Windows Defender Beta 2 is Microsoft's second antispyware beta release, but it really feels more like a new program. New graphics, tighter integration into the OS, and a streamlined interface all set this release apart from its predecessor, Microsoft AntiSpyware Beta 1.
Like Microsoft AntiSpyware, Windows Defender doesn't include centralized management or reporting features, so this free tool is still targeted squarely at the consumer. Still, some companies and organizations might deploy it because it's a free Microsoft product. For the consumer, this new version is a great step toward protecting Windows computers. Let's walk through some of the features in Windows Defender.
A Service, Not an Application
Windows Defender is Microsoft's foray into antispyware, spearheaded by its acquisition of Giant Software in 2004. People are obviously excited about this program—according to the Microsoft Windows Defender Web site, the product has more than 25 million active users. You can download Defender free from Microsoft, and it will also be integrated into Windows Vista.
If you're familiar with Microsoft AntiSpyware, you'll immediately notice significant changes in Windows Defender. The program now runs as a service instead of an application, which ties it more closely to the OS. For example, you can close Windows Defender during an active scan and it will keep scanning in the background.
Also, the system tray icon appears only when there's a problem or notification, much like the Windows update icon. Upon discovery of a suspicious program, Windows Defender flashes a warning on the screen, as Figure 1, shows, and displays an icon in the system tray. After you address the warning, the icon disappears.
In the Vista version, Windows Defender is included in the new malware protection portion of the Windows Security Center Control Panel application, but as of Beta 2, the Windows XP version isn't yet integrated into this console. Several features from Microsoft AntiSpyware won't appear in Windows Defender because upcoming Microsoft programs make them redundant. For example, Microsoft Internet Explorer (IE) 7.0 lets you manage Browser Helper Objects and list and remove ActiveX controls, so those features have been removed from Windows Defender.
Streamlined Interface
You'll notice that Windows Defender has fewer features to tweak. Microsoft AntiSpyware boasted over 58 distinct checkpoints; these remain embedded in Defender, but you won't see them individually. Instead, in the new version, you'll see nine protection groups —including Auto Start, System Configuration, Internet Explorer Add-ons, Services and Drivers, and Windows Add-ons—that can be monitored. You can enable or disable the real-time protection of these groups but not of the individual checkpoints. Power users and administrators won't have as much control as they did with Microsoft AntiSpyware, but most users probably won't notice.
The operation of Windows Defender is simple. From its Vistaesque interface, you can choose to scan a computer, view a history of activity, or access tools that let you configure the program and peek into software running on your computer. You can select a quick scan or a full scan or customize your own scan by specifying the drives or folders you want Defender to check. The full scan checks your entire hard drive and all currently running programs. A quick scan checks areas likely to be infected with spyware.
Microsoft also simplified the scanning interface. Microsoft AntiSpyware delineated scanned objects such as memory processes, files, registry keys, and cookies, but Windows Defender lumps all of these object types together. In addition, Windows Defender permits you to schedule only one automatic scan—you must choose between a quick daily scan or a weekly full scan; you can't schedule both.
After you run a scan, Windows Defender shows a summary of suspicious items by alert level (Severe/High or Medium/Low, as Figure 2 shows).You can remove all the detected items or click Review items detected by scanning to get more details about individual items. Details about the discovered spyware include its category, description, removal advice, and the resource (registry key, file, folder) in which the spyware was discovered. You can specify whether to ignore, quarantine, remove, or always allow a detected item (see Figure 3). When you allow an item, it's added to a list of approved applications, so you won't be prompted time and again about a program you deem safe. If you make a mistake and accidentally allow a malicious item, you can navigate to the History pane and click the Allowed Items link to view and manage these items.
The SpyNet Option
If you want more protection and don't mind giving up a little privacy to get it, you can sign up as an advanced member of the Microsoft SpyNet community through Windows Defender. Then, if Defender finds on your computer a suspicious item for which it doesn't yet have a spyware definition, it sends information about that item to the SpyNet community and displays on your computer information about what other SpyNet members have said about that item. This service is free, but the information that Defender sends Microsoft about suspicious items found on your computer could contain potentially sensitive data such as the name of a file on your system—and this might violate some companies' policies.
Software Explorer
One of the most interesting (and most usable) features of the Windows Defender UI is the Software Explorer tool, which consists of a subset of the System Explorers in Microsoft Anti-Spyware. Software Explorer lets you view details about Startup Programs, Currently Running Programs, Network Connected Programs, and Winsock Service Providers.
Microsoft has improved the presentation of information about these programs in terms of both quantity and quality. The programs are sorted by publisher name and now include data such as when the program was installed, its version, and the user running the program. Network Connected Programs is new in Windows Defender; it shows the names of the actual executables and the network ports they're connected to, so you can easily see which programs are making external connections.
Overall, Windows Defender Beta 2 simplifies and improves the experience, for most users, of working with Microsoft's antispyware tool. Some administrators might miss the fine grained capabilities of the previous version. Windows Defender Beta 2 also omits the management capabilities that third-party enterprise antispyware scanners provide. Thus, Microsoft's antispyware tool is clearly targeted to and best suited for the consumer market. Of course, Microsoft could make Defender much more manageable by simply incorporating Group Policy support for configuring Windows Defender, as the company has done for Windows Firewall.
