Microsoft Anti-Virus

~ the eulogy ~

The interesting thing about Microsoft Anti-Virus is what it could not do. It shipped on 30 march 1993 inside MS-DOS 6.0 knowing about 1,234 viruses, and it had no mechanism for ever learning about a 1,235th. Updated signature files existed. They lived on a bulletin board, and getting them onto your machine meant dialing in, downloading, and copying the files into place yourself.

It was not Microsoft's code. Central Point Software supplied it as a cut-down build of Central Point Anti-Virus, which Central Point had itself licensed from Carmel Software Engineering in Haifa, sold internationally as Turbo Anti-Virus. So the scanner in the world's most widely installed operating system was a third-hand product, two licensing deals away from the people who wrote it.

There was a Windows front end too, MWAV, so the same engine could be run from Windows 3.1x without dropping to a prompt. Both versions carried VSafe, a resident module that stayed in memory and watched for programs writing where they should not.

This one sits just before my window. My modem years start in 1998, and by then a scanner whose knowledge stopped in 1993 was a joke told about older machines rather than something anyone would run. What MSAV is useful for now is that it marks the exact moment the industry learned that a security product is not a program, it is a subscription. The lesson was expensive, and the company that paid for it was not Microsoft.

~ the dossier ~

~ 1,234 viruses and no way to add more ~

A signature scanner is a list. Its entire value is how recently the list was written, and a list frozen at the moment a boxed operating system went to duplication starts rotting the day it ships. MS-DOS 6.0 shipped in march 1993. MS-DOS 6.22 shipped in 1994 and carried the same approach. Anything written after those dates walked straight past it.

It also left traces everywhere it looked. MSAV wrote small checksum files into the directories it scanned so it could notice later whether an executable had changed underneath it. That was a reasonable idea and it meant a full scan seeded a hard disk with little bookkeeping files people found confusing for years afterward.

~ vsafe in memory ~

VSafe was the real-time half: a terminate-and-stay-resident program that sat in memory checking executables and boot sectors, and that could be told to shout when something tried to write to a disk or format one. It is recognizably the ancestor of every on-access scanner since.

It also competed for the one resource that mattered. DOS had 640 KB of conventional memory and games of that era wanted nearly all of it, so a resident scanner was directly in the way of the thing you had turned the machine on to do. Anyone who spent an evening rewriting a boot configuration to free eight more kilobytes eventually stopped loading VSafe. Protection that costs you the use of the computer does not get used.

~ what the bundle did to central point ~

Central Point had built a serious utilities business, roughly $80 million of revenue in 1993. Licensing its scanner into MS-DOS 6 looked like the largest distribution deal available anywhere in software. It was closer to a substitution. Once a stripped-down version of your product arrives free with the operating system, the retail box on the shelf has to argue for itself all over again, and most buyers never hear the argument.

On 4 april 1994, roughly a year after MS-DOS 6.0 shipped, Symantec agreed to buy Central Point for about $60 million in stock, four million shares for the whole company. The deal closed on 1 june 1994. A company sold for less than its previous year's revenue, and the coverage at the time said plainly that one of the pressures was Microsoft folding basic utilities into DOS. Symantec then found itself maintaining the free bundled competitor to its own Norton AntiVirus, which is how the last MSAV update came to carry Symantec's name in june 1996, by then covering 2,371 viruses and able to handle polymorphic ones.

~ the fifteen year gap ~

Windows 95 shipped with no antivirus at all. The DOS utilities that had been folded in were quietly dropped, and Microsoft left the category entirely. Support for MS-DOS 6.x ran on paper until the end of 2001, but nobody was updating anything.

Microsoft did not ship another antivirus until Windows Live OneCare in 2006, sold as a paid subscription, which lasted three years. Microsoft Security Essentials followed in 2009, free, and eventually became the Defender that is built into Windows now. Fifteen years passed between the bundled scanner that helped end an independent utilities company and the free one that ended a lot more of them. The second time, Microsoft owned the code.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »