Morro, effective free AntiMalware software?

A while back now Microsoft bought Giant Software for its AntiMalware offerings, and proceeded to turn them into Windows Defender and eventually Windows OneCare.  Neither of these products has exactly set the world on fire – Defender, IMHO, seems to be moderately effective and the paid OneCare product is a mess. So much so, infact, that it’s been rehashed into ‘Morro’, the code name for Microsoft’s new, totally free, AntiMalware solution.  Is it any good?

It seems, from my totally unscientific subjective testing, that it’s effective, pretty and resource friendly.  I’ve been running the beta on my Windows 7 netbook and it’s caught all the nasties from various questionable sites and the occasional Rapidshare style download.  It’s been free of false positives and updates (both program and definitions) have been seemless.  It has stopped several hack tools in their tracks but excluding them to allow them to run is a quick process and its interface is simple and very attractive.  Being zero cost, it’s also devoid of all the upsells that are present in the commercial vendors free offerings.

I’m a huge proponent of paid security software, and in my experience the old adage of getting what you pay for has never been more true than it is with security software, but my initial impressions of Morro are that it could be an excellent product, and one that could eat into the commercial vendors sales. 

There’s a long rant coming one day detailing my detest for peoples unfounded (yet staunch and passed off as objective) praise for their chosen security software (which ends up launching into a rant about people sucking at judging causality), so I’ll naturally be holding off making any judgements about Morro’s effectiveness until the RTM been run through the ringer by a legitimate, trusted testing facility.  I imagine (in terms of test results) that it cannot possibly be any worse than most of the free offerings, and can quite possibly be better than many commercial offerings.

People outside of the US are excluded from the beta test, but don’t let that deter you.  Download the software from Softpedia – there are different versions for XP and Vista/7.  It is an old version, but once installed Windows Update will bring it up to speed.

I wouldn’t generally recommend running beta software on production machines, but as this is a mature product rehashed it should be fine.  Insert usual caveats about beta software and using it at your own risk here though.

RDX Drives and Ejection Issues

Recently, with VolumeShadowCopy style Backup/DR solutions coming of age, I’ve been selling an increasing number of disk based backup systems.  Personally I’m still of the opinion that data not on tape is data not (properly) backed up (yes, I know, I concede it’s a dying viewpoint), but you can’t argue with the low entry price point and startlingly quick DR times you can get from this type of setup.

Whilst you can certainly do this type of setup with a traditional, cheap USB2 host powered 2.5″ drive in an enclosure, there does exist a more durable removable drive solution in RDX.  It’s dearer (as you’d expect), but I find the added durability provided by a purpose designed solution is an easy sell to any business who appreciates the value of their data.

One big issue I find with these systems is getting them to eject – not because of any fault of the drives themselves, but because the VSS based backup systems tend to leave file handles open on the drive for an extended period of time after backup completion.  Thankfully (or not, depending on your viewpoint) the RDX drivers won’t let you eject the drive whilst it’s in use, but it’s not helpful when your client needs to eject the cartridge, the backup has clearly completed and the drive refuses to acknowledge their many frantic eject-button presses!

The solution – 2 command line tools, openfiles.exe and rsm.exe.

Openfiles.exe is an XP & Server 2003 inbuilt utility that provides additional functionality over and above the old ‘net files’ from NT4 days.  The neat thing with openfiles.exe is that it lets you selectively close open files based on the username of the owner – which is absolutely perfect assuming you run your backup solution under some form of service account (as you would be).  Find details of openfiles.exe at Technet.

Naturally, disconnecting open files under the wrong circumstances will not work out well, so ensure that it’s not messing with the integrity of your backups by testing them regularly.

Brandon Darling details using rsm.exe to eject an RDX disk in his excellent blog post here.

These 2 utilities together in a scheduled batch file help ensure that there’s an ejected cartridge at the end of each day ready for an employee to take offsite.

Forgotten Command Line Gold: EServ Purger

I don’t think there’s a lot I enjoy more than finding an elegant solution to what should be a simple administrative chore.  Despite having a comprehensive backup routine at the office, I encourage the office admin guys to keep backing up their MYOB databases daily to a dedicated MYOBBackup folder for additional piece of mind (and so they can do their own recoveries).  Those of you that use MYOB will know that all it does is ZIP up the database and give it a filename based on the current date – it’s simple and effective but it does mean that an unchecked folder will accumulate backups until the end of time (or disk space, whatever comes first).  So, the issue that arrises is how do we purge files older than a certain number of days (90 in our case) using the command line?

Enter EServ Purger – circa 1998…

Purger.exe is a simple freeware command line utility that will selectively purge files from folders of a certain age.  It was written by Alexander Gorlach and though the attached documentation does provide a link to a homepage it appears to be long gone.

Note that it appears to have been used in certain viruses and other malware, so you may find that it triggers your AV software as a hack tool or some other sort of infection – ignore it, it’s fine.

Usage is simple – in my case it’s ” PURGER.EXE -RED 90 C:\MYOBData\Backups\*.* “, the syntax being R for folder recursion, E for deletion of empty folders and D 90 for ‘Delete files older than 90 days’.  There are other command line options such as logging to a file or leaving a particular size of fresh files (i.e. Leave the latest 1MB of files created, delete everything else).

Check it out – despite its age it’s a very useful, potentially dangerous command line tool to have in your arsenal…  Get it here.