Windows Defender and Other Defenses Against Malware

You can configure Windows Defender to handle different levels of threatening behavior differently, on the Tools > Options dialog box, as shown in Figure 1. Windows Defender ranks the threat levels of malware as Low, Medium, High, Severe, and Not Yet Classified. By default, Windows Defender immediately quarantines Severe and High threat level programs. You can configure the way Windows Defender reacts when it detects malicious software.

Figure 1. Windows Defender performs scheduled scans of your computer and quarantines or warns you of threatening programs.

By scrolling down in this same dialog box, you can configure the way that Windows Defender alerts you when it finds malware, as shown in Figure 2.

Figure 2. Windows Defender alerts can be configured on the Tools > Options dialog box. Sometimes you might want to know when Windows Defender is taking action, and sometimes you may not want Windows Defender’s pop-up alert to bother you.

Because Windows Defender automatically quarantines applications that meet its definition of “threatening,” it may quarantine an application that you know to be safe and desirable. While the application is quarantined, you cannot launch the application. If Windows Defender quarantines a program that you choose to run, you can easily restore the program to its normal state in the Tools > Quarantined Items dialog box.

Windows Defender’s Logging Capabilities

Windows Defender also monitors all the programs that are running, looking for potentially harmful or unwanted behavior by the running processes. This is called real-time protection. As a byproduct of monitoring all running applications, you can enable logging of all known good applications and all unknown applications that are running on the computer. This increased logging can be configured in the Local Computer Policy on one computer or by Group Policy Objects (GPOs) if you are in an Active Directory environment.

Microsoft’s SpyNet Program

Windows Defender’s default settings provide automatic updating of the malware signature database. Windows Defender also reports back to Microsoft on the software that it has seen and taken action on through its SpyNet program. This is an optional service that you can choose whether to participate in. The SpyNet program collects malware statistics from Windows Defender on computers in an attempt to keep Microsoft’s malware signature database current. SpyNet is designed to collect a minimum of personal information and takes steps to ensure your anonymity.

You can opt out of the Microsoft SpyNet program by going to the History page in Windows Defender’s Options and selecting the Change Settings hyperlink adjacent to the SpyNet reference. You can view the items that you have chosen to have Windows Defender allow, as well as the items that Windows Defender has quarantined. These last two items can also be accessed from the Options page.

Alert

Another cool tool in Windows Defender is the Software Explorer, which is also accessed from the Tools dialog box. This tool shows you detailed information about all the programs running on your computer, as shown in Figure 3.

Figure 3. Startup programs can be identified in the Tools > Software Explorer dialog box.

The Software Explorer tool inside Windows Defender can display the running applications by grouping them into four categories:

• Startup Programs— Programs that launch at startup

• Currently Running Programs— Everything running on the desktop and in the background

• Network-Connected Programs— Programs that are connected to other computers over the network or the Internet

• Winsock Service Providers— Programs that assist network-connected programs

Windows Defender relies on an underlying service called (surprise!) Windows Defender, as shown in Figure 4.

To ensure that this service stays running keeping your malware protection in force, you might want to configure the Windows Defender service to restart automatically if it ever gets shut down. You can configure the service to restart on the first and second failure of the service. If the service doesn’t remain started, you can configure the service to try for what is called Trusted Recovery. On the third shutdown of the service, reboot the computer.

MSConfig.exe

Another useful tool in the battle to protect your computer from bad things is called the System Configuration Utility, or MSConfig. You can launch MSConfig.exe, shown in Figure 5, from the Start > Run (or the Start > Search) command line. Just type msconfig and click Enter.

Figure 5. MSConfig.exe allows you to view all programs configured to launch at computer bootup or at user logon.

You can use MSConfig to configure Normal, Diagnostic, or Selective startup on the General tab; adjust the Startup menu (instead of using BCDEdit) on the Boot tab; enable or disable services on the Services tab; view all programs that are configured to run at computer startup or at user logon on the Startup tab; or launch a number of configuration and diagnostic tools from the Tools tab.

The hosts File

One bad thing that malware might do is try to keep you disconnected from websites that help you identify malware, like the Windows Update and the antivirus definitions update websites. Malware often tries to block your access to these websites by adding incorrect mappings into the hosts file on your computer.

If malware modifies your hosts file, your computer thinks it knows where to find these helpful websites by looking in the hosts file. Your computer never asks public DNS servers where to find the actual websites. Because malware has incorrectly mapped these websites to the loopback address of 127.0.0.1 or some other incorrect IP address, your computer can never connect to the update sites and never gets the new updates and security updates that might just find the original malware.

Getting Rid of Malware

While you probably have installed antivirus software, and you use Windows Defender to perform automatic removal of malware, sometimes you can simply uninstall the malware. Malware, like an unwanted Internet Explorer toolbar that installs with some third-party software update, can often be uninstalled from the Control Panel > Programs and Features section. Simply click Uninstall a Program. Then click on the program that you desire to remove and click Uninstall from the overhead menu.

Sometimes it isn’t that easy to get rid of malware, and a more rigorous approach is required.

RootkitRevealer

If you are really concerned about undetected malware, Microsoft and Sysinternals have a tool called RootkitRevealer. It is a specially designed utility to detect rootkits and can be downloaded from the following website:

http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx

Rootkits are what bad guys upload to your computer when they pretty much have taken over. It is a collection of malware tools and “trojaned” applications that are designed to take control and keep control of an exploited system. The bad guys have gotten good at hiding these malicious tools from antivirus and anti-spyware detectors.