Security Essentials - Stopping Spyware with Windows Defender

Spyware is a term that has come to describe a variety of undesirable software programs, whose bad behavior ranges from annoying you with pop-up ads to surreptitiously sending your private information to other people. Indications of common spyware infections include the following:

• Unexpected new toolbars, favorites, and links in your web browser

• Changes to your browser's home page and default search provider

• Numerous pop-up ads

• Sudden occurrence of computer crashes or slow performance

Note that spyware doesn't necessarily "spy" on you. A common characteristic of anything dubbed "spyware" is that it does its deeds—malicious or otherwise—without your informed consent. (Spyware typically gets installed by deceitfully asking permission to do something other than what it actually does or, in some cases, by exploiting browser vulnerabilities. In this regard, most spyware is fundamentally different from earlier types of malware; it typically relies on social engineering to install instead of exploiting vulnerabilities.)

That's where Windows Defender comes in. For known malicious programs that have no redeeming value to you, it intercedes without disturbing you and then quarantines or removes the offending program. Other "spyware" programs, along with programs that perform activities that are suspiciously similar to known spyware tactics, fall into a gray area; when Windows Defender encounters one of these programs knocking at your door, it suggests a solution and asks what you want to do.

Note:

For detailed information about the criteria that Windows Defender uses to identify spyware, visit w7io.com/1517.

In addition to its real-time protection for spyware-like behavior, Windows Defender (shown in Figure 1) also scans your computer's files periodically, looking for known spyware.

Windows Defender runs as a service, which allows it to provide protection for all users on your computer. The Windows Defender user interface runs in the context of the current user (therefore, UAC elevation is required for some actions), but the scanning and spyware removal is done by the service—and without the need for administrative privileges.

Note:

Windows Defender is a good antispyware solution for computers in homes and in small business networks. If you use a domain-based network, you might want to look into Microsoft Forefront Client Security (w7io.com/1519), which provides spyware protection with centralized control, management, and reporting.

1. Scanning Your Computer for Spyware

Scanning is one of the two primary detection mechanisms in Windows Defender. (The other is real-time protection.) When Windows Defender scans your computer, it checks applications it finds against a database of spyware definitions. The database, which is frequently updated via Windows Update, contains detailed information about known spyware, including file names and version numbers, a description of the threat presented by each program, and a recommended action to take if the program is found on your computer.

Scanning performance has been improved in Windows 7. Automatic scans, which run at low priority, use better algorithms to determine when your computer is idle than does Windows Defender in Windows Vista; this enables scans to run efficiently when you're not using your computer and to stay out of the way when you are. In addition, the scanning engine uses a caching system that improves performance over time, persisting through reboots and spy-ware definition updates.

1.1. Scanning Automatically

By default, Windows Defender scans your computer automatically once a day; your current scan schedule appears near the bottom of the home page in Windows Defender, shown in Figure 15-8. You can modify the schedule and set other scanning options by clicking Tools and then clicking Options. The Options page is shown next.

The Automatic Scanning panel of the Options page is where you specify a schedule and the type of scan: quick or full. A quick scan checks only the places on your computer that spy-ware is most likely to infect, and it is the recommended setting for frequent regular scans. A full scan checks all files on your local hard disk drives and all running programs, and it is likely to slow down your computer during its sometimes lengthy run.

Before you leave the Options page, review some additional, less intuitive options that affect scanning:

• Excluded Files and Folders In this box, you can specify files or folders that you know to be safe. Generally, the only reason to consider excluding files in this way is if you have a program that you knowingly run regularly and that is detected by Windows Defender every time it runs, despite your telling it to allow the program. If this happens, you should exclude the detected file (or files) rather than its containing folder; if you grant blanket approval for files in the containing folder, and later some real spyware ends up in the folder, Windows Defender won't detect it.

• Excluded File types Similarly, you can exclude from scans all files with the file name extensions that you specify.

