Malware

Operating System Infection Rates

The features and updates that are available with different versions of the Windows operating system, along with the differences in the way people and organizations use each version, affect the infection rates for the different versions and service packs.

The chart below shows the infection rate for each currently supported Windows operating system/service pack combination that accounted for at least 0.1 percent of total MSRT executions in 2Q11.

Infection rate (CCM) by operating system and service pack in 2Q11

Infection rate (CCM) by operating system and service pack in 2Q11

“32” = 32-bit edition; “64” = 64-bit edition. SP = Service Pack. Supported operating systems with at least 0.1 percent of total executions in 2Q11 shown.

Click on the Image to Enlarge

  • This data is normalized: the infection rate for each version of Windows is calculated by comparing an equal number of computers per version (for example, 1,000 Windows XP SP3 computers to 1,000 Windows 7 RTM computers).
  • As in previous periods, infection rates for more recently released operating systems and service packs are consistently lower than earlier ones, for both client and server platforms. Windows 7 and Windows Server 2008 R2, the most recently released Windows client and server versions, respectively, have the lowest infection rates on the chart.
  • Infection rates for the 64-bit versions of Windows Vista and Windows 7 are lower than for the corresponding 32-bit versions of those operating systems. One reason might be that 64-bit versions of Windows still appeal to a more technically savvy audience than their 32-bit counterparts, despite increasing sales of 64-bit Windows versions among the general computing population. Kernel Patch Protection (KPP), a feature of 64-bit versions of Windows that protects the kernel from unauthorized modification, might also contribute to the discrepancy by preventing certain types of malware from operating.

CCM trends for currently and recently supported 32-bit versions of Windows XP, Windows Vista, and Windows 7, 1Q10–2Q11

CCM trends for currently and recently supported 32-bit versions of Windows XP, Windows Vista, and Windows 7, 1Q10–2Q11

Click on the Image to Enlarge

  • Newer operating systems and service packs consistently have lower infection rates than their older counterparts, with Windows 7 having the lowest infection rates of any client version of Windows.
  • Infection rates for Windows XP SP3 and Windows Vista declined following the February 2011 release of a security update that changed the way the AutoRun feature works on those platforms to match its functionality in Windows 7. The impact of this change can be seen in the infection statistics for Win32/Rimecud, the 9th most commonly detected family worldwide in 1H11 and one of the top abusers of the AutoPlay feature.

Increase or decrease of Win32/Rimecud detections with different operating system/service pack combinations

Increase or decrease of Win32/Rimecud detections with different operating system/service pack combinations

Windows XP SP3 and the two supported Windows Vista service packs received the AutoRun update, and detections of Rimecud on those platforms went down by an average of 2.1 computers cleaned per 1000. Windows 7 already included the more secure AutoPlay functionality; consequently, detections of Rimecud were nearly unchanged.

  • Infection rates for Windows 7 RTM and SP1 were higher in 2Q11, primarily because of increased detections of a number of virus and worm families, notably Win32/Sality, Win32/Ramnit, Win32/Brontok, and Win32/Nuqel. Detections of most of these families also increased on Windows XP and Windows Vista, although the infection rates for those platforms were lower overall because of the AutoPlay change discussed earlier.
Top of page Top of Page
SIR

Locations

United States Change All Microsoft Sites

Search

Feedback:

Was the information in this article helpful?