|A component of Microsoft Windows|
Windows Defender Antivirus, as appears in the Windows 10 Creators Update
|Other names||Windows Defender Antivirus (Windows 10 Creators Update and later)|
|Type||Antivirus software on Windows 8 and later (formerly spyware removal software in Windows XP and Windows 7)|
Windows Vista and later|
Windows Server 2008 and later
|Also available for||Windows XP and Windows Server 2003|
|Replaces||Microsoft Security Essentials|
|Same as the integrated version with Windows|
|Windows Defender Security Center|
Windows Defender (called Windows Defender Antivirus in Windows 10 Creators Update) is an anti-malware component of Microsoft Windows. It was first released as a downloadable free antispyware program for Windows XP, and was later shipped with Windows Vista and Windows 7. It has evolved into a full antivirus program, replacing Microsoft Security Essentials as part of Windows 8 and later versions.
Before Windows 8, Windows Defender only protected users against spyware. It includes a number of real-time security agents that monitor several common areas of Windows for changes which might have been caused by spyware. It also has the ability to remove installed ActiveX software. Windows Defender featured an integrated support for Microsoft SpyNet that allows users to report to Microsoft what they consider to be spyware, and what applications and device drivers they allow to be installed on their systems. Protection against viruses was subsequently added in Windows 8; which resembles Microsoft Security Essentials (MSE). It also uses the same anti-malware engine and virus definitions from MSE.
In Windows 10, Windows Defender settings are controlled in the Windows Defender Security Center. In the Windows 10 Anniversary Update, a new logo is introduced and a pop-up notification will appear to announce the results of a scan, even if no viruses are found.
Windows Defender was initially based on GIANT AntiSpyware, which formerly developed by GIANT Company Software, Inc. The company's acquisition was announced by Microsoft on December 16, 2004. While the original GIANT AntiSpyware officially supported older Windows versions, support for the Windows 9x line of operating systems was later dropped by Microsoft.
The first beta version of Microsoft AntiSpyware released on January 6, 2005 was a repackaged of GIANT AntiSpyware There were also more builds released in 2005, with the last Beta 1 refresh released on November 21, 2005.
At the 2005 RSA Security conference, Bill Gates, the Chief Software Architect and co-founder of Microsoft, announced that Windows Defender (formerly Microsoft AntiSpyware prior to November 4, 2005) would be made available free-of-charge to users with validly licensed Windows 2000, Windows XP, and Windows Server 2003 operating systems to secure their systems against the increasing malware threat.
Windows Defender (Beta 2) was released on February 13, 2006. It featured the program's new name and a redesigned user interface. The core engine was rewritten in C++, unlike the original GIANT-developed AntiSpyware, which was written in Visual Basic. This improved the application's performance. Also, since beta 2, the program works as a Windows service, unlike earlier releases, which enables the application to protect the system even when a user is not logged on. Beta 2 also requires Windows Genuine Advantage (WGA) validation. However, Windows Defender (Beta 2) did not contain some of the tools found in Microsoft AntiSpyware (Beta 1). Microsoft removed the System Inoculation, Secure Shredder and System Explorer tools found in MSAS (Beta 1) as well as the Tracks Eraser tool, which allowed users to easily delete many different types of temporary files related to Internet Explorer 6, including HTTP cookies, web cache, and Windows Media Player playback history. German and Japanese versions of Windows Defender (Beta 2) were later released by Microsoft.
Conversion to antivirus
Windows Defender was released with Windows Vista and Windows 7, serving as their built-in anti-spyware component. In Windows Vista and Windows 7, Windows Defender was superseded by Microsoft Security Essentials, an antivirus product from Microsoft which provided protection against a wider range of malware. Upon installation, Microsoft Security Essentials disabled and replaced Windows Defender. In Windows 8, Microsoft upgraded Windows Defender into an antivirus program very similar to Microsoft Security Essentials for Windows 7 and using the same virus definition updates. MSE itself does not run on Windows versions beyond 7. In Windows 8 and Windows 10, Windows Defender is on by default. It switches itself off upon installation of a third-party anti-virus package.
