Most of Microsoft's efforts to lock down Vista were wasted, according to a new study. Although built on the more secure Windows Server 2003 platform and including new features such as User Account Control to prevent some automatic infections, the new OS shows "little or no security gains" compared to its five-year-old predecessor Windows XP. Systems using the default security tools were connected directly to the Internet in the study and were found to be roughly as vulnerable to attack, including both direct attacks and web-based exploits

Vista's updated Windows Defender security suite was only slightly more effective at trapping spyware and trojans, the report says. It found some threats but still allowing a large amount of malicious code to get through. Compromised systems did nothing to stop attempts to contact extra malicious sites for further exploits, the researchers said.

The study has concluded that most of the enhancements brought about by Vista are primarily superficial notifications to prevent users from accidentally agreeing to spyware or virus installs. Shops and others supplying computers were still asked to supply their own third-party security tools from McAfee, Norton, and other firms rather than relying on Vista's default security for inexperienced users.

"Vista remains riddled with holes," the report says.