Using Windows Defender

It's important to run antispyware software whenever you're using your computer. Spyware and other potentially unwanted software can try to install itself on your computer any time you connect to the Internet. It can also infect your computer when you install some programs using a CD, DVD, or other removable media. Potentially unwanted or malicious software can also be programmed to run at unexpected times, not just when it is installed.

Windows Defender offers three ways to help keep spyware and other potentially unwanted software from infecting your computer:

  • Real-time protection. Windows Defender alerts you when spyware or potentially unwanted software attempts to install itself or run on your computer. It also alerts you when programs attempt to change important Windows settings.
  • SpyNet community. The online Microsoft SpyNet community helps you see how other people respond to software that has not yet been classified for risks. Seeing if other members of the community allow software can help you choose whether to allow it on your computer. In turn, if you participate, your choices are added to the community ratings to help other people choose what to do.
  • Scanning options. You can use Windows Defender to scan for spyware and other potentially unwanted software that might be installed on your computer, to schedule scans on a regular basis, and to automatically remove any malicious software that is detected during a scan.

When you use Windows Defender, it's important to have up-to-date definitions. Definitions are files that act like an ever-growing encyclopedia of potential software threats. Windows Defender uses definitions to determine if software that it detects is spyware or other potentially unwanted software, and then to alert you to potential risks. To help keep your definitions up to date, Windows Defender works with Windows Update to automatically install new definitions as they are released. You can also set Windows Defender to check online for updated definitions before scanning.

Getting started

Follow these links to learn more about spyware and Windows Defender:

  • How to tell if your computer is infected with spyware
  • Spyware: frequently asked questions
  • Understanding Windows Defender alert levels
  • Understanding Windows Defender real-time protection
  • What is Software Explorer?

Learn how to use Windows Defender

Follow these links for information about using Windows Defender:

  • Scan for spyware and other potentially unwanted software
  • Schedule when Windows Defender scans your computer
  • Keep Windows Defender definitions up to date
  • View the progress of a Windows Defender scan
  • Join the Microsoft SpyNet community
  • View or clear the history in Windows Defender
  • Report suspicious software to Microsoft SpyNet
  • Remove or restore items quarantined by Windows Defender
  • Add or remove items from the Windows Defender allowed list
  • Remove spyware from your computer
  • Turn Windows Defender real-time protection on or off
  • Turn Windows Defender on or off
  • Use Windows Defender with a firewall
  • Using Software Explorer


How to tell if your computer is infected with spyware

You might have some form of spyware on your computer if:

  • You notice new toolbars, links, or favorites that you did not intentionally add to your web browser.
  • Your home page, mouse pointer, or search program changes unexpectedly.
  • You type the address for a specific website (for example, a search engine), but you are taken to a different website without notice.
  • You see pop-up ads, even if you're not on the Internet.
  • Your computer suddenly starts running more slowly that it usually does.

There might be spyware on your computer even if you don't see any symptoms. This type of software can collect information about you and your computer without your knowledge or consent. To help protect your privacy and your computer, we recommend that you run Windows Defender or another antispyware program at all times.

Related Topics

Using Windows Defender

Turn Windows Defender on or off

Remove spyware from your computer


Spyware: frequently asked questions

Here are answers to some common questions about spyware.

What is spyware?

Spyware is software that can install itself or run on your computer without providing you with adequate notice, consent, or control. Spyware might not display symptoms after it infects your computer, but many malicious or unwanted programs can affect how your computer runs. Spyware can, for example, monitor your online behavior or collect information about you (including personally identifiable or other sensitive information), change settings on your computer, or cause your computer to run slowly.

How can I tell if I have spyware or unwanted software on my computer?

You probably have some form of spyware on your computer if:

    • You notice new toolbars, links, or favorites that you did not intentionally add to your web browser.
    • Your default home page, mouse pointer, or search program changes.
    • You type the address for a specific website (for example, a search engine), but are taken to a different website without notice.
    • You see pop-up ads, even if you're not on the Internet.
    • Your computer suddenly begins to start or run slowly.

