news windows xps anti malware support extended to 2015
News

Windows XP’s anti-malware support extended to 2015

Microsoft plans to end official support for Windows XP on April 8, more than 12 years after the operating system first became available to the public. Plenty of people are still using the OS, though. According to tracking firm Net Applications, Windows XP still runs on nearly 29% of the desktop systems browsing the web today. Perhaps due to the OS’s persistent popularity, Microsoft has decided to extend anti-malware protection until July 14, 2015.

Windows XP will still be considered an unsupported OS after April 8. However, Microsoft will continue providing "updates to [its] antimalware signatures and engine" until the middle of next year. For consumers, the updates will come via Security Essentials. Enterprise customers will get updates to System Center Endpoint Protection, Forefront Client Security, Forefront Endpoint Protection, and Windows Intune.

The additional 15 months of anti-malware updates are meant to give users more time to transition to a newer operating system. According to Net Applications’ data, Windows XP’s share of web traffic has dropped 10 percentage points in the past year, so people are clearly moving away from the OS. A substantial number of machines remain, of course, and it will be interesting to see how many of them persist after April 8—and after anti-malware support officially expires next year.

Unprotected PCs represent a risk to not only their own users, but also the Internet at large. Simply providing anti-malware updates doesn’t guarantee the safety of an operating system, though. I’ve seen several infected machines that had at one time been running Security Essentials. As Microsoft notes in its blog post announcing the change, "the effectiveness of antimalware solutions on out-of-support operating systems is limited."

0 responses to “Windows XP’s anti-malware support extended to 2015

  1. Shouldn’t take 1.5 years just to learn how to use and deploy it, there’s quite a lot of good info online.

    OTOH if you’re wanting to become a guru-level expert and/or developer and have no prior experience with *NIX style OSes, then yeah… 1.5 years (or more) is probably more like it.

  2. Yup. I just helped my father move his POS systems from XP to new machines running 7. They were never on the WWW, but I still feel better with them running something less than a decade old.

  3. Yeah, I was in a coffee shop in Portland over the holidays (Case Study) and the entire PoS system was an app’d iPad with a Square card reader. That’s actually a great system for small businesses.

    Larger retail businesses, however, usually have the entire store Borged into complex inventory databases and customized PoS software that would require major overhauls and validation in order to support a new OS.

  4. I had read something a year or so ago that stated that a substantial percentage of the remaining XP (and IE6) installations are in China, running pirated copies of XP. China has already partially firewalled themselves off from the rest of the Internet; so if things get bad enough we just beef up the firewall on our side and let China turn into a real-life version of [url=http://xkcd.com/350/<]this[/url<]!

  5. As long as this is a zero-cost option for MS, this is OK – but I really think MS should be doing everything they can to leave XP users (and their newborn sons) alone in the woods beyond the wall. If you’re going to actively work against the security of the global computational environment, you deserve to be carried off by the white walkers.

  6. [quote<]Ever think that the only reason XP has persisted is that MS keeps supporting it?[/quote<] If security was the motivating concern behind people using XP, they would've upgraded as soon as NT 6.0 came out. You're basically saying, "People use XP because it's still secure." No, it isn't. XP is a mess, regardless of MS support - that's why they release new versions. Some idiots in the tech community are under the impression that Windows releases are entirely cosmetic. They are not.

  7. I don’t think even Microsoft has the resources to support the number of Windows machines out there. And remember, XP has been succeeded by [b<]three[/b<] new versions of Windows at this point. I can't remember if Vista still has support, but at some point you have to put your foot down and stop supporting old products so you can sell your new one(s).

  8. There’s a local ice cream place I hit on occasion, and the first time I went there I just kinda stared at the POS — it was an iPad. No cash. It looked like… An ice cream shop out of Star Trek.

    That said, I’d be slightly concerned. Windows or ‘nix would’ve been better long term, as I think Apple would stop patching iOS long before patches would dry up for either of those other OS’s. But in the mean time, very space agey.

  9. As someone that recently, for over a year, held a position that had them daily interfacing for permitting (mostly) purposes with local, county and state government in the state, I suspect they don’t use linux on the front end for the same reason business doesn’t: compatibility with existing apps, and, especially, Office.