Starting with Windows 10, Microsoft began to transfer the control of Windows Defender out of its native client. Initially, its "Settings" dialog box was replaced by a dedicated page in the Settings app. In Windows 10 Creators Update, Windows Defender is renamed Windows Defender Antivirus to distinguish it from Windows Defender Security Center. The latter has become the default avenue to interface with Windows Defender. While there is no shortcut on the Start menu for Windows Defender's native client, it can still run. It was later removed in the Windows April 10, 2018 Update and transferred to Windows Defender Security Center.
- Real-time protection
- In the Windows Defender options, the user can configure real-time protection options.
- Browser integration
- Integration with Internet Explorer and Microsoft Edge enables files to be scanned as they are downloaded to detect malicious software inadvertently downloaded. Although it does not integrate with non-Microsoft web browsers, Windows Defender scans for malicious downloaded files as part of its real-time protection.
Windows 10's Anniversary Update introduced Limited Periodic Scanning, which optionally allows Windows Defender to scan a system periodically if another antivirus app is installed. It also introduced Block at First Sight, which uses machine learning to predict whether a file is malicious.
Windows Vista-specific functionality
Windows Defender had additional functionality in Windows Vista which was removed in subsequent versions of Windows:
- Security agents
- Security agents which monitor the computer for malicious activities:
- Auto Start – Monitors lists of programs that are allowed to automatically run when the user starts the computer
- System Configuration (settings) – Monitors security-related settings in Windows
- Internet Explorer Add-ons – Monitors programs that automatically run when the user starts Internet Explorer
- Internet Explorer Configurations (settings) – Monitors browser security settings
- Internet Explorer Downloads – Monitors files and programs that are designed to work with Internet Explorer
- Services and Drivers – Monitors services and drivers as they interact with Windows and programs
- Application Execution – Monitors when programs start and any operations they perform while running
- Application Registration – Monitors tools and files in the operating system where programs can register to run at any time
- Windows Add-ons – Monitors add-on programs for Windows
- Software Explorer
- The Advanced Tools section allows users to discover potential vulnerabilities with a series of Software Explorers. They provide views of startup programs, currently running software, network connected applications, and Winsock providers (Winsock LSPs). In each Explorer, every element is rated as either "Known", "Unknown" or "Potentially Unwanted". The first and last categories carry a link to learn more about the particular item, and the second category invites users to submit the program to Microsoft SpyNet for analysis by community members. The Software Explorer feature has been removed from Windows Defender in Windows 7.
- Notification of startup programs that run as an administrator
- Windows Defender in Windows Vista automatically blocks all startup items that require administrator privileges to run (this is considered suspicious behavior for a startup item). This automatic blocking is related to the User Account Control functionality in Windows Vista, and requires users to manually run each of these startup items each time they log in if they desire the item to run at startup.
- User interface
- In Windows Vista, it is possible to close the window and have the program run in the system tray while a scan is running. However, in Windows 7, this functionality was removed and the window must remain open while a scan is running.
Windows Defender Offline
Windows Defender Offline (formerly known as Standalone System Sweeper) is a bootable standalone anti-malware program that runs from a bootable disk designed to scan infected systems while their operating systems are offline. Since Windows 10 Anniversary Update, the offline functionality is integrated into the regular Windows Defender program as well.
Mitigated security vulnerability
During the December 2017 test of various anti-malware software carried out by AV-TEST on Windows 10 platform, Windows Defender has earned 6 out of 6 points in detection rate of various malware samples, earning its "AV-TEST Certified" seal. Also, during February 2018 "Real-World Protection Test" performed by AV-Comparatives, Windows Defender has achieved 100% detection rate of malicious URL samples, along with 3 false positive results.
- "Windows Defender". Download Center. Microsoft. May 23, 2007. Archived from the original on April 29, 2012.
- "What is Windows Defender?". Computer Hope. Retrieved December 31, 2017.
- Shultz, Greg. "Windows Defender: Past, present, and future". Retrieved June 13, 2017.
- "How to Remove an Active-X Control in Windows". Microsoft. Retrieved December 31, 2017.
- "What's new in Windows Defender for Windows 10 Anniversary Update". windowscentral.com. Retrieved March 27, 2018.