There might be spyware on your computer even if you don't see any symptoms. This type of software can collect information about you and your computer without your knowledge or consent. Running Windows Defender whenever you use your computer can help you find and remove such software.

Where does spyware and potentially unwanted software come from?

Unwanted software can be installed by websites, downloaded programs, or a program you might install from a CD, DVD, external hard disk, or a device. Spyware is most commonly installed through free software, such as file sharing, screen savers, or search toolbars.

Can I get spyware without knowing it?

Yes, some spyware can be installed from a website through an embedded script, or program in a webpage. Some unwanted software requires your help to install through web pop-ups or free software that require you to accept a downloadable file. However, if you keep Windows up to date and don't reduce your security settings, you can minimize the chances of a spyware infection.

What do I do when a pop-up won't close until I agree to install a program or change my home page?

Some websites will repeatedly display pop-ups asking you to install a toolbar or change your home page. When this happens, try closing the browser window. If the pop-ups still appear, right-click the Internet Explorer button in the taskbar at the bottom of your screen, and then click Close Group. As a last resort, close any other programs you have open, and then restart your computer.

How can I prevent spyware?

Run up-to-date antispyware software. Programs such as Windows Defender can help prevent malicious software, spyware, and other potentially unwanted software or adware from installing itself or running on your computer. Many programs, including Windows Defender, can also scan your system automatically to find and remove spyware that might already be installed.

Keep your computer up to date. Microsoft periodically releases security updates to help prevent spyware from being installed without your knowledge. Most new antivirus programs have spyware protection, and should be kept up to date as well. We recommend that you turn on Automatic Updates for Windows, and that you update your spyware and antivirus programs regularly.

Review license agreements before installing software. When you visit websites, do not automatically agree to download anything the site offers. If you download free software, such as file sharing programs or screen savers, read the license agreement carefully. Look for clauses where you must accept advertising and pop-ups from the company, or that the software will send certain information back to the software publisher. For more information, go to the Microsoft Windows Defender website by going to http://www.microsoft.com and searching for 'Windows Defender'.

How do I remove unwanted software?

The best way to remove spyware is to run up-to-date antispyware software that can monitor software that is trying to install itself on your computer, and also scan for and remove potentially unwanted software that might already by installed. For more information about removing spyware and other unwanted software, see Using Windows Defender and Remove spyware from your computer.


Understanding Windows Defender alert levels

Alert levels help you choose how to respond to spyware and potentially unwanted software. While Windows Defender will recommend that you remove spyware, not all software that is detected is malicious or unwanted. The information in this table can help you decide what to do if Windows Defender detects potentially unwanted software on your computer.

Alert level | What it means | What to do
Severe | Widespread or exceptionally malicious programs, similar to viruses or worms, which negatively affect your privacy and the security of your computer, and can damage your computer. | Remove this software immediately.
High | Programs that might collect your personal information and negatively affect your privacy or damage your computer, for example, by collecting information or changing settings, typically without your knowledge or consent. | Remove this software immediately.
Medium | Programs that might affect your privacy or make changes to your computer that could negatively impact your computing experience, for example, by collecting personal information or changing settings. | Review the alert details to see why the software was detected. If you do not like how the software operates or if you do not recognize and trust the publisher, consider blocking or removing the software.
Low | Potentially unwanted software that might collect information about you or your computer or change how your computer works, but is operating in agreement with licensing terms displayed when you installed the software. | This software is typically benign when it runs on your computer, unless it was installed without your knowledge. If you're not sure whether to allow it, review the alert details or check to see if you recognize and trust the publisher of the software.
Not yet classified | Programs that are typically benign unless they are installed on your computer without your knowledge. | If you recognize and trust the software, allow it to run. If you do not recognize the software or the publisher, review the alert details to decide how to take action. If you're a SpyNet community member, check the community ratings to see if other users trust the software.