    I’ve had occasion to speak to a few different IT people at different governments (mostly cities), and those particular ones did happen to use linux on servers.

    The 10 years thing is a BS excuse, though. In reality, its laziness, incompetence, and lack of incentive to care at all. The majority of the work I did actually had to be done by paper, with a daily courier running back and forth (paid for by the business of course) the only way to get anything done on a sane time scale. Last thing they need to do is switch to linux and Libre Office and start getting slightly garbled renderings of .docx, .xlsx, etc.

  10. I don’t particularly buy that, only because it assumes people patch known vulnerabilities — which reality shows they don’t. No need to wait for XP to stop releasing patches when vast numbers of people wouldn’t apply the patches anyway. Reference: Recent Yahoo ad hack infected computers via two vulnerabilities that’d been patched, one I think was around 2 years old.

  11. Translation: someone over there figured out what would happen if they tried to give the ‘you deserve it for not upgrading’ line to an organization that kills people in both hemispheres.

  12. They could charge for updates. I’d love to see them make XP SP3 a free download and have a subscription or a la carte pricing for patches and support calls. That would make everyone happy; kids and cheapskates who’d otherwise go *nix get a free entry-level Windows OS, existing users aren’t screwed over and MS can turn the XP liability into an asset.

  13. When I was in Florida about a year ago I visited a government agency that will not be named that had just recently upgraded to XP. The rationale is that for their needs, not only do they hate to upgrade but whatever they upgrade to needs to exist for about ten years before it’s considered stable enough. Why they don’t go Linux and be done with it is beyond me, though Microsoft undoubtedly buys more politicians than Team Tux.

  14. From experience, I can say that spending a few years in the goatse-or-be-goatse’d world of hardcore Internet trolling is an excellent way to not ever have to worry about phishing. Ah, the glory days of yore…

  15. [quote<]For the record, that "average Joe's" system still staying malware-free after he switched to a paid antimalware product by a third-party company a couple of years ago. He still gets some adware which attempts to install toolbars into browser but all of this is easily removable by Windows's own uninstaller or through browser's own "add-ons" menus and he knows how to do that.[/quote<] I have personally seen enterprise Symantec and AVG fail to stop the exact malware scenario you described. MSE may suck but let's not pretend the others offer any better protection.

  16. Another exaggerated fear.

    Crackers and malware writers aren’t stockpiling anything. They have been working with XP for years and have been adapting their tools for 7/Vista ecology.

  17. All forms of A/V software generate a false sense of security.

    The best way to avoid getting nailed by malware is knowing how it spreads. Don’t open up suspicious emails, attachments, websites and download files from questionable sources. You pretty much are safe from the majority of the stuff that is out there. You only have to deal with stuff that depends on zero-day exploits.

  18. No it shouldn’t. A company offers products, and when those products become obsolete, the company doesn’t [i<]have[/i<] to do anything to said products. There will often be legacy support as a friendly measure to ease eventual transitions, and companies that make physical products will maintain warranties up to a certain point. However, that is not required, and it is in the company's best interest to sell newer products instead of providing support. Remember, Microsoft isn't selling XP anymore, so that means that any work it does to support it costs them money without providing a return.

  19. I’ve actually got both of those bases covered. My new desktop is natively a Windows 7 system (as decreed by our IT department), but I do Linux development so most of my work is in a Linux VM hosted on the Windows 7 box!

  20. I think Vista is a big part of the reason XP is still supported. Enterprise users are very slow to upgrade; most of them passed on Vista, and many still haven’t made the transition to 7. The company I worked for until last year was still running XP; the only reason my Windows PC is on 7 now is because our division got bought out.

  21. Heck, there are still point-of-sale systems out there running Windows 3.x. And OS/2. Windows XP is still new and exciting in that market!

  22. The real irony here is that Stallman started his crusade (which resulted in the GPL and most of the current open source movement) because of a printer driver. I guess some things never change.

  23. This is considered a serious threat in the computer security industry. Considering the amount of code common to different versions of Windows, if a vulnerability on a supported version is patched, the patch itself can be used to create an exploit to the vulnerability it fixed–and can be used on older, unpatched version of the OS.

