NWA-PCUG Newsletter Article, December 2006
Windows Defender – Free Anti-Spyware from Microsoft
By Ira Wilsker,
APCUG Director; Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

Iwilsker@apcug.net
(click to email author)


WEBSITE:
http://www.microsoft.com/athome/security/spyware/software

According to several computer security pundits, spyware may pose a greater threat to our online cyber safety than the traditional viruses that have assaulted us for years. Spyware is software that can gather information from our computers such as usernames and passwords and send it to parties unknown for nefarious purposes. Spyware may take control of our computers unknown to us, turning our computers into remote control zombies, and then utilize our machines to send out millions of spam emails, viruses, or to even launch coordinated attacks against computer networks. Spyware can be used to generate revenue for its creators by placing unwanted pop-up ads on our monitors, for which a fee is collected for each ad displayed (some reports indicate that as much as 80% of the pop-up ads displayed on our machines are from the spyware unwittingly installed on them).

Spyware is such a major security problem that almost all contemporary antivirus software and security suites now include some integrated anti-spyware function. Third party software publishers create and distribute some very good anti-spyware products, both commercially and as freeware. Not to be left behind in this technological marketplace, Microsoft some time ago purchased the small but well respected anti-spyware publisher “Giant”, and utilized its proven technology to create and distribute its first dedicated anti-spyware product, Microsoft Anti-Spyware Beta. This beta (pre-release) software went through several versions, each one being of limited time functionality which required the user to update the software periodically in order to maintain its anti-spyware capabilities. The beta originally functioned on Windows 2000 and XP, and was eventually renamed Windows Defender Beta, and intended for XP machines. Users of the final Windows Defender Beta 2 should be aware that the beta version will expire on December 31, 2006.

Not to be alarmed by the demise of the beta, eligible users should be heartened to know that the full release version of Windows Defender is now available for free download from Microsoft at http://www.microsoft.com/athome/security/spyware/software. Users should be aware that this final version of defender requires that a genuine copy of Windows XP (with service pack 2) or Windows Server 2003 (with service pack 1) be installed on the machine. Prior to allowing the downloading, and possibly again at the install, Microsoft will run its controversial “WGA” (Windows Genuine Authority) utility to confirm that the copy of Windows installed is indeed genuine; if the WGA detects a suspicious or pirated copy of Windows, the download and install will be blocked.

When installed, the default settings are adequate for most users. Microsoft has done a good job in determining which settings are appropriate. Personally, I am using the default settings as I found no need to change any of the settings. Once installed, the user may alter any setting desired by opening Defender, and clicking on the “Tools” icon on the menu bar, and then selecting “Options”. Possible choices include the automated running of a spyware scan at predetermined times, what default actions should be taken if different risk levels of spyware are found, and what real-time protection functions are enabled. I have my Windows Defender loaded at start-up, with the auto update feature turned on to notify me of any updates as they are released by Microsoft.

Under the “Tools” selection are several other useful options. One is to voluntarily participate in Microsoft’s SpyNet, which is an online community which will help detect, defeat, and protect against spyware attacks. Another option allows for the removal or restoration of any items that have been detected by Defender and subsequently placed under quarantine. The “Software Explorer” displays detailed information on any programs in the start-up or running; unwanted programs can be stopped with the “remove” selection. Another link will show programs that the user has explicitly allowed to load and run, while the final link will connect the user directly to the Windows Defender website.

The major purposes of any anti-spyware product are to protect from spyware attack, and to remove any spyware that may have previously infected the computer. By allowing Windows Defender to load its real-time protection at startup will provide a reasonable amount of protection from new spyware attacks and infestations. Microsoft releases frequent and periodic updates (called “definitions”), which should be downloaded and installed promptly as they become available. The other primary function is to periodically scan the computer for any infection that may have slipped through the perimeter defenses of the real-time protection function. The default is to have Defender run a daily scan at off-peak times, such as at 2am, assuming the computer is left on continuously. Personally, I choose to run the scan at my convenience, and shut down my computer when not in use. To run a scan, simply click on the “Scan” icon on the toolbar, and the selected scan option will commence. If any spyware threats are identified, Defender will take appropriate action based on the default actions, or whatever actions were selected by the user under “Options”. If no spyware is found on the contemporary scan, a checkmark will appear in a green shield with the reassuring statement, “No unwanted or harmful software detected. Your computer is running normally.” A status bar at the bottom of the page selected by the “Home” icon shows the date, time, and type of the most recent complete scan, as well as the time selected for the automated scan. An indication that real-time protection is on provides the user with the assurance that the Defender anti-spyware is loaded and running. The final item on the page shows the date and time of the latest definition file that is installed.

Personally, I found Windows Defender to be a capable anti-spyware product with reasonable features. Currently being a free product, it is a good choice for anyone with an XP or Server 2003 computer. I also have a commercial non-Microsoft internet security suite installed and running on my computer, which includes an anti-spyware function along with its antivirus, firewall, and other security features. In a non-scientific manner, I have not noticed any degradation in performance by having both installed and running simultaneously. Since spyware is such a serious threat, I do not mind having more than one item providing my primary perimeter defense.

There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author. The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.

Click here to return to top



==================================================================