Microsoft Defender

Microsoft Defender (specifically Microsoft Defender Antivirus, and formerly Windows Defender) is an anti-malware component of Microsoft Windows. It was first released as a downloadable free anti-spyware program for Windows XP and was shipped with Windows Vista and Windows 7. It has evolved into a full antivirus program, replacing Microsoft Security Essentials in Windows 8 and later versions.[3]

Microsoft Defender Antivirus
Other namesWindows Defender
Developer(s)Microsoft
Stable release
4.18.2207.7 / 6 September 2022 (2022-09-06)[1]
Operating system
PredecessorMicrosoft Security Essentials
TypeAntivirus software

Basic features

Before Windows 8, Windows Defender only protected users against spyware.[4] It includes a number of real-time security agents that monitor several common areas of Windows for changes which might have been caused by spyware. It also has the ability to remove installed ActiveX software.[5] Windows Defender featured an integrated support for Microsoft SpyNet that allows users to report to Microsoft what they consider to be spyware, and what applications and device drivers they allow to be installed on their systems. Protection against viruses was subsequently added in Windows 8; which resembles Microsoft Security Essentials (MSE). It also uses the same anti-malware engine and virus definitions from MSE.

In Windows 10, Windows Defender settings are controlled in the Windows Defender Security Center. In the Windows 10 Anniversary Update, a new logo is introduced and a pop-up notification will appear to announce the results of a scan, even if no viruses are found.[6]

History

Microsoft AntiSpyware (Beta 1)
Microsoft AntiSpyware Beta 1 (Version 1.0.701) running on Windows XP

Windows Defender was initially based on GIANT AntiSpyware, formerly developed by GIANT Company Software, Inc.[7] The company's acquisition was announced by Microsoft on December 16, 2004.[8][9] While the original GIANT AntiSpyware officially supported older Windows versions, support for the Windows 9x line of operating systems was later dropped by Microsoft.

The first beta release of Microsoft AntiSpyware from January 6, 2005, was a repackaged version of GIANT AntiSpyware.[8] There were more builds released in 2005, with the last Beta 1 refresh released on November 21, 2005.

At the 2005 RSA Security conference, Bill Gates, the Chief Software Architect and co-founder of Microsoft, announced that Microsoft AntiSpyware would be made available free-of-charge to users with validly licensed Windows 2000, Windows XP, and Windows Server 2003 operating systems to secure their systems against the increasing malware threat.[10]

Windows Defender (Beta 2)

On November 4, 2005, it was announced that Microsoft AntiSpyware was renamed to Windows Defender.[11][12] Windows Defender (Beta 2) was released on February 13, 2006. It featured the program's new name and a redesigned user interface. The core engine was rewritten in C++, unlike the original GIANT-developed AntiSpyware, which was written in Visual Basic.[13] This improved the application's performance. Also, since Beta 2, the program works as a Windows service, unlike earlier releases, which enables the application to protect the system even when a user is not logged on. Beta 2 also requires Windows Genuine Advantage (WGA) validation. However, Windows Defender (Beta 2) did not contain some of the tools found in Microsoft AntiSpyware (Beta 1). Microsoft removed the System Inoculation, Secure Shredder and System Explorer tools found in MSAS (Beta 1) as well as the Tracks Eraser tool, which allowed users to easily delete many different types of temporary files related to Internet Explorer 6, including HTTP cookies, web cache, and Windows Media Player playback history.[8] German and Japanese versions of Windows Defender (Beta 2) were later released by Microsoft.[14][15]

Windows Defender (Final)

On October 23, 2006, Microsoft released the final version of Windows Defender.[16] It supports Windows XP and Windows Server 2003; however, unlike the betas, it doesn't run on Windows 2000.[17]: qt  Some of the key differences from the beta version are improved detection, redesigned user interface and delivery of definition updates via Automatic Updates.[18]

Conversion to antivirus

Windows Defender was released with Windows Vista and Windows 7, serving as their built-in anti-spyware component. In Windows Vista and Windows 7, Windows Defender was superseded by Microsoft Security Essentials, an antivirus product from Microsoft which provided protection against a wider range of malware. Upon installation, Microsoft Security Essentials disabled and replaced Windows Defender.[19][20]

In Windows 8, Microsoft upgraded Windows Defender into an antivirus program very similar to Microsoft Security Essentials for Windows 7[3] and using the same virus definition updates. Microsoft Security Essentials itself does not run on Windows versions beyond 7.[19] In Windows 8 and Windows 10, Windows Defender is on by default. It switches itself off upon installation of a third-party anti-virus package.[21][22]: 8 

