paddy

References:

• PressPass: Microsoft Announces Plans for No-Cost Consumer Security Offering
• PressPass Q&A: Improving Global Access to Core PC Protection
• WLOC Team Blog: Consumer Security Strategy Update

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Antivirus Product Removal Tools

(Last Update 28Aug2013)

Kurt Wismer certainly got it right in anti-virus rants: av product removal tools when he said:

"on the subject of doing your job horribly wrong, i think we can all agree that both symantec and mcafee are doing their job of providing quality anti-malware software horribly wrong when you consider they make removal tools to get rid of their own products..."

Providing help on the forums, I frequently see logs with left-overs from incomplete uninstalls of Symantec. However, in researching the most widely used subscription antivirus softare, Norton and McAfee are apparently not the only vendors who have found it necessary to provide removal tools in order to completely remove their software products.

Below are links to the removal tools and instructions available. If not listed, the software should be completely removable through Control Panel -> Add/Remove Programs, as shown in the instructions. Follow the removal with a shutdown/restart of the computer.

To uninstall from Windows XP:

1. Click Start, then click Control Panel.
   
2. Under Pick a category, click Add or Remove Programs.
   
3. Under Pick a task, click Remove a Program.
   
4. In the Currently installed programs list, click the software being uninstalled and then click Remove.

To uninstall from Windows Vista or Windows 7:

1. Click the Vista Orb, then click Control Panel.
   
2. Click Programs and Features.
   
3. In the Uninstall or change a program list, click the software being unisntalled and proceed with the uninstall.
   

If the software was not completely removed the removal tools provided by the vendors can be found at the links below. It is, however, advisable to use the built-in uninstaller first.

Another option is the Microsoft Fix it solution available here. 

1. avast!:  http://www.avast.com/eng/avast-uninstall-utility.html
2. AVG: http://www.avg.com/us-en/utilities
3. Avira AntiVir: Uninstall via control panel, restart and then use the Avira RegistryCleaner
   
4. BitDefender:  http://kb.bitdefender.com/KB333-en--How-to-uninstall-BitDefender.html
5. CA Associates:  See Total Defense
6. Comodo Internet Security:  https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=298
7. Cyber Defender Early Detection Center:  http://cyberdefender.custhelp.com/app/answers/detail/a_id/207
8. Dr. Web  http://www.comss.ru/page.php?id=309, Registered users only:  https://support.drweb.com/support_wizard/?lng=en 
9. eScan: Direct download link: http://www.microworldsystems.com/download/tools/esremove.exe
10. ESET:  http://kb.eset.com/esetkb/index?page=content&id=SOLN2788
11. FRISK F-PROT:  http://www.f-prot.com/support/windows/fpwin_faq/25.html 
12. F-Secure: Direct download link: ftp://ftp.f-secure.com/support/tools/uitool/UninstallationTool.zip 
13. G Data:  https://www.gdatasoftware.co.uk/?eID=PushFile&dl=f4b2f2fd23%3AAFEIBgU%3D
14. Kaspersky Lab's Removal Tool:  http://support.kaspersky.com/faq/?qid=208279463
15. K7 Total Security: Direct download link: http://www.k7computing.com/en/tools/K7RT.exe
16. Lavasoft:  http://www.lavasoftsupport.com/index.php?showtopic=28 
17. McAfee Removal:  Direct download link: http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe
18. Microsoft Security Essentials:  http://support.microsoft.com/kb/2435760
    
19. Norman Antivirus: Direct download link: http://download.norman.no/public/Delnvc5.exe
20. Norton Removal:  https://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?lg=english&ct=united+states&docid=20080710133834EN&product=home&version=1&pvid=f-home
21. Panda Antivirus (All Versions): Direct download link: http://www.pandasecurity.com/resources/sop/UNINSTALLER_08.exe
22. Sophos:  http://www.sophos.com/support/knowledgebase/article/11019.html
23. Total Defense:  http://totaldefense.iyogi.com/?p=368
24. Trend Micro: http://esupport.trendmicro.com/1/How-do-I-remove-old-or-new-versions-of-Trend-Micro-products-in-my-comp.aspx
25. Vipre (Sunbelt Software) http://kb.gfi.com/articles/Skynet_Article/Error-1612-Installation-source-for-this-product-is-not-available-when-attempting-to-uninstall-VIPRE
26. Webroot:  http://support.webroot.com/cgi-bin/webroot.cfg/php/enduser/std_adp.php?p_faqid=1761
27. Windows Live OneCare: Direct download link: http://download.microsoft.com/download/4/c/b/4cb845e7-1076-437b-852a-7842a8ab13c8/OneCareCleanUp.exe 
28. Zone Alarm: Direct download link: http://download.zonealarm.com/bin/free/support/download/clean.exe

