Virus Updates and PC Mode

[emmjay]

Security Note...

If you use MSE (Microsoft Security Essentials)  the virus definition files will not update if you put your system into SLEEP, HIBERNATE or STANDBY mode.  MSE virus definition files update every day and even sometimes several times a day to keep your system safe from attack.

Microsoft is aware of this problem and have been working on it since November 11, 2009. No fix as yet.

If you are using MSE, make sure you either MANUALLY update the virus definitions every day or SHUTDOWN your system after use.  After a shutdown/reboot or restart the definition files update.

I will post to this location once I find out more. More details at:   social.answers.microsoft.com/forums

[emmjay]

As promised...an update:      Applies to WIndow 7, Vista and XP

New release 1.0.1961.0  ( 2/3/2010), laptops & desktops using hibernate/sleep:  problem still not addressed.

N.B.: You can not upgrade to the latest release of MSE by selecting   'UPGRADE'  from the dropdown menu beside 'help'.  If you want the new version, you have to reinstall MSE all over again, or wait for the upgrade to come down via windows updates.

Temporary Workaround for sleep/hibernate:  Reset  your power settings to keep your PC awake.   

There is a MSE  catchup utility that checks your system every 24 hours to see if your virus definitions have updated.  Apparently this is the problem.  Some users are also experiencing problems with scheduled scans. These are either not running on schedule or not at all.

Temporary Workaround for Updates and Scans:.

Download splinterware scheduler (freeware).  Follow these setup instructions:

1. Open a new event. 

2. In Application, enter:        c:\program files\microsoft security essentials\MpCmdRun.exe

3. In Parameters, enter:     SignatureUpdate

4. Go to Schedule, enter:   Daily     enter a time that suits you.. Save/exit

for scans:

1. Open another event

2. In Application, enter:      same as above

3. In Paramters, enter        Scan 1  (quick scan)   or   Scan 2  (full scan)

4. Set your schedule, save/exit

NB: you obviously have to be online for MSE to update.

[emmjay]

It appears that Microsoft  has made some changes in the latest release of MSE, however as they do not provide a change- log for each new release it is impossible to identify what changes they have made or not made.

What appears to have  not changed:  The 7 day update cycle maintained by the catch-up utility in MSE is still in effect. So if your system has not updated the virus definitions in several days, the MSE icon will turn orange and you will be instructed to update the virus definition files manually  (the same time 7 day period applies to scanning your system for viruses).

Automated Updates:  If you have set the PC power options to keep your system awake for at least 12 hours you do not need to use the provided scheduler work-around anymore (see previous post). N.B.: Some PC's do not have this option in the power settings so you will have to stay with the workaround.. MSE has not announced that they have a fix for the sleep/hibernate problem as yet, so this is the best work-around for the time being. You can do a registry hack to get the same result, but I would recommend against it.

MSE Settings:  In the latest release of MSE, automated updates are now pretty close to the time you set (sometimes an hour before, sometimes within an hour after). I suggest that if you do not care about the updates or scans being automated, just hit the 'UPDATE' button when it suits you. This is a bit of a crap shoot because the bad guys are out there  24/7 and your system can be compromised  within seconds. Daily updates are highly recommended.  

Here is the recommended  MSE Settings for the best protection (Go to the Settings Tab) ...

Scheduled Scans

Open MSE > go to Settings > Put a check in 'Run a scheduled scan on my computer'

Select  'Daily'  >  pick a time you will be online >  select a scan type (quick is recommended)

Put a check in 'Check for latest virus and spyware definitions before running scheduled scans

DO NOT CHECK 'Start the scheduled scan when my computer is on but not in use'

Real Time Protection

Check real time protection and the next 2 items on this setting.

Save

Run a full scan once a week  (manually). No need to automate this activity.

Make sure you have Windows Firewall enabled. Do not turn it off.