Related Topics

Understanding Windows Defender real-time protection

Join the Microsoft SpyNet community

Keep Windows Defender definitions up to date


Understanding Windows Defender real-time protection

Real-time protection alerts you when spyware and other potentially unwanted software attempts to install itself or run on your computer. Depending on the alert level, you can choose one of these actions to apply to the software:

  • Ignore. Allows the software to be installed or run on your computer. If the software is still running during the next scan, or if it the software tries to change security-related settings on your computer, Windows Defender will alert you about this software again.
  • Quarantine. When Windows Defender quarantines software, it moves it to another location on your computer, and then prevents the software from running until you choose to restore it or remove it from your computer.
  • Remove. Permanently deletes the software from your computer.
  • Always Allow. Adds the software to the Windows Defender allowed list and allows it to run on your computer. Windows Defender will stop alerting you to risks that the software might pose to your privacy or your computer. Add software to the allowed list only if you trust the software and the software publisher.

You are also alerted if programs attempt to change important Windows settings. Because the software is already running on your computer, you can choose one of these actions:

  • Permit. Allows the software to change security-related settings on your computer.
  • Deny. Prevents the software from changing security-related settings on your computer.

You can choose the software and settings that you want Windows Defender to monitor, but we recommend that you use all of the real-time protection options, called agents. The following table explains each agent and why it is important.

Real-time protection agent | Purpose
Auto Start | Monitors lists of programs that are allowed to automatically run when you start your computer. Spyware and other potentially unwanted software can be set to run automatically when Windows starts. That way, it can run without your knowledge and collect information. It can also make your computer start or run slowly.
System Configuration (Settings) | Monitors security-related settings in Windows. Spyware and other potentially unwanted software can change hardware and software security settings, and then collect information that can be used to further undermine your computer's security.
Internet Explorer Add-ons | Monitors programs that automatically run when you start Internet Explorer. Spyware and other potentially unwanted software can masquerade as web browser add-ons and run without your knowledge.
Internet Explorer Configurations (Settings) | Monitors browser security settings, which are your first line of defense against malicious content on the Internet. Spyware and other potentially unwanted software can try to change these settings without your knowledge.
Internet Explorer Downloads | Monitors files and programs that are designed to work with Internet Explorer, such as ActiveX controls and software installation programs. These files can be downloaded, installed, or run by the browser itself. Spyware and other potentially unwanted software can be included with these files and installed without your knowledge.
Services and Drivers | Monitors services and drivers as they interact with Windows and your programs. Because services and drivers perform essential computer functions (such as allowing devices to work with your computer), they have access to important software in the operating system. Spyware and other potentially unwanted software can use services and drivers to gain access to your computer or to try to run undetected on your computer like normal operating system components.
Application Execution | Monitors when programs start and any operations they perform while running. Spyware and other potentially unwanted software can use vulnerabilities in programs that you have installed to run malicious or unwanted software without your knowledge. For example, spyware can run itself in the background when you start a program that you frequently use. Windows Defender monitors your programs and alerts you if suspicious activity is detected.
Application Registration | Monitors tools and files in the operating system where programs can register to run at any time, not just when you start Windows or another program. Spyware and other potentially unwanted software can register a program to start without notice and run, for example, at a scheduled time each day. This allows the program to collect information about you or your computer or gain access to important software in the operating system without your knowledge.
Windows Add-ons | Monitors add-on programs (also known as software utilities) for Windows. Add-ons are designed to enhance your computing experience in areas such as security, browsing, productivity, and multimedia. However, add-ons can also install programs that will collect information about you or your online activities and expose sensitive, personal information, often to advertisers.

Related Topics

Turn Windows Defender real-time protection on or off

Scan for spyware and other potentially unwanted software

Keep Windows Defender definitions up to date

Add or remove items from the Windows Defender allowed list


What is Software Explorer?