Edit Notes: Can't find an uninstaller? Check the lists maintained by Fred de Vries at Singular Labs:

• List of Security Software uninstallers
• List of Driver uninstallers
• List of Pre-Installed Software uninstallers
• List of Other Software uninstallers

If the Microsoft Fix it does not solve the problem, an alternate option is to use AppRemover.  See AppRemover.

Additions:

1. Edit Note: Thank you, Clark76! AVG Added.
2. Edit 02Oct08: avast! removal tool added. Thanks, Ripley. This Song's for you!
3. Edit 10Oct08: Bit Defender and F-Secure added. Thanks to GravityGripp, the developer of one of my favorite Firefox Add-ons, Malware Search.
4. Edit 15Nov08: McAfee and BitDefender links updated.
5. Edit 14Dec08: Added Norman Antivirus. Info provided by Cel.
6. Edit 24Jan09: Added ESET NOD32.
7. Edit 14Jul10: Added reference to Ultimate List of Uninstallers.
8. Edit 06Jun12: Updated AVG (Thanks R-C!)  and other broken links, Added many additional products as well as Singular Labs lists and added AppRemover.
9. Edit 08Aug13: Updated broken links.
   

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Malware Protection Center (MMPC) Blog

If you are looking for the Anti-Malware Engineering Team blog, they have moved. In fact, not only have they moved, but they have a refreshing new look and a more fitting title: Microsoft Malware Protection Center Blog (MMPC). Vinny Gullotto introduced the team in the initial post:

"The MMPC is the team that builds Microsoft’s anti-malware and ant-spyware tools and technologies; you’ll find our work powers all of Microsoft’s antimalware and antispyware tools and products such as the Forefront suite of products and Windows Live OneCare as well as in free tools and utilities such as the Malicious Software Removal Tool (MSRT), Windows Defender (built into Windows Vista) and the Windows Live OneCare safety scanner."

To top it off, it looks as though Matt McCormack will be a regular contributor at MMPC, continuing from his initial post to tell us Taterf – all your drives are belong to me!!!1!one! In addition to providing information on Taterf, Matt's post includes a special message to all you gamers:

"As a PC gamer (RPGs and First Person Shooters on consoles just seems wrong to me...), and somewhat of a performance junkie myself, I get why many gam0rz don’t run AV. But seriously, a good AV product shouldn’t affect your FPS that much (if you’re chronically being pwned, don’t blame your AV and FPS - just l2p). Also, many gamers are in a higher risk category – downloading dodgy copies of games and the cracks to match, make you much more likely to get infected (NEWSFLASH: Not all cracks are actually cracks)."

Don't forget to update your RSS feed. You don't want to miss the next report in the MMPC Blog.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Lavasoft Addresses Conflict with Windows LiveOneCare (Not!)

It appears that a 31Jan08 update to Windows Live OneCare (WLOC) has resulted in the Ad-Aware 2007 service being seen as a conflict.


Conflicts do occur between security software programs and someone with an all-in-one suite such as Windows Live OneCare needs to consider this when adding another security software, particularly when that software includes a service. (Note for example that Spybot Search & Destroy does not include a service.)

According to responses posted in the help topic at the Lavasoft Support forums, Lavasoft has been working to resolve the problem. Understandable, a new issue arises and it is necessary to determine the source of the conflict, working with the other vendor if needed.

I am rather confused about Lavasoft's method of "working" on the problem. Rather, there seems to be more rudeness and sarcasm involved than helpful information for their customers. Today LS Tobias referred Lavasoft customers to the latest blog post by Lavasoft's VP of Marketing, Michael Helander, copied in part:

Microsoft Bullies

by Michael on February 13th, 2008 in Industry and Security News.

