25 replies to this topic

[DesertJerry]

Microsoft Security Programs

Malicious Software Removal Tool - updated every month during patch Tuesday - 32-bit and 64-bit versions - applicable to all versions of Windows.

Windows Defender - downloadable 32-bit and 64-bit versions for XP Pro, XP Pro x64, and Vista - user updates definitions; comes with Win7.

Microsoft Security Essentials - 32-bit and 64-bit versions for XP Pro, Vista, and Win7 - NOT for XP Pro x64. Installation routine 'turns off' but does not uninstall Windows Defender, user updates definitions

Microsoft Safety Scanner - 32-bit and 64-bit - must be run within ten days of being downloaded else must be re-downloaded for successful scan.

More extensive information is at Microsoft's Malware Protection Center: http://www.microsoft...itions/ADL.aspx

AutoPatcher > Stand Alone > should be updated to reflect these various security programs and conditions for downloading/running.

[Cristiano]

can someone running an x64 OS (vista and seven only) and the latest version of Microsoft Security Essentials x64 check this registry key:
[DetectionRegistry]
RegistryPath=HKCR\Installer\Products\0BD83724E3CF27649AB939275F96E603
KeyName=Version
KeyValue=33621084

just don't forget that the original data is in hexa and autopatcher can read decimal only

for the x86 version, an vm must be set and i'm still deploying the service packs for vista x64 to take some detections for the .net script. that will take some time yet, since my vista x64 dvd is rtm version (due that, sp1, sp2...)

windows defender installer is the same one that is at the script. so, no need for an change, except by the mistake in the restrictions section of the module. for ms safety scanner, i can't track the updates for it, sorry

> Installation routine 'turns off'
true. that has to be done in order to have an silent install. at the reboot, the update is on again

> does not uninstall Windows Defender
that is required? i was thinking that mse installer was turning windows defender off. if that is an issue, i can check for an way to do that

[]s

[DesertJerry]

Win7 64-bit w/SP1: HKCR\Installer\Products\0BD83724E3CF27649AB939275F96E603 checked and values are the same as posted (version is shown in both hex and decimal - with decimal in (**).

Windows Defender does not have to be uninstalled - the issue could be that after Security Essentials is installed AutoPatcher still shows Defender - only it's in black - could confuse some people.

[Cristiano]

hum... that is really an problem... the module can't be hidden, but it's possible add the ms security detection into windows defender module, that shall made windows defender looks as already installed. and, in fact, is, because ms security replaces it. what you think about?

[]s

[ViroMan]

if it replaces it we could remove it then, yes?

[Cristiano]

yes and no. long ago, someone had the stupid idea of mix everything into the same script, like happens in the .net script. the same thing was done with the other ones. the problem: certain things can't be installed in all OS's and certain users can choose an free anti-virus (that most of the times, doesn't have an spyware scanner). for those cases, an alternate version should be present. in this case, windows defender. for .net, it's even worst. an user running 2k (that requires about 30MB of that package) must download the whole thing, that is about 478MB and will increase in about 170MB in a few days. an similar issue happens with those that are running windows 7, vista and xp. there's no reason for someone running an x86 OS download the updates for x64, but since at the time that this was done the releaser was the same one for all of those, then the user has no choice. with more people handling the updates, that mistake could be fixed. my idea was do an script for xp, another one for seven and another one for 2k, but free time to do that is an problem. yesterday, to prepare an vm to take certain detections for vista x64, i was working a little bit below 32F (in fact, 30.2). right now, i'm with one core handling an vm with an vista x86 sp1 that is being updated to sp2 and then i will take certain detections to finish one of the scripts that are broken. for the .net updates, will take a few more days. then, i will be back to xp to fix a few things. but really, to fix all that fast, someone else should be doing this. could be an easy thing, like extras or something else, i don't know, but anyone else working could be great, like you are doing. alone, we just don't have time enough do to every single thing that has to be done

[]s

[Cristiano]

ok, possible detections for ms security x86 taken. options:
HKCR\Installer\Products\D7CD6B45B5C8BFD4CB510C013A23B6B2
Version
33621084

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}
DisplayVersion
2.1.1116.0

both will work. any preferences?

[]s

[ViroMan]

which ever one is the actual version, would be more understandable.

[Cristiano]

that's the problem: windows defender and ms security are the current version. they only difference is that one target spyware only and the other one target spyware, viruses, etc. the same could happen with IE updates, but there's those that for an reason or another are stucked with an older version. some companies that i know still run ie6, some still run ie7 and some still run ie8 and some fewer run ie9. due that, for xp, we have to keep 3 ie updates, 2 for vista and now 2 for seven and soon seven and maybe vista will have another ie version and then another update to be added into the script. and even worst: under vista, ie9 doesn't work if the user doesn't have a dozen of updates already deployed. that could be fixed, if and when ms realize that they shouldn't double their efforts and do their best into a single one. the problem with that is compatibility too... i don't know with US home banking, but here, we have to install an crapware that doesn't work under firefox 5 or ie9... and some versions of that crapware doesn't work even with ie8... but what worst than the bank that works with social security informations, home loans, etc (aka Caixa Econômica Federal) that claims that their software works with oracle java, but some of their services only work under ms java, that already was banned ages ago...

[]s

[DesertJerry]

Don't know if this helps but here's what I found looking in a couple of places:

Win7 64-bit w/SP1.

\Program Files has folders: \Windows Defender and \Microsoft Security Client.

Control Panel > Programs and Features - lists Microsoft Security Essentials 2.1.1116.0

Control Panel > Programs and Features > Turn Windows features on or off > Windows Features - could not find any lisitng for Windows Defender (so it appears to not be an optional installation program, user has no choice - it is installed by default).