Software Explorer in Windows Defender allows you to view detailed information about software that is currently running on your computer and that can affect your privacy or the security of your computer. You can see, for example, which programs run automatically when you start Windows and information about how these programs interact with important Windows programs and services.

Software Explorer helps you monitor the following items:

  • Startup programs, which are programs that run automatically when you start Windows, with or without your knowledge.
  • Currently running programs, which are programs that are currently running on the screen or in the background.
  • Network-connected programs, which are programs or processes that can connect to the Internet or to your home or office network.
  • Winsock service providers, which are programs that perform low-level networking and communication services for Windows and programs that run on Windows. These programs often have access to important areas of the operating system.

Note

  • If you are running Windows 2000 Service Pack 4, you can't use Software Explorer to monitor network-connected programs.

Related Topics

Using Software Explorer

Understanding Windows Defender real-time protection


Scan for spyware and other potentially unwanted software

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

In Windows Defender, you can choose to run a quick scan of your computer or a full system scan. If you suspect spyware has infected a specific area of your computer, you can customize a scan by selecting only the drives and folders that you want to check.

A quick scan checks the places on your computer's hard disk that spyware is most likely to infect. A full scan will check all files on your hard disk and all currently running programs, but it might cause your computer to run slowly until the scan is complete. We recommend that you schedule a daily quick scan. At any time, if you suspect that spyware has infected your computer, run a full scan.

To run a quick scan

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Scan.

To scan all areas of your computer

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click the Down arrow next to the Scan button, and then click Full Scan.

To scan specific areas of your computer only (custom scan)

You can select specific locations on your computer for Windows Defender to scan. However, if potentially unwanted or malicious software is detected, Windows Defender will then run a quick scan so the detected items can be removed from other areas of your computer, if needed.

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click the Down arrow next to the Scan button, and then click Custom Scan.
  3. Click Scan selected drives and folders, and then click Select.
  4. Select the files or folders that you want to scan, and then click OK.

Using advanced scanning options

When scanning your computer, you can choose from four additional options:

  • Scan the contents of archived files and folders for potential threats. Scanning these locations might increase the time required to complete a scan, but spyware and other potentially unwanted software can install itself and attempt to "hide" in these locations.
  • Use heuristics to detect potentially harmful or unwanted behavior by software that hasn't been analyzed for risks. Windows Defender uses definition files to identify known threats, but it can also detect and alert you about potentially harmful or unwanted behavior by software that is not yet listed in a definition file. For more information about definition files, see Keep Windows Defender definitions up to date.
  • Create a restore point before applying actions to detected items. Because you can set Windows Defender to automatically remove detected items, selecting this option allows you to restore system settings in case you want to use software that you didn't intend to remove.
  • Do not scan these files or locations. Use this option to select any files and folders that you don't want Windows Defender to scan.

To choose advanced scanning options

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click the Tools button, and then click Options.
  3. Under Advanced options, select the check box next to each option that you want to use.
  4. If you do not want Windows Defender to scan certain areas of your computer, under Do not scan these files or locations, click Add.
  5. Browse to the files or folders that you do not want to scan, and then click OK. Repeat this step for each file or folder that you do not want to scan.
  6. When you have finished selecting advanced options, click Apply.

Related Topics

Schedule when Windows Defender scans your computer

View the progress of a Windows Defender scan

Remove spyware from your computer


View the progress of a Windows Defender scan

You can view which type of Windows Defender scan is in progress and see how long it has been running.

To view the progress of a scan

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. If a scan is in progress, the progress is displayed until the scan is complete. If the scan is complete, the status will display the scan results, and the date and time that the scan completed.

Note

  • If a scan is in progress, you can also click the Windows Defender icon in the notification area to view the status of the scan. To choose when the icon should appear in the notification area, click Tools, click Options, and then, under Real-time protection options, click the option that you want.
  • To view when your computer was last scanned for spyware and other potentially unwanted software, check the Status area on the Windows Defender Home page.