For those of you who are old enough to remember Roseanne Roseannadanna on Saturday Night Live, ”My father always used to say, it’s always something. If it’s not one thing, it’s another”

Microsoft is pushing their weight around. We’ve got Ad-Aware customers contacting us left and right because Microsoft is telling them to uninstall their Ad-Aware software in order to run Windows Live OneCare “security software” (the quotation marks are mine).

Some article title: "Microsoft Bullies"! LS Tobias tells Lavasoft customers that they are working with Microsoft and the VP of Marketing refers to them as bullies. Now that is class (not).

I suppose Marketing VP's get away with being snippy, as in the "(the quotation marks are mine)" in reference to Windows Live OneCare security software.

Also from the Lavasoft blog post:

I guess it always takes two MS people to get your issues resolved?

Smart remarks do not solve issues. But this takes the cake:

Thank you for that wonderful explanation, but isn’t Windows the reason that companies like ours are in business in the first place?

No, Michael, "Windows" is not the reason why Lavasoft is in business. Nicolas Stark is the reason Lavasoft is in business when he took over the original "opt-out" program from Steve Gibson. The malware purveyors keep companies like Lavasoft in business.

It is not uncommon for a security software vendor to point out conflicts between their software and that of another. Trend Micro even includes their own products as well as Ad-Aware as necessary to be uninstalled. See EN-1035951.

The conflict is explained at the WLOC forums as follows:

"As mentioned earlier, Ad-Aware 2007 has changed from previous versions in that it now operates as a service that runs at boot time of the PC. This is discussed on the Lavasoft Support forums at the folllowing link.

http://www.lavasoftsupport.com/index.php?showtopic=9893

Though the free version of Ad-Aware 2007 doesn't include the associated Ad-Watch real-time active mode protection, this service is still loaded at boot time to provide the application with elevated rights to cope with malware, even when the logged in user has limited rights themselves.

Though this choice makes sense for the more effective removal of malware, it creates a new problem. The issue is that when Ad-Aware detects malware the service will attempt to 'take control' and remove the infection, which makes sense by iteself. However, if another anti-malware application also exists on the PC, it may also detect the same malware with its real-time protection at the same moment. Now you have an issue where two programs are competing to remove the same piece of malware at the same moment, i.e. a conflict."

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Making sense of Microsoft malware protection

Not long ago, I posted Understanding Microsoft Updates and had thought to follow-up with a post on the available Microsoft malware protection software. In the interim, I discovered that fellow MVP Mark Burnett has done just that, providing

"a breakdown of Microsoft’s client protection offerings in an attempt to help you understand what might be best for you"

Most of the offerings are free. Particularly if you are not familiar with the Microsoft Malicious Software Removal Tool or the Microsoft OneCare Safety Scanner, I encourage you to read Mark's post, Making sense of Microsoft malware protection.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Windows Live OneCare Passed VB100 Test

In February I reported that Windows Live OneCare failed the VB100 test. Obviously, the Windows Live OneCare Team took that in stride as they were regathering their forces with Vincent Gullotto, recently wooed from McAfee's AVERT team at the helm. Add to that the security research centres in Europe and Asia. Indeed, they have really worked hard and turned things around.

Now, soon after moving up the list a bit in AV-comparatives.org testing, re-certification from West Coast Labs and the ICSA Labs, Windows Live OneCare passed Virus Bulletin's VB100 test. Note, Microsoft Forefront also passed.

What is interesting are names listed as "failures" this time through, including some of the "big names" in the industry. I wonder if they will receive the same publicity that Windows Live OneCare did in February?

FAILED:

• Agnitum Outpost Security Suite Pro 2007 5.1214.616

• Doctor Web Dr.Web 4.33.3.04230

• F-Secure Protection Service for Consumers 7.00

• Grisoft AVG 7.5 Professional Edition

• Kaspersky Anti-Virus 6.0.2.621

Windows OneCare Re-Certified

Good news for the Windows OneCare Team. The West Coast Labs and the ICSA re-certified OneCare. According to the Windows OneCare Blog:

". . .one of the reasons certification from West Coast Labs and the ICSA is considered significant is that their testing methodologies reflect malware threats “out in the wild.” Testing in this manner provides an accurate indication of how security products perform against real world threats."

Windows OneCare is Windows Vista compatible on 32-Bit systems.

