Microsoft seeks antivirus fix

REDMOND, WASH. - Microsoft is working behind the scenes with leading antivirus software vendors to improve the way desktop security software works with its next major operating system, code-named Longhorn.

Under enormous pressure from customers, partners and competitors to clean up its security act, Microsoft plans to open up Longhorn through one hundred or so APIs that antivirus software developers could use to get a more direct path into the operating system and applications running on it. Longhorn will be only client desktop software,and according to Microsoft, Longhorn isn't expected out until late 2004 or early 2005.

"When Microsoft gives [developers] these APIs, it will be easier to scan for viruses," says Bruce Hughes, content security lab manager at ICSA Labs, a Mechanicsburg, Pa., organization that tests antivirus products.

Those familiar with the plan say Microsoft's effort to work with antivirus software vendors should result in products that are less prone to interfering with operating systems and applications.

"Antivirus, for Microsoft, is a nuisance," says John Pescatore, a security analyst at Gartner, pointing to part of the company's incentive to work more closely with antivirus companies.

The availability of the APIs also should make for a de facto standardization of desktop antivirus software, making it easier for more companies to get into the $1.7 billion antivirus market, now the territory of vendors such as Network Associates, Symantec and Trend Micro. If the effort works out, observers say, it could pave the way for similar Microsoft projects involving intrusion-detection and other security technologies.

Sources say there is no evidence yet that Microsoft's APIs will help vendors looking to design better tools for cleaning up after a virus strikes computers.

Microsoft, which already has provided server-based antivirus APIs for its Exchange messaging server, acknowledged the Longhorn plan for desktop antivirus APIs, but declined to discuss it further.

Enthusiastic following

Antivirus vendors say they are enthusiastic about Microsoft's effort. While there always is concern about Microsoft taking too much control of a market, Microsoft's leadership is required in this area given the prevalence of its desktop software, they say.

Some antivirus companies already have had a preview of the potential benefits of APIs by using the server-based antivirus APIs that Microsoft makes available for its Exchange messaging server.

Trend Micro, for instance, has used Microsoft's VSAPI 2.0 for Exchange to better design its ScanMail product to block mail-based viruses, says Kevin Murray, Trend Micro's product marketing manager for messaging. Desktop antivirus APIs are where the industry is headed, says Murray, who predicts the change will result in antivirus software that's "a lot less intensive on system resources."

It could lead to antivirus software vendors no longer having to store thousands of signature updates - the information used to identify new viruses - on desktops. Instead, a central server could remotely scan desktops periodically.