Microsoft security essentials and Windows XP

[DrWho3000]

hopefully we won't have to rely on the engine, if the update def files works and MSE scans ok and well

[Dave-H]

Of course the danger is that eventually MSE will stop working again because the engine will be deemed to be too out of date!

[DrWho3000]

how long is it before MSE will complain IDE's are out of date before needing a update again
could we say leave it 2-3 or even 4 days ?

[dencorso]

More than one day for sure, but I don't remember just now for how many days... that's documented somewhere, though, if MS didn't take it down, yet.

[3dreal]

Microsoft Security Essentials( MSE) for Winxp: No more updateS since quite a long time.

Only free solution: Clamwin. The addon-Software Clamsentinel i removed since too much false positive. one must adjust this. e.g.. irfanview plugins a lot of them were blocked!
So remove MSE and install Clamwin. At least true for Winxp SSE. What is working on Winxp SSE2 i cannot answer now since other PC must be setup again.

[Mathwiz]

I used to use ClamWin. It wasn't bad; my only complaint was, it's only an on-demand scanner (like MalwareBytes' Anti-Malware Free). So you have to schedule a scan every day, and there's still a chance malware could get into your system and do a lot of damage before the scan caught it.

I think MSE is one of only a few free real-time AV products left for XP. That's why we're jumping through hoops trying to keep it alive.

1 hour ago, DrWho3000 said:

how long is it before MSE will complain IDE's are out of date before needing a update again

There have been occasional outages before, and IIRC it takes 3 days before the systray icon turns yellow. So you could update every other day and never see the yellow icon.

[dencorso]

47 minutes ago, 3dreal said:

Microsoft Security Essentials( MSE) for Winxp: No more updateS since quite a long time.

How so? What do you think this very thread is all about? So long as there are working virus definitions, the rest's just fireworks.

[Dave-H]

Just to confirm what we already know, I noticed this in my Windows System event log from my earlier attempts to use the later engine file -

Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
 	Signatures Attempted: Current
 	Error Code: 0x800700c1
 	Error description: Microsoft Antimalware is not a valid Win32 application. 
 	Signature version: 1.293.45.0;1.293.45.0
 	Engine version: 1.1.15900.4

And -

Microsoft Antimalware has encountered an error trying to update the engine.
 	New Engine Version: 1.1.15900.4
 	Previous Engine Version: 1.1.15800.1
 	Engine Type: Antimalware
 	User: NT AUTHORITY\SYSTEM
 	Error Code: 0x8007007f
 	Error description: The specified procedure could not be found.

[heinoganda]

Will publish a customized MSE Updater, but this means that the mpengine.dll would remain at the state of version 1.1.15800.1. A test with the Eicar test virus has been positive with the most recent virus definition. In how far this will affect more recent virus definitions in the future, I can not foresee. The fact is that in future vulnerabilities or functional extensions in the file mpengine.dll no update is possible.  There are still some tests needed in the next few hours and if they go well I will publish the updated MSE Updater.

 

[3dreal]

On 4/16/2016 at 12:45 PM, ND22 said:

Then I got a serious problem here! On 3 different systems with XP and MSE 4.4 I got the same message!

I am going do download MBAM to do a complete scan!

Thank you anyway.

There is a workaround with hotfix for MBAM latest xp-version2.21. 1043. for SSE-winxp. . 2.18 and above related. i have the instructions. they are their forum.

[3dreal]

I am trying out Emet 41u1. advised from palemoon/newmoon-people. i am leaving it alone now.

 

[Mathwiz]

I think a batch file like this will get me by for a few days:

@echo off
net stop MsMpSvc
echo Please ignore "At Risk" pop-up from Microsoft Security Essentials while the latest definitions are being installed
cd %TEMP%
if not exist mpam-fe.exe "%ProgramFiles%\HTTPSProxy\wget.exe" -O mpam-fe.exe http://go.microsoft.com/fwlink/^?LinkID=121721^&clcid=0x409^&arch=x86^&eng=0.0.0.0^&avdelta=0.0.0.0^&asdelta=0.0.0.0^&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
cd "C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates"
"%ProgramFiles%\7-zip\7z.exe" x -y "%TEMP%\mpam-fe.exe" *.vdm
del "%TEMP%\mpam-fe.exe"
net start MsMpSvc

7-Zip and wget required. Note: this is specific to my system; you'll probably need to adjust some path names, depending on where 7-Zip and wget live on your own systems.

[dencorso]

Good! Here's a slightly more generic version of it. As before 7-Zip and wget required and one'll probably need to adjust some path names, depending on where 7-Zip and wget live on your own systems. In my system wget.exe is on the environment PATH, so no explicit path is needed.

@echo off
pushd %temp%
if not exist mpam-fe.exe start /wait wget -O mpam-fe.exe http://definitionupdates.microsoft.com/download/DefinitionUpdates/x86/mpam-fe.exe
"%ProgramFiles%\7-zip\7z.exe" x -y "mpam-fe.exe" *.vdm
net stop MsMpSvc
move *.vdm "%ALLUSERSPROFILE%\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates"
net start MsMpSvc
del mpam-fe.exe
popd

Notice please it's a .cmd, I don't remember whether pushd/popd work OK with .bat extension...

[Mathwiz]

On 4/24/2019 at 6:48 AM, DrWho3000 said:

https://en.wikipedia.org/wiki/ClamWin_Free_Antivirus

it doesnt rank very good 43/55

To be fair, that was in 2009. I haven't seen a recent ranking; it may have improved since then.

[heinoganda]

Microsoft Security Essentials Definition Updater update to version 1.7

Adjustment for support end of MSE

Edited April 30, 2019 by heinoganda