Windows Live OneCare (
http://www.windowsonecare.com) is Microsoft's subscription-based PC protection service for non-enterprise computers. OneCare covers up to three PCs, giving antivirus, anti-spyware, host-based firewall, performance tune-ups, backups, and automated Windows patch management. About the only thing it is missing is e-mail anti-spam protection.
OneCare is composed of a front-end GUI connecting to several back-end services. The service list includes Msfwhlpr, Msfwdrv, Msfwsvc, Mpfilter, Msmpsvc, and Winss. It also relies on many default Windows services, such as Application Layer Gateway Service, Network Location Awareness, Plug and Play, Remote Procedure Call, Telephony, and Windows Management Instrumentation. Curiously, OneCare does not work with dynamic disks (see http://www.support.microsoft.com/kb/913964).
OneCare provides real-time and on demand antivirus scanning, with instant messaging support as well. OneCare has received several respected industry certifications, including West Coast Labs Checkmark (Trojan, Antivirus Level 1, Antivirus Level 2), ICSA Labs (Firewall and Antivirus), and the Virus Bulletin 100.
The firewall is a two-way Windows Firewall, but is not the same as the one built into Windows Vista. One very notable difference is in how it handles outbound blocking. The Windows Vista firewall provides a default set of outbound blocking rules that are actually meaningful and does not prompt the interactive user to allow/block outbound traffic for random programs as this provides no real security value . The OneCare firewall, unfortunately, takes the same approach as most third-party firewalls and asks the user to make decisions about outbound traffic based on information that is incomplete and meaningless to the vast majority of users. This also means that users must elevate to an administrator to allow or block a program each time a program is blocked, significantly increasing the number of User Account Control dialog boxes encountered.
To avoid incessant prompting when it is first installed, the OneCare firewall, comes in with many pre-installed firewall rule exceptions, not all of which are acceptable to all security defenders. For instance, (in at least early betas of the Windows Vista-compatible version), the OneCare firewall allowed any signed ActiveX control or Java applet to pass through the firewall. Unfortunately, malware writers have digitally signed content in the past, so some threats may slip by using this vector.
As mentioned previously, Windows Defender is integrated with One - Care. OneCare ensures the Windows Defender signatures are updated as needed. OneCare also e-mails participating users vulnerability threat warnings when the risk is high enough to warrant.
OneCare can perform backups to external hard drives or writeable discs (CD-RW, DVD+RW, and so on). When OneCare is first installed, it prompts the user to perform a backup. Thereafter, backups are automatically done before performance tune-ups.
Mid-size and large businesses with their own administrators and security officers probably want to avoid OneCare because when it is installed it provides no central management and it overrules previously installed software and configuration settings. For instance, it replaces previously customized Windows Firewall rules with OneCare's default rules. In most cases, OneCare's default rules are weaker than what the average security administrator would set. Overall, OneCare is an interesting, relatively inexpensive solution for home and small business users.