Name changes

Starting with Windows 10, Microsoft began to transfer the control of Windows Defender out of its original user interface. Initially, its "Settings" dialog box was replaced by a dedicated page in the Settings app. Then, in the 1703 update, Windows Defender was renamed to Windows Defender Antivirus[23]: qt  and became part of the Windows Defender Security Center app,[24]: qt  but the original user interface could still be accessed by alternative methods.[25][26] In the 1803 update, its original user interface ceased to be available.[lower-alpha 1] In the 1809 update, the Windows Defender Security Center app was renamed to Windows Security Center.[32]: qt  In the 2004 update, the Windows Defender Antivirus was renamed to Microsoft Defender Antivirus.[33][34]: qt 

Advanced features

Real-time protection
Windows Defender real-time notification

In the Windows Defender options, the user can configure real-time protection options. Windows 10's Anniversary Update introduced Limited Periodic Scanning, which optionally allows Windows Defender to scan a system periodically if another antivirus app is installed.[6] It also introduced Block at First Sight, which uses machine learning to predict whether a file is malicious.[35]

Browser integration
Demonstration of Microsoft Defender Browser Protection on Chrome. Pictured here is the warning that the website in question "has been reported as unsafe".

Integration with Internet Explorer and Microsoft Edge enables files to be scanned as they are downloaded to detect malicious software inadvertently downloaded. As of April 2018, Microsoft Defender is also available for Google Chrome via an extension and works in conjunction with Google Safe Browsing.

Application Guard
Application Guard on Microsoft Edge

A feature released in early 2018, Windows Defender Application Guard is a feature exclusive to Microsoft Edge that allows users to sandbox their current browsing session from the system. This prevents a malicious website or malware from affecting the system and the browser. Application Guard is a feature only available on Windows 10 Pro and Enterprise. In May 2019, Microsoft announced Application Guard for Google Chrome and Firefox. The extension, once installed, will open the current tabs web page in Microsoft Edge with Application Guard enabled.

Controlled Folder Access
A notification showing Microsoft Defender has blocked access to a protected folder.

Controlled Folder Access is a feature introduced with Windows 10 Fall Creators Update to protect a user's important files from the growing threat of ransomware. This feature was released about a year later after the Petya family of ransomware first appeared. The feature will notify the user every time a program tries to access these folders and will be blocked unless given access via the user. Windows will warn the user with a User Account Control popup as a final warning if they opt to "Allow" a program to read Controlled Folders.

Windows Vista-specific functionality

Windows Defender had additional functionality in Windows Vista which was removed in subsequent versions of Windows:[36]

Security agents

Security agents which monitor the computer for malicious activities:

  • Auto Start – Monitors lists of programs that are allowed to automatically run when the user starts the computer
  • System Configuration (settings) – Monitors security-related settings in Windows
  • Internet Explorer Add-ons – Monitors programs that automatically run when the user starts Internet Explorer
  • Internet Explorer Configurations (settings) – Monitors browser security settings
  • Internet Explorer Downloads – Monitors files and programs that are designed to work with Internet Explorer
  • Services and Drivers – Monitors services and drivers as they interact with Windows and programs
  • Application Execution – Monitors when programs start and any operations they perform while running
  • Application Registration – Monitors tools and files in the operating system where programs can register to run at any time
  • Windows Add-ons – Monitors add-on programs for Windows

Software Explorer

The Advanced Tools section allows users to discover potential vulnerabilities with a series of Software Explorers. They provide views of startup programs, currently running software, network connected applications, and Winsock providers (Winsock LSPs). In each Explorer, every element is rated as either "Known", "Unknown" or "Potentially Unwanted". The first and last categories carry a link to learn more about the particular item, and the second category invites users to submit the program to Microsoft SpyNet for analysis by community members.[37][38] The Software Explorer feature has been removed from Windows Defender in Windows 7.[39]

Notification of startup programs that run as an administrator

Windows Defender in Windows Vista automatically blocks all startup items that require administrator privileges to run (this is considered suspicious behavior for a startup item). This automatic blocking is related to the User Account Control functionality in Windows Vista, and requires users to manually run each of these startup items each time they log in if they desire the item to run at startup.[40]

User interface

In Windows Vista, it is possible to close the window and have the program run in the system tray while a scan is running. However, in Windows 7, this functionality was removed and the window must remain open while a scan is running.

Windows Defender Offline

Windows Defender Offline (formerly known as Standalone System Sweeper)[41] is a stand-alone anti-malware program that runs from bootable removable media (e.g. CD or USB flash drive) designed to scan infected systems while the Windows operating system is offline.[42] Since Windows 10 Anniversary Update in 2016, the option to boot into Windows Defender Offline can be initiated from within Windows itself, negating the need for the separate boot disk.