Related Topics

Schedule when Windows Defender scans your computer

Turn Windows Defender real-time protection on or off

Scan for spyware and other potentially unwanted software


Keep Windows Defender definitions up to date

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

Definitions are files that act like an encyclopedia of known spyware and other potentially unwanted software. Because spyware is continually being developed, Windows Defender relies on up-to-date definitions to determine if software that is trying to install, run, or change settings on your computer is potentially unwanted or malicious software.

Windows Defender works with Automatic Updates in Windows to automatically install the latest definitions. To make sure that Automatic Updates is on, click Start, click Control Panel, and then click Performance and Maintenance. Click System, and then click the Automatic Updates tab.

To check for new definitions automatically before scheduled scans (recommended)

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Tools, and then click Options.
  3. Under Automatic scanning, make sure the Automatically scan my computer (recommended) check box is selected.
  4. Select the Check for updated definitions before scanning check box, and then click Save.

If you don't use scheduled scans, or if you don't get updates automatically, you should check for new definitions at least once a week. To help protect your computer, Windows Defender will notify you if your definitions are out of date for more than seven days.

To check for new definitions manually

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click the Down arrow next to Help, and then click Check for updates.

Related Topics

Scan for spyware and other potentially unwanted software

Join the Microsoft SpyNet community

Spyware: frequently asked questions


Remove spyware from your computer

Follow these procedures in order until the spyware is removed.

Use a spyware scanner and removal tool

Windows Defender is a program from Microsoft that you can download and install for Windows to help prevent malicious software, spyware, and other potentially unwanted software from infecting your computer. When Windows Defender is on, you're alerted if spyware and other potentially unwanted software tries to run or install itself on your computer. You choose if you want to ignore, quarantine, or remove each item that is detected. For more information, see Scan for spyware and other potentially unwanted software.

Spyware scanners are also frequently included in antivirus programs. If you have already installed an antivirus program, check to see if that program includes spyware protection features or if you can add them as an update, and then scan your computer regularly. You can see a list of other spyware protection programs at the Microsoft Security at Home website by going to http://www.microsoft.com and searching for 'security at home downloads'.

Troubleshoot removing spyware

Spyware can sometimes infect areas of your computer that are difficult to clean without causing further problems. If an antispyware program notifies you that it can't remove spyware, follow any directions provided by the program. If that doesn't work, try these options:

  • Check Add or Remove Programs for items that don't belong on your computer.

    Use this method with extreme caution. Control panel lists many programs, most of which are not spyware. Many spyware programs use special installation methods to avoid showing up in Add or Remove Programs. Occasionally, a spyware program will offer an uninstall option and can be removed with this method. Only remove programs you can positively identify as spyware, and do not remove programs that you might want to keep, even if you don't use them very often. To learn how to remove programs, search for "Change or remove a program" in Help and Support.

  • Restore your computer to how it was before it was infected by spyware.

    If you can identify when the spyware was installed, you might be able to use System Restore to restore your computer to the state that it was in before the problem started. You can use Software Explorer to find the installation date for some programs. See Using Software Explorer. To learn how to restore your computer to a previous state, search for "System Restore" in Help and Support.

  • Reinstall Windows.

    Some spyware can hide itself so well that it can't be removed. If you still see evidence of spyware after trying the first two solutions listed here, you might need to reinstall Windows and your programs.

    • Warning

    • Reinstalling Windows will remove spyware, but it will also delete your files and programs. If you have to reinstall Windows, make sure that you back up your documents and files, and that you have access to the installation discs you will need to reinstall your programs.

Related Topics

Using Windows Defender

Join the Microsoft SpyNet community

Spyware: frequently asked questions


Report suspicious software to Microsoft SpyNet

If you join the Microsoft SpyNet community, and if Windows Defender detects software on your computer that has not yet been classified for risks, you might be asked to send a sample of the software to Microsoft SpyNet for analysis. When you're prompted, Windows Defender displays a list of files that can help analysts determine if the software is malicious. You can choose to send some or all of the files in the list.