References:

Windows Live OneCare - Home
Windows OneCare - Blog

The Microsoft Anti-Malware Team Lives!

When the first report was issued that Windows Live One Care failed an antivirus test, I was more upset that we had no statements, updates, or any type of information from the Microsoft Anti-Malware Team in many months, let alone any comment, explanation, or path forward with regard to the test results. After all, veteran McAfee failed the same test.

A short time ago, however, I had a wonderful surprise when I decided a check of my RSS feeds would be a good companion to the New England Clam Chowder that I picked up from the cafeteria for lunch. There before me was (finally) an indication of a new entry in the Microsoft Anti-Malware Engineering Team blog!

Jimmy Kuo, Microsoft Security Research & Response team (MSRR), addresses the concerns raised with regard to the detection capability of Windows Live OneCare. What I particularly like about Jimmy Kuo's post is that it is in "normal English", not "Geek-Speak". This is important to me because my focus is on the home PC user -- the very people who are likely to consider Windows Live OneCare for their computer. I can point to his explanation with confidence that my readers will not get lost after the first sentence.

That said, without further adeau, I encourage taking a few minutes to read "Hello World" by Jimmy Kuo.

Update: Although MIA since the end of January, the Windows Live OneCare blog team has also posted today. See Update from OneCare. I hope we are seeing a come back.

Microsoft Security Team Expansion

Wooing Vincent Gullotto away from McAfee's AVERT team has begun showing positive results. As reported at Computerworld, Mr. Gulloto discussed Microsoft plans to open new security research centres in Europe and Asia at RSA last week.

The plan is to use the centres to provide 24-hour monitoring of emerging security threats. Such monitoring will also provide faster access to threats for Windows Live OneCare. The European head of operations will be Katrin Tocheva, formerly a malware researcher at F-Secure.

Referring to the failure of OneCare to pass the VirusBulletin VB100 test, Mr. Gullotto was quoted as explaining:

"We missed one virus in their collection. While missing one virus isn't huge, it is not a good thing either. It can put the thinking into the mind of folks that we can't keep them protected."

Let's face facts -- whether an anti-malware, anti-trojan or anti-virus software, all vendors have an occasional false/positive and no software will have every variant of every virus, trojan, or other nasty-ware in detection. Microsoft's new security research centres will certainly go a long way toward placing OneCare in excellent position to at least have all major variants in detection.

Windows Live OneCare Failed VB100 Test

In a report by BetaNews, it was indicated that a Microsoft spokesperson confirmed that Windows Live OneCare antivirus failed a test conducted by Virus Bulletin. Windows Vista Business Edition was the operating system used in the test. The BetaNews report confirms the report I read by F-Secure a couple of days ago that also stated Microsoft Live OneCare for Vista did not get the VB100.

This is the statement from Microsoft Representative as quoted from BetaNews:

"We are looking closely at the methodology and results of the test to ensure that Windows Live OneCare performs better in future tests," the Microsoft spokesperson told us, "and, most importantly, as part of our ongoing work to continually enhance Windows Live OneCare to ensure the highest level of protection and service that we can provide our customers. As we have more information to share from our review of this particular test moving forward, we will keep you updated via our anti-malware blog." {bold added}

I have a problem with that statement by the Microsoft spokesperson. Over the past year, communications by Microsoft staff have been on a rapid incline and, I might add, very appreciated. There is one area that I follow, however, where there has been a distinct lack of communication. That is the Anti-Malware Blog. As of this posting, the most recent entry in that blog is October 30, 2006. That gives me the feeling that we won't be seeing much information sharing in the near future.

On a positive note, there were a number of anti-virus software programs that did pass the test by being able to positively detect a series of known viruses without a false positive, in as many as three trials on two separate machines. The combined list from the BetaNews and F-Secure reports of products that passed the test includes:

• Avast
• AVG
• CA's Home and eTrust (enterprise) products
• Fortinet's FortiClient
• F-Secure Anti-Virus
• Kaspersky Anti-Virus 6.0
• NOD32
• Quick Heal
• Sophos Anti-Virus 6.5
• Symantec AntiVirus 10.2

Two other failures were McAfee's VirusScan Enterprise 8.1 and the Norman Virus Control. There are plenty of options to select from if you are looking for a new antivirus software for Vista.