Mitigated security vulnerability

On May 5, 2017, Tavis Ormandy, a vulnerability researcher from Google, discovered a security vulnerability in the JavaScript analysis module (NScript) of Microsoft Antimalware Engine (MsMpEngine) that impacted Windows Defender, Microsoft Security Essentials and System Center Endpoint Protection. By May 8, 2017, Microsoft had released a patch to all affected systems. Ars Technica commended Microsoft for its unprecedented patching speed and said that the disaster had been averted.[43][44]

Reviews

During a December 2017 test of various anti-malware software carried out by AV-TEST on Windows 10, Windows Defender earned 6 out of 6 points in detection rate of various malware samples, earning its "AV-TEST Certified" seal.[45]

During a February 2018 "Real-World Protection Test" performed by AV-Comparatives, Windows Defender achieved a 100% detection rate of malicious URL samples, along with 3 false positive results.[46]

An AV-TEST test of Windows Defender in October 2019 demonstrated it provides excellent protection both against viruses and 0-day / malware attacks.[47]

On December 1, 2021, AV-TEST gave Defender a maximum protection score of 34 points after successfully managing to detect ten out of ten ransomware samples in a lab test.[48]

See also

Notes
  1. As reported in Microsoft forums,[27] comments to news articles[28][29] and other forums.[30][31]