  24. Microsoft should provide the products and services their customers want. It should not work the other way around.

  25. But it’s not. If you can’t understand that – here is a scenario (based on actual experience) from an “average Joe”:

    – “hmm… I just received a strange file from a friend/family member/guildmate/coworker… I have no antimalware program, so I should not run it…”
    Then user goes to download and install useless MSE, “based on recommendations” by internets’ armchair “IT profeshanals”. Installs it, changes his thought process to:
    – “Hey, I have antivirus now, it should catch and repair everything bad! Let me execute that strange file, because I am completely safe now… Oh wait, why is my PC locked now with a huge banner asking me to send my money to certain PayPal account in order to receive unlock code to remove that ransomware banner??? Why did MSE allow this to happen, without even trying to warn me about specific malware-like behavior during the execution of this program?”

    For the record, that “average Joe’s” system still staying malware-free after he switched to a paid antimalware product by a third-party company a couple of years ago. He still gets some adware which attempts to install toolbars into browser but all of this is easily removable by Windows’s own uninstaller or through browser’s own “add-ons” menus and he knows how to do that.

    My point is, there are better antimalware tools still available even for WinXP so neither MS nor the average users should waste time and money (for many people these two things are the same) on Microsoft’s own, supposedly “better than nothing”, false “security” products.

  26. I thought this was only here O_o. We had a really old plotter that required XP to print and it could only be done via a VM.

  27. Sure they do, but all of us would be affected if botnets suddenly acquire a couple of million zombies.

  28. Because its better than no security, which is what millions would do if MS didnt include at least some form of AV.

  29. The EB/Gamestop POS is (or at least was) built on W2K, but it was basically impossible to access anything but the POS, and the only “web browsing” available was to the Gamestop site.

    So yes, those are probably just clients.

  30. I have to laugh at this………… I read an article in the past 2 or 3 days that said Microsoft was going to stop supporting W7 very soon……. this is truth. If I knew where I saw it I’d link it………… might have been on a W9 story I was reading or DX12 thing. Don’t remember.

  31. The fear is that hackers are stockpiling “tools” that can take advantage of undocumetned vulnerabilities and waiting to strike when these vulnerabilities will not be patched. That leaves a permanant hole that will not be fixed for hackers to run rampant on a target of millions of systems. Even worse, the AV’s are usually only signature based and it’s not uncommon for them to miss a slightly modified version of malware that is blocked. So I don’t trust this extension at all. I’m doing my best to get everyone I know with XP on to Ubuntu or 7 before April comes.

  32. On that note: nothing in the world made me WTF quite like seeing a college secretary’s system running XP in a VM so her printer would still work.

  33. I still see banks with W2K logins on my walks about town. I *really* hope those are just thin-clients and the actual hosts are “secure.”

  34. Lots of software isn’t making the jump to x64, because of issues like compatibility with 32-bit printer drivers and 32-bit browser plugins, which are still the predominant setups.

  35. We still use XP in the office because we haven’t bothered upgrading our machines yet, but at home we ditched XP back in June 2010. Never looked back. For now, it’s Win7. No plans to get Win8 [u<]ever[/u<]. Hopefully, Win9 will be worth upgrading to.

  36. Thankfully my company just hit 84% converted or replaced machines to Windows 7. Still a few thousand more to go though! My company really should have started 1 year sooner but good ol’ medical software companies dragging there feet with implementing newer versions of software! The next issue I foresee though is all the Windows 7 machines we do have all run x32 builds. This is in part thanks to medical software not making the jump to handle x64 environments!

  37. Apple, not Linux.

    I think MS just doesn’t want to burn bridges with millions of people who eventually need to upgrade. They are playing it safe. They are also showing they care about long term support when other companies do not. XP has been supported exceptionally well.

  38. That kind of logic only works in a static system. Internet security and computational demands of modern apps are constantly changing, and as such it is very likely that “Manaagement” saved money at the cost of potentially earning more money at higher efficiency…

  39. Your post makes no sense. You want them to have no backwards compatibility but be fully XP compatible? Maybe it’s just the wording…

    What would be ok is if they support backwards compatibility through transparent VMs that don’t require anything too special from the user to run. That might be hard or require specific hardware features but that’s what hardware requirements are for, but overall backwards compatibility is a HUGE deal for Windows and I wouldn’t want MS to pull an Apple and just throw it out.

