Antivirus Tools Fool XP's Security Center

Windows Security Center may say your PC is protected, even when it isn't.

Mary Landesman and Aoife M. McEvoy

The McAfee Security Center under Windows XP SP2 incorrectly indicated that our test machine was fully protected, prior to updating.

Microsoft's Windows XP Service Pack 2 is supposed to improve security. Its Windows Security Center should alert you when your antivirus software is missing or out of date. But in our tests, both McAfee's Internet Security Suite 2005 and Symantec's Norton Internet Security 2005 crippled SP2's ability to deliver accurate alerts immediately after installation.

We installed each application on a PC running SP2, and both caused the Windows Security Center to report erroneously that the products were up-to-date. Any antivirus software must be updated immediately after you install it to protect the computer against viruses discovered since the software's initial release.

McAfee and Symantec acknowledge that their products intentionally disable the Windows Security Center's messaging feature. Both companies say the reason for doing so is to streamline customers' experience; neither company plans to alter its practices.

Our advice: Grab the virus definition updates as soon as you finish installing either application. Click here more details.

But the ability of antivirus vendors to tinker with SP2 raises a more ominous issue: Couldn't a smart hacker do the same? Yes, in theory, admits Yoav Schwartz, program manager for the Windows Security Center. (He also says that no known security flaws are associated with SP2.)

Security expert Steve Gibson, president and founder of Gibson Research, says that, like Internet Explorer before it, the Windows Security Center is wide open to attack. "It's not even a matter of time," he says. "It's a matter of desire."