To send files to Microsoft SpyNet

  • If you suspect that a file or program on your computer might be spyware, you can send it to Microsoft. Complete the online instructions for reporting suspicious software to Microsoft SpyNet by going to http://www.microsoft.com and searching for 'report a possible spyware problem to Microsoft'.

To report software that might be incorrectly classified

  • If Windows Defender alerts you about software that you don't believe is malicious or unwanted, you can report the problem to Microsoft by completing the False Positive Report Form on the Microsoft Security at Home website by going to http://www.microsoft.com and searching for 'False positive report form'.

Related Topics

Remove spyware from your computer

How to tell if your computer is infected with spyware

Join the Microsoft SpyNet community

Remove or restore items quarantined by Windows Defender


Remove or restore items quarantined by Windows Defender

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

When Windows Defender quarantines software, it moves it to another location on your computer, and then prevents the software from running until you choose to restore it or remove it from your computer.

To remove or restore quarantined items

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Tools, and then click Quarantined items.
  3. Review each item and then, for each, click Remove or Restore. If you want remove all quarantined items from your computer, click Remove All.

Warning

  • Do not restore software with severe or high alert ratings because it can put your privacy and the security of your computer at risk.

Related Topics

Add or remove items from the Windows Defender allowed list

Schedule when Windows Defender scans your computer

Understanding Windows Defender alert levels


Add or remove items from the Windows Defender allowed list

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

If you trust software that Windows Defender has detected, you can stop Windows Defender from alerting you to risks that the software might pose to your privacy or your computer. To stop being alerted, you need to add the software to the Windows Defender allowed list. If you decide that you want to monitor the software again later, you can remove it from the Windows Defender allowed list at any time.

To add an item to the allowed list

  • The next time Windows Defender alerts you about the software, on the Action menu in the Alert dialog box, click Always Allow.

To remove an item from the allowed list

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Tools, and then click Allowed items.
  3. Select the item that you want to monitor again, and then click Remove From List.

Warning

  • Do not allow software with severe or high alert ratings to run on your computer because it can put your privacy and the security of your computer at risk.

Related Topics

Understanding Windows Defender alert levels

How to tell if your computer is infected with spyware

Remove or restore items quarantined by Windows Defender


View or clear the history in Windows Defender

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

The history displays actions you've applied to spyware and other potentially unwanted software that Windows Defender has detected on your computer.

To view or clear the history

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click History.
  3. To delete all items in the list, click Clear History.

Related Topics

Scan for spyware and other potentially unwanted software

Remove or restore items quarantined by Windows Defender

How to tell if your computer is infected with spyware


Using Software Explorer

Changing how a program runs on your computer, such as blocking Internet or network connections and ending processes, can cause problems with Windows and other programs. Use Software Explorer to change how a program runs on your computer only if you are certain the program is causing a problem.

To use some Software Explorer options, you must be logged on as an administrator or be a member of the Administrators group.

To view software running on your computer using Software Explorer

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Tools, and then click Software Explorer.
  3. In the Category list, select the type of software that you want to monitor.

Note

  • If you are running Windows 2000 Service Pack 4, you can't use Software Explorer to monitor network-connected programs.

Understanding Software Explorer details

Software Explorer displays basic information about programs, such as the program name, publisher, and version. Depending on the category you choose, you might also see these important types of information.

Auto Start | Indicates if the program is registered to start automatically when Windows starts.
Startup Type | The location where the program is registered to start automatically when Windows starts; for example, in the registry or the All Users Startup Folder.
Classification | Indicates if the program has been analyzed for risks to your privacy and the security of your computer. Note: Some programs that ship with the operating system, such as Internet Explorer or Windows Explorer, can be described as Not yet classified. This occurs if Windows Defender detects that additional software, such as a browser add-on or another software utility, is running with the program.
Ships with Operating System | Indicates if the program was installed as part of your Windows installation.
Digitally Signed By | Indicates if the software has been signed and, if so, if the publisher listed has signed it. If not, we recommend that you do not trust the publisher information provided with the software, and that you review more details before choosing if you trust the software itself.