• Advanced The first three options on the Advanced panel expand the scope of Windows Defender scans when selected. Note that archive files—the subject of the first option—provide the storage mechanism for compressed folders as well as .zip and .cab files.

1.2. Scanning Manually

Regular automatic scanning is normally suffiicient for identifying and resolving spyware problems. However, if you suspect that you've been infected—or if you've disabled automatic scanning—you can scan on demand. To immediately run a quick scan, simply click the Scan button on the toolbar. If you want to run a full scan, which is a better option if you suspect infection, click the arrow next to the Scan button and click Full Scan. The Custom Scan option lets you narrow your scan to the drives and folders you specify.

2. Using Real-Time Protection

Real-time protection runs in the background, always on the lookout for spyware that attempts to install itself or to run. To enable real-time protection, open the Options page and click Real-Time Protection. For full protection, be sure that all check boxes are selected.

When real-time protection is enabled, if Windows Defender encounters spyware (or suspected spyware), an alert appears by the Action Center icon in the notification area, as shown below.

3. Responding to Windows Defender Alerts

If Windows Defender detects the presence of spyware, whether during the course of a scan or caught by real-time protection, you must decide how to handle it. If you see an alert triggered by real-time protection, as shown above, click the alert balloon (or, if it deflates before you have a chance to click it, click the Action Center icon and click Potentially Harmful Software Detected). Alternatively, on the Home page of Windows Defender (shown earlier in Figure 15-8), click Review Detected Items. A Windows Defender Alert dialog box opens, as shown in Figure 2.

For each suspected spyware program, you can specify one of three actions:

• Remove Windows Defender permanently removes the detected spyware from your computer.

• Quarantine Windows Defender moves the program to a different folder and prevents the program from running.

• Allow Windows Defender allows the program to be installed or to run and adds the program to the allowed list; Windows Defender no longer alerts you to its presence and its risks. You should allow only software that you know to be safe.

If you simply want to remove all detected items, click Clean System; Windows Defender begins the removal process and reports the results when it completes. If you're unsure which action to take, click Show Details to display additional information, advice, and a link to online details about the selected item. After you select an action for each item, click Apply Actions. If you later change your mind about items you chose to quarantine or allow, you can reverse those decisions, as described in the following section.

4. Working with Allowed and Quarantined Items

When you choose to let Windows Defender remove a detected spyware item, whether by selecting the Remove action or by clicking Clean System, it's gone for good. That's not the case with items for which you select the Allow or Quarantine actions. The detected files remain on your system. You can view and manage allowed and quarantined items from the Tools page in Windows Defender.

Allowed files remain in their original location, and you can use them without interference from Windows Defender. If you later change your mind, you can remove an item from the allowed list. On the Tools page, click Allowed Items. By default, Windows Defender hides allowed items to protect the privacy of other users on your computer (allowed items for all users appear here); click View and respond to the UAC elevation prompt to view the files. To remove a program from the allowed list, shown in Figure 3, select the item and click Remove From List. Windows Defender does not remove the program from your computer—but it does resume monitoring it and warning you when the program does something provocative.

Quarantined items are moved to an isolated folder location where they can't be accessed, except through Windows Defender. If you later decide what you want to do with a quarantined item, you can visit the quarantine, where you can choose to restore an item (that is, return it to its prequarantine condition) or remove it from your computer. On the Tools page, click Quarantined Items and then click View to expose the file list and the available actions: Remove All (removes all quarantined files from your computer), Remove (removes the selected item), or Restore (returns the selected item to its previous location).

5. Disabling Windows Defender

Choices on the Options page—specifically, the first option on the Automatic Scanning and Real-Time Protection panels—let you turn off automatic scanning and real-time protection. Even if you turn off both options, however, the Windows Defender service continues to run and the program remains available for manual scans. If you want to disable Windows Defender altogether, open Windows Defender, click Tools, click Options, and then click Administrator. Clear the Use This Program check box to disable Windows Defender.