Now that Windows 7 is available, a recent blog by Chester Wisnieski (who works at security vendor Sophos), entitled Windows 7 vulnerable to 8 out of 10 viruses, which has stirred some interest.

Here's a quick summary for those who missed Chester's blog. During a test SophosLabs conducted, they subjected Windows 7 to "10 unique [malware] samples that arrived in the SophosLabs feed." They utilized a clean install of Windows 7, using default settings (including the UAC defaults), but did not install any anti-virus software. The end result was 8 of the 10 malware samples successfully ran and the blog proclaims that "Windows 7 disappointed just like earlier versions of Windows." Chester's final conclusion? "You still need to run anti-virus on Windows 7." Well, we agree: users of any computer, on any platform, should run anti-virus software, including those running Windows 7.

Clearly, the findings of this unofficial test are by no means conclusive, and several members of the press have picked apart the findings, so I don't need to do that. I'm a firm believer that if you run unknown code on your machine, bad things can happen. This test shows just that; however, most people don't knowingly have and run known malware on their system. Malware typically makes it onto a system through other avenues like the browser or email program. So while I absolutely agree that anti-virus software is essential to protecting your PC, there are other defenses as well.

Let me recap some of the Windows 7 security basics. Windows 7 is built upon the security platform of Windows Vista, which included a defense-in-depth approach to help protect customers from malware. This includes features like User Account Control (UAC), Kernel Patch Protection, Windows Service Hardening, Address Space Layout Randomization (ASLR), and Data Execution Prevention (DEP) to name just a few. The result, Windows 7 retains and refines the development processes, including going through the Security Development Lifecycle, and technologies that made Windows Vista the most secure Windows operating system ever released.

Beyond the core security of Windows 7, we have also done a lot of work with Windows 7 to make it harder for malware to reach a user's PCs in the first place. One of my favorite new features is the SmartScreen Filter in Internet Explorer 8. The SmartScreen Filter was built upon the phishing protection in Internet Explorer 7 and (among other new benefits) adds protection from malware. The SmartScreen Filter will notify you when you attempt to download software that is unsafe - which the SophosLabs methodology totally bypassed in doing their test.

So while I'm not a fan of companies sensationalizing findings about Windows 7 in order to sell more of their own software, I nevertheless agree with them that you still need to run anti-virus software on Windows 7.  This is why we've made our Microsoft Security Essentials offering available for free to customers. But it's also equally important to keep all of your software up to date through automatic updates, such as through the Windows Update service. By configuring your computers to download and install updates automatically you will help ensure that you have the highest level of protection against malware and other vulnerabilities.

Back on May 26th, we announced Windows Vista SP2 and Windows Server 2008 SP2 hit the RTW milestone. The first wave of languages (English, German, French, Spanish, and Japanese) was made available on Windows Update at that time. Today, we are releasing the remaining languages for Windows Vista and Windows Server 2008 SP2 to Windows Update.

For more information, including languages, on Windows Vista and Windows Server 2008 SP2 click here.

If you have Windows Update configured to download updates automatically, Windows Update will notify you when Windows Vista SP2 and Windows Server 2008 SP2 is ready to be installed.

On April 28^th, we announced that Windows Vista and Windows Server 2008 (Service Pack 2) SP2 had RTM’d. Today, we are pleased to announce the Release to Web (RTW) for Windows Vista and Windows Server 2008 SP2.

Windows Vista and Windows Server 2008 SP2, a combined service pack for both operating systems encapsulated in a single installer, will simplify deployment, management, and support for IT Professionals. It includes support for new types of hardware and emerging hardware standards, as well as updates since SP1.  For specific information on what’s included in SP2, visit the notable changes document.

Windows Vista and Windows Server 2008 SP2 is now available for download on the Microsoft Download Center and on Windows Update.  