- Thurrot, Paul (October 6, 2010). "Microsoft Windows Anti-Spyware Preview: Paul Thurott's SuperSite for Windows". SuperSite for Windows. Retrieved November 26, 2013.
- "Microsoft Acquires Anti-Spyware Leader GIANT Company". PressPass. Microsoft. December 16, 2004. Retrieved November 11, 2009.
- "Gates Highlights Progress on Security, Outlines Next Steps for Continued Innovation". PressPass. Microsoft Corporation. February 15, 2005. Retrieved November 11, 2009.
- Thurrott, Paul (February 14, 2006). "Windows Defender Beta 2 Review: Paul Thurrott's SuperSite for Windows". SuperSite for Windows. Retrieved November 26, 2013.
- "Windows Defender: Startseite" (in German). Microsoft Corporation. Archived from the original on January 30, 2009. Retrieved May 8, 2011.
- "マイクロソフト セキュリティ At Home" (in Japanese). Microsoft Corporation. Archived from the original on January 18, 2010. Retrieved May 8, 2011.
- Thurrott, Paul (October 24, 2006). "Finally, Microsoft Ships Windows Defender". Windows IT Pro. Retrieved May 8, 2011.
- Thurrott, Paul (June 18, 2009). "Microsoft Security Essentials Public Beta". Paul Thurrott's SuperSite for Windows. Retrieved May 8, 2011.
- Hau, Kevin (June 23, 2009). "Windows Defender and Microsoft Security Essentials". Microsoft Answers. Microsoft Corporation. Retrieved May 8, 2011.
- Marius, Marius Oiaga (August 30, 2010). "Microsoft Security Essentials 1.0 and 2.0 Disable Windows Defender". Softpedia. SoftNews NET SRL. Retrieved May 8, 2011.
- Windows 8 Consumer Preview: Set Up Windows 8 with the Web Installer
- "Protect your PC". Support (12 ed.). Microsoft. September 8, 2016. Retrieved December 14, 2016.
- Lich, Brian (May 18, 2017). "Windows Defender Antivirus in the Windows Defender Security Center app". docs.microsoft.com. Microsoft.
- Popa, Bogdan (August 24, 2017). "Quick Tip: Use the Old Windows Defender in Windows 10 Creators Update". Softpedia. SoftNews.
- Williams, Wayne (August 24, 2017). "How to get the classic Windows Defender back on Windows 10 Creators Update". BetaNews.
- "How to enable Windows 10's Block at First Sight protection in Windows Defender". betanews.com. Retrieved March 27, 2018.
- "Protect Your PC with New Security Features in Windows Vista". Microsoft. November 2006. Retrieved April 12, 2018.
- "Using Software Explorer in Windows Defender". Support. Microsoft. Archived from the original on October 14, 2009. Retrieved April 26, 2017.
- O'Reilly, Dennis (April 22, 2008). "Software Explorer keeps unneeded apps from auto-starting". CNET. CBS Interactive. Retrieved May 9, 2015.
- Thurrott, Paul (October 6, 2010). "Windows 7 Annoyances". Supersite for Windows. Penton. Retrieved May 9, 2015.
- "Error message when you start a Windows Vista-based computer: 'Windows has blocked some startup programs'". Support. Microsoft. September 23, 2011. Archived from the original on April 7, 2015. Retrieved April 26, 2017.
- Whitney, Lance. "Utility Spotlight: Repair Your PC Infection". technet.microsoft.com. Retrieved April 16, 2018.
- "Help protect my PC with Windows Defender Offline". support.microsoft.com. Retrieved April 16, 2018.
- Anthony, Sebastian (May 9, 2017). "Massive vulnerability in Windows Defender leaves most Windows PCs vulnerable". Ars Technica. Condé Nast.
- "Microsoft Security Advisory 4022344". TechNet. Microsoft. May 8, 2017.
- "The best antivirus software for Windows Home User". AV-TEST.org. AV-TEST. 2018. Retrieved April 12, 2018.
- "Real-World Protection Test" (PDF). AV-Comparatives.com. AV-Comparatives. 2018. Retrieved April 12, 2018.