  40. Possibly at the expense of a much larger, last-minute panic to replace these programs. Management typically has a problem weighing short-term gainst against long-term costs and effects.

  41. With all the W8 hate going around, I think MS is afraid XP users will switch to W7, or even worse, Linux, if they end support now. They’d rather wait until Windows 9 is out before pulling the plug.

  42. If it works, don’t fix it. Somehow your post sounds like this is a bad thing. Why?.

    Manaagement saved money by not upgrading; they deserve their bonuses.

  43. My company has nearly eliminated XP, and the ones that are left are barred from reaching the internet. If our cybersecurity group didn’t have so much pull in our company we would still be on XP. Thank goodness for small favors, I guess. But we are a big company, and other companies I worked for in the past I can totally see why they might still be on XP.

    And the whole ActiveX and IE6 thing definitely hurt things, Microsoft was terrible in pushing those non-standard demons on us, and shame on us in the IT industry for buying into it. Getting off of those was a painful experience, but we bought into it less than others.

    What I would like to see, actually, is Microsoft strip a lot of old compatibility stuff out of Windows 9. Instead of trying to make the new OS be compatible with the past, they should just spend some/all of those dollars on XP and not just extend the malware support but make an XP.2 that is fully XP compatible but has added security features/layers (for example make IE better, do virtual sandobxing, etc.). They would then be more nimble with the new OS and the folks that can’t get off of XP can still upgrade (perhaps for a small fee? $10/seat? $25?) to a more secure version.

    Just my 2 cents

  44. What’s the point… Microsoft’s Forefront/Endpoint/MSE products are the worst of their kind in terms of detection rates:
    [url<]http://www.av-test.org/en/tests/home-user/windows-xp/sepoct-2013/[/url<] [url<]http://www.av-test.org/en/tests/corporate-user/windows-xp/sepoct-2013/[/url<] Why continue giving people a false sense of security?

  45. I know there’s one large company about 30 minutes away from here that still uses mainly Windows XP.

    Why?

    Because almost all of their software were custom made, and were only designed to work on IE6.

    From what I’ve heard, the management will only start to move off of Windows XP after no enterprise antivirus software supports it anymore.

    On a side note, their management also got some hefty bonuses in 2013.

  46. Just let it die! The fact that they support a 13 year old OS to this day is incredible. Enterprise users have had YEARS of warning. This would be like Apple still supporting OSX Puma (hah!)

    Though I guess, may as well throw new virus definitions into MSE, that’s a standalone program so why make that standalone program different from 7s.

  47. Well, in my case I had to use it because other AV’s were mucking with my HD Home Run Prime. Fortunately, I’m not on XP.

  48. Those systems often run a different type of XP, though, that will be supported longer. [url<]http://www.microsoft.com/windowsembedded/en-us/product-lifecycles.aspx[/url<]

  49. Yea, its rather disturbing. At starbucks other day, POS system was crashed, and booting XP…it never came up and crashed again, got my coffee free. Don’t like to imagine my CC going through that system though.

  50. Security Essentials has really fallen off in terms of protection though. I used to recommend it to everyone, and now even Microsoft tells people they shouldn’t use it.

    [url<]http://www.howtogeek.com/173291/goodbye-microsoft-security-essentials-microsoft-now-recommends-you-use-a-third-party-antivirus/[/url<]

  51. There are over 7000 people where I work, and 57% are on XP, including me.
    Sad, isn’t it?

  52. I’m worried that the day XP is no longer supported will be a day that goes down in history as the begining of the greatest hack-fest in history.

  53. The vast majority of point-of-sale systems I see in the wild seem to still be running XP, as well as a significant number of ‘kiosk’ -type systems. Interestingly, most of those sorts of systems not running XP seem to be running a ‘nix of some flavour.

  54. Ever think that the only reason XP has persisted is that MS keeps supporting it? I know this is nice for stragglers, and many of those users might still be on business machines, but they could convince a lot more people to switch/upgrade if XP support was dropped completely.

  55. July 14, 2015 – Windows 9 released two weeks prior to this.

    I don’t know that, just sayin.

  56. Finally have years of talks and extension this will be the first time Microsoft is dropping support for the OS.

    Curious they still do Malware support though. Guess they can’t drop it completely.