Download: Windows Vista and Windows Server 2008 SP2 x86 (5 Language Standalone)
Download: Windows Vista and Windows Server 2008 SP2 x64 (5 Language Standalone)

Consumers with Windows Vista SP1 can visit the Microsoft Download Center or use Windows Update (WU) to install SP2, but my suggestion is to turn on Automatic Update (AU) and sometime during the coming months your computer will download and install SP2. Similar to previous releases, SP2 delivery over Automatic Update is a “throttled release” which will begin in June.

Business customers who require additional time to prepare for the download and deployment of SP2 can use the same blocker tool kit provided for Windows Vista SP1 to delay deployment.

Business customers with Windows Vista will find the transition to Windows 7 will be significantly more straightforward due to the high degree of compatibility between Windows Vista and Windows 7. For more on Windows deployment guidance, I suggest reading this blog post from Gavriella Schuster.

Windows Vista and Windows Server 2008 SP2 represents Microsoft’s continued commitment to quality. While most updates contained in SP2 are available as individual downloads, the roll-up convenience of SP2 is a major benefit for administrators. This functionality coupled with new advanced deployment features, such as the single installer and the pre-installation analyzer, means SP2 continues to provide ongoing improvements that our customers have grown to expect from Microsoft. For more detail on SP2’s contents, see Hotfixes and Security Updates in Windows Server 2008 SP2 and Windows Vista SP2.

Starting this Tuesday (May 12th) we will release up to ten test updates to PCs running the Windows 7 RC in order to verify our ability to deliver and manage updating of Windows 7 in certain real-life scenarios. These updates do not deliver any new features or fixes. This is the second set of test updates we’ve released to test the updating mechanism for Windows 7 - the first set were released on February 24. For more information, see this post on the Microsoft Update Blog.

RSA was great last week - security was clearly top of mind for the attendees, and I fielded a number of different questions last week about how Microsoft protects our customers. Some are pretty straightforward around how the various Windows 7 security technologies work, but many have focused on how we actually deliver protection to customers on an ongoing basis.

One question that comes up more than I would have ever expected is: Who gets security updates?

There seems to be a myth that Microsoft limits security updates to genuine Windows users.

Let me be clear: all security updates go to all users.

Not only do all security updates go to all users' systems, but non-genuine Windows systems are able to install service packs, update rollups, and important reliability and application compatibility updates. In addition, the users of non-genuine Windows systems can also upgrade a lot of the other software on their computer. For example Internet Explorer 8 has numerous security- oriented features and improvements, and it is available to all users.

This isn't to say that all updates are available to non-genuine PCs. Other value-adding updates and software may or may not be blocked, at Microsoft's discretion. On Windows Vista, available updates can be accessed through the Windows Update control panel. On Windows XP, a non-genuine Windows system can access updates through Automatic Updates, but they cannot get to any of the optional updates which are only available through the Windows Update and Microsoft Update websites.

Keeping a machine up to date is one of the first steps in helping ensure that they remain reliable, compatible, and safe from threats when they are online. Some of the most famous incidents of malicious software infection have come after security updates were publicly available from Microsoft - Blaster, Zotob, Conficker and Sasser, just to name a few.

I hope this clears up some confusion. Rest assured that we at Microsoft are committed to making sure that security updates are available to all of our users to help ensure a safe online experience for everyone.

Starting February 24, we will be releasing up to 5 test updates to PCs running the Windows 7 Beta (Build 7000) via Windows Update. These updates allow us to test and verify our ability to deliver and manage the updating of Windows 7. We typically verify servicing scenarios during a beta.

Windows 7 Beta users will be notified that new updates are available beginning February 24 through Windows Update. Even if the user has Windows Update configured for automatic update – these test updates will not install automatically. Users will need to manually install the test updates through Windows Update.

These updates do not deliver new features or bug fixes. The test updates simply replace system files with the same version of the file currently on the system.

For more information, please visit the Microsoft Update blog.

Again, thank you for helping test Windows 7. Your feedback is extremely valuable!