Administrative Tools > Services > Windows Defender > Status (blank) > Startup Type - Manual > Log On As Local System - have no idea why it is shown as Manual.

Administrative Tools > Services > Microsoft Antimalware Service > Status Started > Startup Type Automatic > Log On As Local System

So I would have to state that Windows Defender is turned off when Security Essentials is installed but there really is no option to uninstall Windows Defender in the places most people would look for an uninstaller.

[Cristiano]

not really. autopatcher is redirected to program files x86 instead program files under an x64 OS. the same issue happens with system32. due that, no detection can be done from those locations, at least if the OS is x64. but in fact, windows defender can't be uninstall, just disabled

[]s

[Cristiano]

done. the ms security script was fixed and sent to be uploaded. it shall be online soon

[]s

[Black Ghost]

Microsoft Security Essentials 4.0 is now out.

http://www.askvg.com...-and-languages/

Edited by Black Ghost, 24 April 2012 - 09:13 PM.

[Whatacrock]

Found the link for the above on the Microsoft website and not a lot to go on but here is what I found

Spoiler

Microsoft Security Essentials
Microsoft Security Essentials provides real-time protection for your home or small business PC that guards against viruses, spyware, and other malicious software.

Software Version:4.0.1526.0

URL=http://www.microsoft.com/download/en/details.aspx?id=5201 enus\amd64\mseinstall.exe
Hash=1A453EEDE7E44733DBFAA6E427D52C9D
Size=12621696

URL=http://www.microsoft.com/download/en/details.aspx?id=5201 enus\x86\mseinstall.exe
Hash=4CC124D12E39D0620931BBBA53362C49
Size=10288512

both the 32 and 64 bit versions of this are listed same page.

[click-click]

Windows XP (32-bit)

Windows Vista or 7 (32-bit)

Windows Vista or 7 (64-bit)

[Black Ghost]

When Microsoft Security Essentials 4.0 updated can it be split up so there is a 32 and a 64 bit download. Thanks.

[dfdff3000]

Is there a possible script error? I noticed that the script was updated May 20, 2012. However, after updating .. the MD5 for the x86 mseinstall.exe is for the previous Microsoft Security Essentials release. Likewise for the x64 release. I'm still trying to figure out scripts, lol .. but are the DetectHash and ExpectedHash supposed to be the same, like ...

Spoiler

Item=mseinstall_xp_vista_seven_x86
DetectFile=autopatcher:\modules\stand_alone\mseinstall_xp_vista_seven_x86.apm_files\mseinstall.exe
DetectHash=4CC124D12E39D0620931BBBA53362C49
DownloadFrom=http://download.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/enus/x86/mseinstall.exe
DownloadTo=autopatcher:\modules\stand_alone\mseinstall_xp_vista_seven_x86.apm_files\mseinstall.exe
ExpectedSize=10288512
ExpectedHash=4CC124D12E39D0620931BBBA53362C49

instead of

Item=mseinstall_xp_vista_seven_x86
DetectFile=autopatcher:\modules\stand_alone\mseinstall_xp_vista_seven_x86.apm_files\mseinstall.exe
DetectHash=AD2C37CEB8ADA40431AC9E4A41098820 <-MD5 for Security Essentials 2.1.1116 x86
DownloadFrom=http://download.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/enus/x86/mseinstall.exe
DownloadTo=autopatcher:\modules\stand_alone\mseinstall_xp_vista_seven_x86.apm_files\mseinstall.exe
ExpectedSize=10288512
ExpectedHash=4CC124D12E39D0620931BBBA53362C49

and

Item=mseinstall_xp_vista_seven_x64
DetectFile=autopatcher:\modules\stand_alone\mseinstall_xp_vista_seven_x64.apm_files\mseinstall.exe
DetectHash=1A453EEDE7E44733DBFAA6E427D52C9D
DownloadFrom=http://download.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/enus/amd64/mseinstall.exe
DownloadTo=autopatcher:\modules\stand_alone\mseinstall_xp_vista_seven_x64.apm_files\mseinstall.exe
ExpectedSize=12621696
ExpectedHash=1A453EEDE7E44733DBFAA6E427D52C9D

instead of

Item=mseinstall_xp_vista_seven_x64
DetectFile=autopatcher:\modules\stand_alone\mseinstall_xp_vista_seven_x64.apm_files\mseinstall.exe
DetectHash=B34618EAF07F752B7572F7E7D0431101 <-MD5 for Security Essentials 2.1.1116 x64
DownloadFrom=http://download.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/enus/amd64/mseinstall.exe
DownloadTo=autopatcher:\modules\stand_alone\mseinstall_xp_vista_seven_x64.apm_files\mseinstall.exe
ExpectedSize=12621696
ExpectedHash=1A453EEDE7E44733DBFAA6E427D52C9D

[Whatacrock]

The hash fingerprints should be identical ie the detect hash should match the expected hash otherwise apup won't download the newer version.

I would have to guess to say the maintainer copied and pasted to one location and not to the other...once the error has been reported it will be fixed very quickly

[ViroMan]

your right... I goofed up. fixing

Fixed.

Edited by ViroMan, 24 May 2012 - 04:15 PM.

[DesertJerry]

Thought I'd mention that Microsoft Security Essentials 4.0.1540.0 Prerelease (64bit version) - which I downloaded today installed just fine on XP Pro x64 w/SP2. It did turn off Windows Defender, as it did for XP Pro 32bit and updated itself and scanned with no problems. Microsoft must have changed it because earlier versions would not install on XP Pro x64.