Related Topics

What is Software Explorer?

Report suspicious software to Microsoft SpyNet


Schedule when Windows Defender scans your computer

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

We recommend that you schedule a daily quick scan. A quick scan will check the areas of your computer that spyware and other potentially unwanted software is most likely to infect. If you want Windows Defender to check all files and programs on your computer, run or schedule a full scan.

To enhance the security of your computer, you can choose to automatically remove spyware and other potentially unwanted software if it is detected during a scan.

To schedule scans

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Tools, and then click Options.
  3. Under Automatic scanning, select the Automatically scan my computer (recommended) check box, and then select the frequency, time of day, and type of scan that you want to run.
  4. To automatically remove spyware or other potentially unwanted software after a scan, select the Apply default actions to items detected during a scan check box.
  5. Under Default actions, select the action that you want to apply to each Windows Defender alert, and then click Save.

Notes

  • You can't select a default action for software with a severe alert rating because Windows Defender automatically removes it or alerts you to remove it. If software has not yet been classified for potential risks to your privacy or your computer, you must review information about the software and then choose an action.
  • If Windows Defender alerts you about software and you choose to ignore it by selecting Ignore in the list of available actions, you are allowing the software to run on your computer. If the software acts suspiciously at a later time, Windows Defender will alert you about the software again or automatically apply actions that you have set for each type of alert. If you trust the software and do not want Windows Defender to automatically remove or quarantine it, see Add or remove items from the Windows Defender allowed list.

Related Topics

Scan for spyware and other potentially unwanted software

View the progress of a Windows Defender scan

Turn Windows Defender real-time protection on or off

Understanding Windows Defender alert levels


Join the Microsoft SpyNet community

Windows Defender detects known spyware and other potentially unwanted software. This includes software that has not yet been analyzed for risks and any changes made to your computer by that software. By joining the online Microsoft SpyNet community, you can see how other people have responded to alerts about software that has not yet been analyzed. Seeing how other people have responded can help you decide what to do. If you choose to participate, the actions that you take for these alerts are added to the community ratings to help other people.

Spyware is continually developed, so SpyNet ratings also help Microsoft determine which software to investigate. For example, if many people deny changes by software that has not yet been classified, Microsoft will analyze the software, determine if it is spyware, and if needed, update the Windows Defender definitions. Up-to-date definitions help Windows Defender detect the latest spyware threats and keep them from infecting your computer. Even if software is not spyware, Windows Defender alerts you if it detects that software is operating in a way that might be malicious or unwanted.

If you join Microsoft SpyNet, Windows Defender automatically sends information to Microsoft about spyware, potentially unwanted software, and software or changes by software that has not yet been analyzed for risks. The actions that are applied to the software are also reported to Microsoft. For more information about reports, read the Windows Defender privacy statement on the Microsoft Security at Home website by going to http://www.microsoft.com and searching for 'Windows Defender privacy statement'.

To join the Microsoft SpyNet community

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Tools, and then click Microsoft SpyNet.
  3. Select the level of community participation you want by clicking Join with a basic membership or Join with an advanced membership, and then click Save.

Related Topics

Scan for spyware and other potentially unwanted software

Understanding Windows Defender alert levels

Read the Windows Defender privacy statement


Turn Windows Defender real-time protection on or off

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

To help prevent spyware and other unwanted software from infecting your computer, turn on Windows Defender real-time protection and select all real-time protection options. Real-time protection alerts you when spyware and other potentially unwanted software attempts to install itself or run on your computer. You are also alerted if programs attempt to change important Windows settings.

To turn real-time protection on or off

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Tools, and then click Options.
  3. Under Real-time protection options, select the Use real-time protection (recommended) check box.
  4. Select the options that you want. To help protect your privacy and your computer, we recommend that you select all real-time protection options.
  5. Under Choose if Windows Defender should notify you about:, select the options you want, and then click Save.

