PersianAdmins

I f you’ve been a Windows user for any length of time, you already know all about the dangers of

spyware. These days, it often seems as if there’s a spyware infection lurking behind every Web page, email, or downloaded file.

There’s no shortage of third-party utilities available for combating the spyware scourge, but Microsoft is finally weighing in with its own antispyware tool called Windows Defender. In beta form for most of 2006, Windows Defender is now finished and available free to licensed users of Windows XP.

Windows Defender is designed to detect and remove existing spyware, as well as prevent new infections by monitoring your system for suspicious activity. Get Windows Defender at www.windowsdefender.com;

follow the links to the download. Microsoft requires you to validate your copy of WinXP via Windows Genuine Advantage before letting you download any software, and your system

will likely require validation again upon installation of Windows Defender. Windows Defender’s installation wizard will ask you to choose from three installation options: Use Recommended Settings, Install Definition Updates Only, or Ask Me Later. Choose Install Definition Updates Only and accept the default settings.

Scan Your System

When Windows Defender’s installation is complete, it will check online for the latest updates and conduct a scan of your system. This quick scan is limited to a handful of areas spyware is most likely to infect, but on some systems, even a quick scan might take a while.

To perform a full scan of your hard drive, click the down arrow next to Scan and select Full Scan. If you want a scan to target specific files, opt for a Custom Scan. If Windows Defender finds any spyware or suspicious software, it will display some information about each item, including a description and location, an alert level, and a recommended action. There are five alert levels: Not Yet Classified, Low, Medium, High, and Severe. Anything with an alert level of High or Severe should be removed unless you trust the program. If you’re sure a program is OK, you can select Always Allow so Windows Defender won’t flag it again. If you’re not so sure, you can choose Quarantine, which will disable the software. After Windows Defender removes

harmful software, it may prompt you to reboot. Windows Defender also provides real-time protection by monitoring your system for any changes to critical files or settings. If any such changes are detected, Windows Defender will display a warning dialog box that will allow you to remove the offending program.

Customize Settings

Click Tools and Options. Decide what type of scan to perform and set up a schedule. You can also configure Windows Defender to take the recommended action instead of requiring you to do so manually. Windows Defender’s recommended actions will vary based on the software it finds, but you can override them by changing settings under Default actions.

If you find the real-time protection feature too obtrusive, you can modify the list of system settings and events that are monitored. You can also turn the feature off altogether, though we don’t recommend you do this.

Software Explorer

Msconfig has been a handy way to figure out and control which applications start each time you boot Windows. Although designed to help users streamline and speed the boot process, it can also be useful as a way to ferret out spyware or undesirable programs.

Windows Defender comes with a similar but more powerful tool called Software Explorer.

To access it, click Tools and Software Explorer. While Msconfig’s abilities are limited

to startup applications, Software Explorer goes further by providing information and

control over any currently running program, not just those set to start with Windows. And because

programs that access the Internet are often the most dangerous, Software Explorer

can also highlight those with active network connections. To change the kind of programs

Software Explorer displays, make a choice from the Category drop-down menu near the top of the window. You’ll see two display panes— the left pane contains a list of programs. Next to each name is Microsoft’s classification, based upon its spyware database. Most legitimate applications

will be listed as Permitted, though if a program’s classification is listed as In Progress, it

means Software Explorer is trying to determine the nature of the software. The right pane will display detailed information on the selected application, including its size, location, the date it was installed, and whether it was originally included with the OS. Depending on the category

you’ve selected, you may find additional information in either pane. Your options for a particular

program are also categorydependent. If you see Not Yet Classified, it means the application

isn’t yet in Microsoft’s software database

Microsoft SpyNet

Distinguishing spyware from legit software can be challenging. Microsoft approaches this by attempting to harness the wisdom of the online community with Spy- Net. Joining SpyNet is free and optional. There are two levels of membership—Basic and Advanced.

You can find it under Tools and Microsoft SpyNet. One benefit of joining Spy- Net is that knowing how other Windows Defender users chose to respond to a program may help you decide how to do so. It can also provide Microsoft with useful data that can improve the software. Before joining SpyNet, you should be aware of the possibility that personal information could be collected and

sent to Microsoft. Although the installation wizard states that no personal information

is sent with a basic SpyNet membership, the Join dialog box contradicts this: For both

basic and advanced membership, it says that personal info might unintentionally be sent,

though the company won’t use such information to identify or contact you. Given the

apparent discrepancy, if you have any concerns about signing up for SpyNet, click the

link to read Windows Defender’s privacy statement.

Support