Microsoft's AntiSpyware Rebranded 'Windows Defender'


Microsoft Corp.'s Windows AntiSpyware technology has been renamed "Windows Defender" and has been expanded to detect and remove rootkits, keystroke loggers and other forms of malware.




The revamped application will be bundled into the Windows Vista operating system, but users will be free to choose a competing spyware protection product from a redesigned Windows Security Center.

Jason Garms, group program manager for Microsoft's anti-malware technology team, made the announcement in a blog entry that also included confirmation that rootkit detection will be fitted into the product.


As previously reported, Microsoft will use rootkit detection technology from its Strider Ghostbuster research project.
Strider Ghostbuster is a prototype tool developed by Microsoft's Cybersecurity and Systems Management Research Group.



Click here to read more about Microsoft's rootkit detection technology.



"Our solution has really been about more than just the standard definition of spyware," Garms said. "We've always said we will provide visibility and control, as well as protection, detection and removal from other potentially unwanted software, including rootkits, keystroke loggers and more."

"Making the engineering change from 'Windows AntiSpyware' to 'Windows Defender' took a lot of careful coordination across our team to ensure that the strings in the UI got changed, the help files all got updated, registry keys, file names and properties, as well as a couple of images all got changed," Garms said.

The revamped product will be fitted with a new user interface and a significant change to the way malware signature updates are delivered.

Read more here about Microsoft's plans to bundle its anti-spyware software with Vista.


"The engine is now moved to a system service, and signatures are delivered over Windows Update. The detection mechanisms have also been radically improved by applying to spyware threats all the great detection technology we use in our anti-virus engine," Garms added.

Although the changes are being geared for Windows Vista, Garms said the enhancements will also be available to existing Windows XP users via a software refresh.


In Vista, users will be allowed to disable or turn off Windows Defender and install a third-party anti-spyware application.
The Vista Security Center will also be able to detect if an anti-spyware application such as Windows Defender is running and operating normally.



From:
http://www.eweek.com/article2/0,1895,1882440,00.asp

Rootkit Detection Coming to Windows AntiSpyware


Microsoft plans to integrate rootkit detection technology from its Strider Ghostbuster research project into future versions of the Windows AntiSpyware application, Ziff Davis Internet News has learned.

Strider Ghostbuster, a prototype tool developed by Microsoft Corp.'s Cybersecurity and Systems Management Research Group, provides a straightforward way to detect Windows rootkits by comparing scan results between a clean system and one that may potentially be compromised.


Details of Microsoft's plans remain scarce, but sources say the company has grown increasingly worried about the threat from stealth rootkits.

The integration is unlikely to happen in time for the next Windows AntiSpyware beta refresh.

Company officials declined to discuss specific plans going forward. "We have not made any public commitments to include functionality from that project in Microsoft products at this time," a Microsoft spokesperson said.
In a recent interview, Mike Nash, corporate vice president at Microsoft's Security Business and Technology Unit, was asked if the company plans to include Strider Ghostbuster in Windows AntiSpyware.

"We can't be specific about that," Nash said, adding that Microsoft was adopting "a combination of cleaning and blocking" to combat spyware.

"We need to understand that better," Nash said.

While acknowledging the importance of the threat of rootkits, Nash said Microsoft is currently focusing its anti-spyware beta on "bots."
On the Strider Ghostbuster Web page, the company has said the tool will be released either as a research prototype or as part of Microsoft products.


More here:
http://www.eweek.com/article2/0,1895,1838294,00.asp