Related Topics

Understanding Windows Defender real-time protection

Keep Windows Defender definitions up to date

Schedule when Windows Defender scans your computer


Turn Windows Defender on or off

To complete these steps, you must be logged on as an administrator or be a member of the Administrators group.

When Windows Defender is on, you will be alerted when spyware and other potentially unwanted software tries to install itself, run on your computer, or change important Windows settings. If you use the default settings, Windows Defender will also check for new definitions, regularly scan for spyware and other potentially unwanted software, and automatically remove any malicious software that it finds.

To turn Windows Defender on or off

  1. Open Windows Defender by clicking Start, clicking Programs, and then clicking Windows Defender.
  2. Click Tools, and then click Options.
  3. Under Administrator options, select or clear the Use Windows Defender check box, and then click Save.

Related Topics

Understanding Windows Defender alert levels

Keep Windows Defender definitions up to date


Why can't I change a Windows Defender setting?

If your computer is part of a network at an organization such as a school, government agency, or a business, your organization's system administrator might have disabled Windows Defender settings by using Group Policy. Group Policy is a feature of Windows that lets system administrators manage users' access to Windows features or to settings that can affect all users on the computer. If you can't change a setting that you need to access, contact your system administrator.

If your computer is not part of a network, a user with administrator privileges might have modified Group Policy on your computer to remove access to the settings. In this case, contact the users who are administrators on your computer to modify the settings you'd like to change. If Group Policy has not been applied to Windows Defender, you might need to log on as administrator, or ask an administrator to log on and change the setting.

For more in-depth technical information about Group Policy, go to the Microsoft website for IT professionals Go to http://www.microsoft.com and search 'Vista resources for IT professionals'.


System requirements for installing Windows Defender

To install Windows Defender, you must be logged on as an administrator or be a member of the Administrators group.

Your computer, and all computers on a network for which you want to install Windows Defender, must meet these requirements.

Software and hardware | Installation requirements
Processor | Pentium 233 MHz or higher processor (Pentium III recommended)
Operating system | Microsoft Windows 2000 Service Pack 4, Windows XP Service Pack 2, or Windows Server 2003 Service Pack 1
Random Access Memory (RAM) | 64 MB RAM (minimum); 128 MB RAM (recommended)
Disk space | 20 MB of available hard disk space
Web browser | Internet Explorer 6.0 or later

Note

  • Windows Defender does not run on the Windows ME, Windows 98, or Windows NT operating systems.


Using Windows Defender with a firewall

To join the Microsoft SpyNet community, download software updates, and get the latest definitions for Windows Defender, your computer must be connected to the Internet. To help protect your computer when you go online, make sure that you turn on Windows Firewall.

If you use a different firewall, check the help for that firewall to see how to allow the program, MSASCui.exe, to access Transmission Control Protocol (TCP) port 80.

Related Topics

Join the Microsoft SpyNet community

Keep Windows Defender definitions up to date

Spyware: frequently asked questions


Remove Windows Defender from your computer

To prevent problems with removing Windows Defender, save your work and close any open programs before you begin.

To remove Windows Defender

  1. Close Windows Defender. If the program is not open but is performing a scan or another activity, right-click the Windows Defender icon in the notification area, and then click Exit.
  2. Click Start, click Control Panel, and then click Add or Remove Programs.
  3. Click Windows Defender, and then click Remove.
  4. Follow the instructions to uninstall the program.

Related Topics

System requirements for installing Windows Defender

Spyware: frequently asked questions


Windows Defender License Terms

You can read the Windows Defender license terms on the Microsoft Security at Home website by going to http://www.microsoft.com and searching for 'Windows Defender license terms'.


Read the Windows Defender privacy statement

Your privacy is important to us. You can read the privacy information about Windows Defender on the Microsoft Security at Home website by going to http://www.microsoft.com and searching for 'Windows Defender privacy statement'.