A request that this article title be changed to Microsoft Defender Antivirus is under discussion. Please do not move this article until the discussion is closed. |
Other names | Windows Defender |
---|---|
Developer(s) | Microsoft |
Stable release | 4.18.2210.6 / 10 November 2022 [1] |
Operating system |
|
Predecessor | Microsoft Security Essentials |
Type | Antivirus software |
Microsoft Defender Antivirus (formerly Windows Defender) is an anti-malware component of Microsoft Windows. It was first released as a downloadable free anti-spyware program for Windows XP and was shipped with Windows Vista and Windows 7. It has evolved into a full antivirus program, replacing Microsoft Security Essentials in Windows 8 or later versions. [3]
As of 2021, Defender Antivirus is part of a much larger Microsoft Defender brand.
As of 2021, Microsoft Defender Antivirus is part of the much larger Microsoft Defender brand, which includes several other software and service offerings, including:
Before Windows 8, Windows Defender only protected users against spyware. [12] It includes a number of real-time security agents that monitor several common areas of Windows for changes which might have been caused by spyware. It also has the ability to remove installed ActiveX software. [13] Windows Defender featured an integrated support for Microsoft SpyNet that allows users to report to Microsoft what they consider to be spyware[ citation needed ], and what applications and device drivers they allow to be installed on their systems. Protection against viruses was subsequently added in Windows 8; which resembles Microsoft Security Essentials (MSE). It also uses the same anti-malware engine and virus definitions from MSE.
In Windows 10, Windows Defender settings are controlled in the Windows Defender Security Center. In the Windows 10 Anniversary Update, a new logo is introduced and a pop-up notification will appear to announce the results of a scan, even if no viruses are found. [14]
In the Windows Defender options, the user can configure real-time protection options. Windows 10's Anniversary Update introduced Limited Periodic Scanning, which optionally allows Windows Defender to scan a system periodically if another antivirus app is installed. [14] It also introduced Block at First Sight, which uses machine learning to predict whether a file is malicious. [15]
Integration with Internet Explorer and Microsoft Edge enables files to be scanned as they are downloaded to detect malicious software inadvertently downloaded. As of April 2018, Microsoft Defender is also available for Google Chrome via an extension and works in conjunction with Google Safe Browsing.
A feature released in early 2018, Windows Defender Application Guard is a feature exclusive to Microsoft Edge that allows users to sandbox their current browsing session from the system. This prevents a malicious website or malware from affecting the system and the browser. Application Guard is a feature only available on Windows 10 Pro and Enterprise. In May 2019, Microsoft announced Application Guard for Google Chrome and Firefox. The extension, once installed, will open the current tabs web page in Microsoft Edge with Application Guard enabled.
Controlled Folder Access is a feature introduced with Windows 10 Fall Creators Update to protect a user's important files from the growing threat of ransomware. This feature was released about a year later after the Petya family of ransomware first appeared. The feature will notify the user every time a program tries to access these folders and will be blocked unless given access via the user. Windows will warn the user with a User Account Control popup as a final warning if they opt to "Allow" a program to read Controlled Folders.
Windows Defender was initially based on GIANT AntiSpyware, formerly developed by GIANT Company Software, Inc. [16] The company's acquisition was announced by Microsoft on December 16, 2004. [17] [18] While the original GIANT AntiSpyware officially supported older Windows versions, support for the Windows 9x line of operating systems was later dropped by Microsoft.
The first beta release of Microsoft AntiSpyware from January 6, 2005, was a repackaged version of GIANT AntiSpyware. [17] There were more builds released in 2005, with the last Beta 1 refresh released on November 21, 2005.