References
  1. "KB4052623". catalog.update.microsoft.com. Retrieved 10 February 2022.
  2. "Windows Defender". Download Center. Microsoft. 23 May 2007. Archived from the original on 29 April 2012.
  3. Kingsley, Robert (18 January 2013). "Windows Defender in Windows 8 and Windows 7 – What's New & Different?". www.digitalcitizen.life. Archived from the original on 19 December 2020. Retrieved 4 March 2021.
  4. Shultz, Greg (17 November 2016). "Windows Defender: Past, present, and future". Retrieved 13 June 2017.
  5. "How to Remove an Active-X Control in Windows". Microsoft. Retrieved 31 December 2017.
  6. "What's new in Windows Defender for Windows 10 Anniversary Update". windowscentral.com. 26 July 2016. Retrieved 27 March 2018.
  7. "Microsoft Acquires Anti-spyware Leader Giant Company Software Inc". www.giantcompany.com. December 2004. Archived from the original on 30 December 2004. Retrieved 21 December 2020.
  8. Thurrot, Paul (6 October 2010). "Microsoft Windows Anti-Spyware Preview: Paul Thurott's SuperSite for Windows". SuperSite for Windows. Archived from the original on 5 August 2016. Retrieved 21 December 2020.
  9. "Microsoft Acquires Anti-Spyware Leader GIANT Company". PressPass. 16 December 2004. Archived from the original on 17 June 2005. Retrieved 21 December 2020.
  10. "Gates Highlights Progress on Security, Outlines Next Steps for Continued Innovation". PressPass. 15 February 2005. Archived from the original on 6 June 2005. Retrieved 21 December 2020.
  11. Garms, Jason (4 November 2005). "What's in a name?? A lot!! Announcing Windows Defender!". blogs.technet.com. Archived from the original on 23 November 2005. Retrieved 21 December 2020.
  12. Dodson, Steve (4 November 2005). "Microsoft Windows AntiSpyware is now......"Windows Defender"". blogs.technet.com. Archived from the original on 24 November 2005. Retrieved 21 December 2020.
  13. Thurrott, Paul (14 February 2006). "Windows Defender Beta 2 Review: Paul Thurrott's SuperSite for Windows". SuperSite for Windows. Archived from the original on 7 January 2015. Retrieved 21 December 2020.
  14. "Windows Defender: Startseite" (in German). Microsoft Corporation. Archived from the original on 30 January 2009. Retrieved 21 December 2020.
  15. "マイクロソフト セキュリティ At Home" (in Japanese). Microsoft Corporation. Archived from the original on 18 January 2010. Retrieved 21 December 2020.
  16. "Windows Defender: Release notes". www.microsoft.com. 23 October 2006. Archived from the original on 30 October 2006. Retrieved 21 December 2020.
  17. "Windows® Defender". www.microsoft.com. 8 November 2006. Archived from the original on 18 November 2006. Retrieved 21 December 2020.
  18. "Frequently asked questions about Windows Defender". www.microsoft.com. 13 February 2006. Archived from the original on 30 October 2006. Retrieved 21 December 2020.
  19. Hau, Kevin (23 June 2009). "Windows Defender and Microsoft Security Essentials". Microsoft Answers. Microsoft Corporation. Retrieved 19 December 2020.
  20. Marius, Marius Oiaga (30 August 2010). "Microsoft Security Essentials 1.0 and 2.0 Disable Windows Defender". news.softpedia.com. Retrieved 19 December 2020.
  21. "Microsoft Defender Antivirus compatibility". docs.microsoft.com. 17 December 2020. Retrieved 19 December 2020.
  22. Bott, Ed (2013). Introducing Windows 8.1 for IT Professionals (PDF). Microsoft Press (published 15 October 2013). ISBN 978-0-7356-8427-0.
  23. "What's new in Windows 10, version 1703 for IT Pros". docs.microsoft.com. 9 May 2017. Archived from the original on 2 June 2017. Retrieved 19 December 2020.
  24. Lich, Brian (18 May 2017). "Windows Defender Antivirus in the Windows Defender Security Center app". docs.microsoft.com. Archived from the original on 3 August 2017. Retrieved 19 December 2020.
  25. Popa, Bogdan (24 April 2017). "Quick Tip: Use the Old Windows Defender in Windows 10 Creators Update". www.softpedia.com. Archived from the original on 27 April 2017. Retrieved 5 March 2021.
  26. Williams, Wayne (24 August 2017). "How to get the classic Windows Defender back on Windows 10 Creators Update". BetaNews. Archived from the original on 5 March 2021. Retrieved 5 March 2021.
  27. "How to Get the Old Windows Defender in Windows 10 Back". social.microsoft.com. There appears to be no way to access the "classic UI" in 1803.
  28. "How to Get the Old Windows Defender in Windows 10 Back". 29 June 2017. Since the new Windows 10 Update 1803, this no longer works. (Comments section)
  29. "Get Classic Windows Defender in Windows 10 Creators Update". 18 April 2017. Classic UI its gone on windows 10 enterprise 1803, try other way pls (Comments section)
  30. "Version 1803 and Windows Defender". In previous versions a link to [...] MSASCui.exe" opened the program in the "classic" user interface but no longer.
  31. "Windows 10 & Windows Defender Interface". the "Classic" Windows Defender interface has been removed in the 1803 version of Windows 10
  32. "What's new in Windows 10, version 1809 for IT Pros". docs.microsoft.com. September 2018. Archived from the original on 11 November 2020. Retrieved 19 December 2020.
  33. "Announcing Windows 10 Insider Preview Build 18945". Windows Experience Blog. 26 July 2019. Archived from the original on 26 July 2019. Retrieved 19 December 2020.
  34. "Windows Security: Microsoft Defender Antivirus & More". www.microsoft.com. June 2020. Archived from the original on 30 June 2020. Retrieved 21 December 2020.
  35. "How to enable Windows 10's Block at First Sight protection in Windows Defender". betanews.com. 18 November 2016. Retrieved 27 March 2018.
  36. "Protect Your PC with New Security Features in Windows Vista". Microsoft. November 2006. Retrieved 12 April 2018.
  37. "Using Software Explorer in Windows Defender". Support. Microsoft. Archived from the original on 14 October 2009. Retrieved 26 April 2017.
  38. O'Reilly, Dennis (22 April 2008). "Software Explorer keeps unneeded apps from auto-starting". CNET. CBS Interactive. Retrieved 9 May 2015.
  39. Thurrott, Paul (6 October 2010). "Windows 7 Annoyances". Supersite for Windows. Penton. Archived from the original on 1 July 2015. Retrieved 9 May 2015.
  40. "Error message when you start a Windows Vista-based computer: 'Windows has blocked some startup programs'". Support. Microsoft. 23 September 2011. Archived from the original on 7 April 2015. Retrieved 26 April 2017.
  41. Whitney, Lance. "Utility Spotlight: Repair Your PC Infection". technet.microsoft.com. Retrieved 16 April 2018.
  42. "Help protect my PC with Windows Defender Offline". support.microsoft.com. Retrieved 16 April 2018.
  43. Anthony, Sebastian (9 May 2017). "Massive vulnerability in Windows Defender leaves most Windows PCs vulnerable". Ars Technica. Condé Nast.
  44. "Microsoft Security Advisory 4022344". TechNet. Microsoft. 8 May 2017.
  45. "The best antivirus software for Windows Home User". AV-TEST.org. AV-TEST. 2018. Retrieved 12 April 2018.
  46. "Real-World Protection Test" (PDF). AV-Comparatives.com. AV-Comparatives. 2018. Retrieved 12 April 2018.
  47. "Test Microsoft Windows Defender 4.18 for Windows 10 (194015)". www.av-test.org. Retrieved 2020-09-04.
  48. "9 Security Packages for Consumer Users in an Advanced Threat Protection Test against Ransomware". AV-TEST.org. AV-TEST. 2021. Retrieved 1 December 2021.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.