NB:  If you are using Norton or any other heuristics antivirus application (in real time), DO NOT USE MSE. Applications such as Norton have their own firewall so turn off windows firewall as well. If the AV does not have its own firewall you can use windows firewall or a 3rd party firewall.

I'll keep this post updated ( unless you prefer I bug off).

[MrPeter1985]

For best free system protection use the following. I do. And I never getting anything. If for some reason I do it does not stay long. LOL. I use MSE, AVAST, and ZONEALARM. If you have 2gigs of ram then you will not have a problem using these 3 together. For those who download the best extra protection is peerblock. You will be surprised at who you see it blocks. And if someone gets hit bad with spyware like all those old and new rogue AV use SUPERANTISPYWARE portable. It's free and I guarantee it will clear it fast. It loads under random file names each time it starts to hide from spyware that look and hide from spyware removal tools. Trust me it's way better and faster than spybot and malwarebytes. It also does not require to install anything nor needs to run in safemode.

[MrPeter1985]

Here's the links to following. SAS portable http://portable.superantispyware.com/sassaferun.php ZONEALARM http://download.cnet.com/ZoneAlarm/3000-10435_4-10039884.html?part=dl-69168&subj=dl&tag=button PEERBLOCK http://www.peerblock.com/releases/public-releases/peerblock-1.0.0-r181 MSE http://www.microsoft.com/security_essentials/?mkt=en-us AVAST http://www.avast.com/free-antivirus-download let me know what you guys think. try'em out you'll like'm too.

[emmjay]

I agree that there are excellent freeware security products out there. Avast  comes very highly rated and does an excellent job of keeping your system safe. Along with MSE I have Superantispyware, Malawarebytes and WinPatrol installed.  Each of these products perform different functions.   However, please take note of the following...

•  if you have installed several antivirus, anti-malware, anti-spyware applications, you should use only one of them at a time.  That is, make sure you have only one set to run in Real Time. Turn off realtime protection in the others.  A product like WInPatrol is complimentary to the antivirus application and will not interfere with its operation. As MSE and Avast are heuristic antivirus applications, you should not run them at the same time. They will interfere with each other and you may end up with less protection and a big recovery headache. 
• Use the other installed protection software  as DEMAND APPLICATIONS. That is,  if you chose to run MSE in real time, you can have Avast setup to run in Demand mode (Avast has settings that allow you to do this).  

The choice of security products is a very personal one.  Thank you for your suggestion. 

[emmjay · Accepted solution]

AV Update:     I have read that Immunet Cloud Security will run real time with other anti-virus apps. including MSE.   This is not in line with conventional wisdom, re: Realtime AVs do not co-exist.  It is up to you to decide. 

MSE Virus Definition Updates:  Though MSE has not made any official statements on this matter, it appears that the SLEEP/HIBERNATE problem has been addressed.    If you are  logged on during the time you have set to receive MSE updates, you will see them downloading, however, if you are not, you will see them in Control Panel/ Windows Updates as OPTIONAL updates. Do not regard them as optional, and download them ASAP. 

[MrPeter1985]

Threatfire is one that's REALTIME that will run side by side with any other AV. Read about it on there site--> http://www.threatfire.com/ and it's FREE!!!

[Bugbatter]

---

emmjay wrote:

AV Update:     I have read that Immunet Cloud Security will run real time with other anti-virus apps. including MSE.   This is not in line with conventional wisdom, re: Realtime AVs do not co-exist.  It is up to you to decide. 

When making that decision, it might be good to consider if you would want two products on board taking up space and using resources.
The problem with cloud computing is that one needs an internet connection to access the cloud. Nowadays, malware likes to disable on-board resident protection and the internet connection.

[emmjay]

Microsoft MVPs state that MSE uses Cloud computing to update  MSE   virus definitions... it is the standard answer to why we do not need daily definition  updates (yes they are considered optional downloads  !!!)  .   Frankly, I do not understand your point.  Maybe you should elaborate.