At the 2005 RSA Security conference, Bill Gates, the Chief Software Architect and co-founder of Microsoft, announced that Microsoft AntiSpyware would be made available free-of-charge to users with validly licensed Windows 2000, Windows XP, and Windows Server 2003 operating systems to secure their systems against the increasing malware threat. [19]
On November 4, 2005, it was announced that Microsoft AntiSpyware was renamed to Windows Defender. [20] [21] Windows Defender (Beta 2) was released on February 13, 2006. It featured the program's new name and a redesigned user interface. The core engine was rewritten in C++, unlike the original GIANT-developed AntiSpyware, which was written in Visual Basic. [22] This improved the application's performance. Also, since Beta 2, the program works as a Windows service, unlike earlier releases, which enables the application to protect the system even when a user is not logged on. Beta 2 also requires Windows Genuine Advantage (WGA) validation. However, Windows Defender (Beta 2) did not contain some of the tools found in Microsoft AntiSpyware (Beta 1). Microsoft removed the System Inoculation, Secure Shredder and System Explorer tools found in MSAS (Beta 1) as well as the Tracks Eraser tool, which allowed users to easily delete many different types of temporary files related to Internet Explorer 6, including HTTP cookies, web cache, and Windows Media Player playback history. [17] German and Japanese versions of Windows Defender (Beta 2) were later released by Microsoft. [23] [24]
On October 23, 2006, Microsoft released the final version of Windows Defender. [25] It supports Windows XP and Windows Server 2003; however, unlike the betas, it doesn't run on Windows 2000. [26] Some of the key differences from the beta version are improved detection, redesigned user interface and delivery of definition updates via Automatic Updates. [27]
Windows Defender had additional functionality in Windows Vista which was removed in subsequent versions of Windows: [28]
Security agents which monitor the computer for malicious activities:
The Advanced Tools section allows users to discover potential vulnerabilities with a series of Software Explorers. They provide views of startup programs, currently running software, network connected applications, and Winsock providers (Winsock LSPs). In each Explorer, every element is rated as either "Known", "Unknown" or "Potentially Unwanted". The first and last categories carry a link to learn more about the particular item, and the second category invites users to submit the program to Microsoft SpyNet for analysis by community members. [29] [30] The Software Explorer feature has been removed from Windows Defender in Windows 7. [31]
Windows Defender in Windows Vista automatically blocks all startup items that require administrator privileges to run (this is considered suspicious behavior for a startup item). This automatic blocking is related to the User Account Control functionality in Windows Vista, and requires users to manually run each of these startup items each time they log in if they desire the item to run at startup. [32]
Windows Defender was released with Windows Vista and Windows 7, serving as their built-in anti-spyware component. In Windows Vista and Windows 7, Windows Defender was superseded by Microsoft Security Essentials, an antivirus product from Microsoft which provided protection against a wider range of malware. Upon installation, Microsoft Security Essentials disabled and replaced Windows Defender. [33] [34]
In Windows 8, Microsoft upgraded Windows Defender into an antivirus program very similar to Microsoft Security Essentials for Windows 7 [3] and using the same virus definition updates. Microsoft Security Essentials itself does not run on Windows versions beyond 7. [33] In Windows 8 and Windows 10, Windows Defender is on by default. It switches itself off upon installation of a third-party anti-virus package. [35] [36]
Starting with Windows 10, Microsoft began to transfer the control of Windows Defender out of its original user interface. Initially, its "Settings" dialog box was replaced by a dedicated page in the Settings app. Then, in the 1703 update, Windows Defender was renamed to Windows Defender Antivirus. [37] and became part of the Windows Defender Security Center app, [38] although users could still access original user interface by alternative methods. [39] [40] In the 1803 update, Microsoft removed the UI altogether. [lower-alpha 1] In the 1809 update, the Windows Defender Security Center app was renamed to Windows Security Center. [46] In the 2004 update, the Windows Defender Antivirus was renamed to Microsoft Defender Antivirus. [47] [48]
Windows Defender Offline (formerly known as Standalone System Sweeper) [49] is a stand-alone anti-malware program that runs from bootable removable media (e.g. CD or USB flash drive) designed to scan infected systems while the Windows operating system is offline. [50] Since Windows 10 Anniversary Update in 2016, the option to boot into Windows Defender Offline can be initiated from within Windows itself, negating the need for the separate boot disk.
On May 5, 2017, Tavis Ormandy, a vulnerability researcher from Google, discovered a security vulnerability in the JavaScript analysis module (NScript) of Microsoft Antimalware Engine (MsMpEngine) that impacted Windows Defender, Microsoft Security Essentials and System Center Endpoint Protection. By May 8, 2017, Microsoft had released a patch to all affected systems. Ars Technica commended Microsoft for its unprecedented patching speed and said that the disaster had been averted. [51] [52]
During a December 2017 test of various anti-malware software carried out by AV-TEST on Windows 10, Windows Defender earned 6 out of 6 points in detection rate of various malware samples, earning its "AV-TEST Certified" seal. [53]
During a February 2018 "Real-World Protection Test" performed by AV-Comparatives, Windows Defender achieved a 100% detection rate of malicious URL samples, along with 3 false positive results. [54]
An AV-TEST test of Windows Defender in October 2019 demonstrated it provides excellent protection both against viruses and 0-day / malware attacks. [55]
On December 1, 2021, AV-TEST gave Defender a maximum protection score of 34 points after successfully managing to detect ten out of ten ransomware samples in a lab test. [56]
Malware is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, deprive access to information, or which unknowingly interferes with the user's computer security and privacy. By contrast, software that causes harm due to some deficiency is typically described as a software bug. Malware poses serious problems to individuals and businesses on the Internet. According to Symantec's 2018 Internet Security Threat Report (ISTR), malware variants number has increased to 669,947,865 in 2017, which is twice as many malware variants as in 2016. Cybercrime, which includes malware attacks as well as other crimes committed by computer, was predicted to cost the world economy $6 trillion USD in 2021, and is increasing at a rate of 15% per year.
