Microsoft: Vista Infected 62% Less Often Than XP

Windows Vista is dramatically more secure than Windows XP, according Microsoft's latest Security Intelligence Report, released Monday. The infection rate of Windows Vista SP1 was 61.9 percent less than Windows XP SP3, the company said.

The report covers the first half of 2009 and is the seventh such twice-yearly report the company has issued.

The study found that for all Microsoft operating systems that the most current service pack is always the least infected, based on infections per 1,000 computers running each OS. Windows 7 was not included in the report; here is our guide to Win7 security.

The finding is not surprising considering that service packs "roll-up" all previous patches. Users who install the packs may practice safer computing overall than those who do not, Microsoft said.

Other key findings:

• In the United States, the United Kingdom, France and Italy trojans were the largest single category of threat; in China, several language-specific browser-based threats were prevalent; in Brazil, malware targeting online banking was widespread; in Spain and Korea, worms dominated, led by threats targeting online gamers.
• Phishing impressions rose significantly in 1H09, due primarily to a large increase in phishing attacks targeting social networking sites.
• Phishers continued to target a wider range of Web-site types than in the past, with gaming sites, portals, and the online presences of major corporations being some of the most frequently targeted sites in 1H09.
• After remaining mostly consistent throughout 2H08 and through April of 2009, the number of impressions suddenly nearly quadrupled in May, and rose even higher in June due in part to a phishing campaign or campaigns targeting social networks.
• Spam in 1H09 was dominated by product advertisements, primarily pharmaceutical products. In total, product advertisements accounted for 69.2 % of spam in 2H08.
• The most frequently exploited vulnerabilities in Microsoft Office software during 1H09 were also some of the oldest. More than half of the vulnerabilities exploited were first identified and addressed by Microsoft security updates in 2006.
• 71.2% of the Office attacks exploited a single vulnerability for which a security update (MS06-027) had been available for three years. Computers which had this update applied were protected from all these attacks.

Microsoft collects data on infections from its free security products such as Windows Defender, the Malicious Software Removal Tool (MSRT), Security Essentials as well as ones the company sells.

The report is available as a more than 230-page document or a 19-page summary. Both may be downloaded here. The long version includes best practices and a great deal of educational material, with the expected Microsoft slant.

David Coursey tweets as @techinciter and can be contacted via his Web site.

For more PC news, visit PC World. Story copyright PC World Communications, Inc.