Spyware is software with malicious behaviour that aims to gather information about a person or organization and send it to another entity in a way that harms the user—for example, by violating their privacy or endangering their device's security. This behaviour may be present in malware as well as in legitimate software. Websites may engage in spyware behaviours like web tracking. Hardware devices may also be affected. Spyware is frequently associated with advertising and involves many of the same issues. Because these behaviors are so common, and can have non-harmful uses, providing a precise definition of spyware is a difficult task.
Antivirus software, also known as anti-malware, is a computer program used to prevent, detect, and remove malware.
Clam AntiVirus (ClamAV) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, OSF (Tru64) and Solaris. As of version 0.97.5, ClamAV builds and runs on Microsoft Windows. Both ClamAV and its updates are made available free of charge. One of its main uses is on mail servers as a server-side email virus scanner.
ESET NOD32 Antivirus, commonly known as NOD32, is an antivirus software package made by the Slovak company ESET. ESET NOD32 Antivirus is sold in two editions, Home Edition and Business Edition. The Business Edition packages add ESET Remote Administrator allowing for server deployment and management, mirroring of threat signature database updates and the ability to install on Microsoft Windows Server operating systems.
Norton AntiVirus is an anti-virus or anti-malware software product founded by Peter Norton, developed and distributed by Gen Digital since 1991 as part of its Norton family of computer security products. It uses signatures and heuristics to identify viruses. Other features included in it are e-mail spam filtering and phishing protection.
Norton Internet Security, developed by Symantec Corporation, is a discontinued computer program that provides malware protection and removal during a subscription period. It uses signatures and heuristics to identify viruses. Other features include a personal firewall, email spam filtering, and phishing protection. With the release of the 2015 line in summer 2014, Symantec officially retired Norton Internet Security after 14 years as the chief Norton product. It was superseded by Norton Security, a rechristened adaptation of the Norton 360 security suite.
Windows Live OneCare was a computer security and performance enhancement service developed by Microsoft for Windows. A core technology of OneCare was the multi-platform RAV, which Microsoft purchased from GeCAD Software Srl in 2003, but subsequently discontinued. The software was available as an annual paid subscription, which could be used on up to three computers.
This is a non-exhaustive list of notable antivirus and Internet Security software, in the form of comparison tables, according to their platform and their operating systems.
Security and Maintenance is a component of the Windows NT family of operating systems that monitors the security and maintenance status of the computer. Its monitoring criteria includes optimal operation of antivirus software, personal firewall, as well as the working status of Backup and Restore, Network Access Protection (NAP), User Account Control (UAC), Windows Error Reporting (WER), and Windows Update. It notifies the user of any problem with the monitored criteria, such as when an antivirus program is not up-to-date or is offline.
Kaspersky Anti-Virus is a proprietary antivirus program developed by Kaspersky Lab. It is designed to protect users from malware and is primarily designed for computers running Microsoft Windows and macOS, although a version for Linux is available for business consumers.
Norton 360, developed by Symantec, is an “all-in-one” security suite for the consumer market.
PC Tools, formerly known as WinGuides.com, was a software company acquired by Symantec in 2008; the new owner eventually discontinued the PC Tools name. Company headquarters were in Australia, with offices in Luxembourg, the United States, United Kingdom, Ireland and Ukraine. The company had previously developed and distributed security and optimization software for the Mac OS X and Microsoft Windows platforms.
Microsoft Security Essentials (MSE) is an antivirus software (AV) product that provides protection against different types of malicious software, such as computer viruses, spyware, rootkits, and trojan horses. Prior to version 4.5, MSE ran on Windows XP, Windows Vista, and Windows 7, but not on Windows 8 and later versions, which have built-in AV components known as Windows Defender. MSE 4.5 and later versions do not run on Windows XP. The license agreement allows home users and small businesses to install and use the product free-of-charge. It replaces Windows Live OneCare, a discontinued commercial subscription-based AV service, and the free Windows Defender, which only protected users from spyware until Windows 8.
Comodo Internet Security (CIS) is developed and distributed by Comodo Group, a freemium Internet security suite that includes an antivirus program, personal firewall, sandbox, host-based intrusion prevention system (HIPS) and website filtering.
MS Antivirus is a scareware rogue anti-virus which purports to remove virus infections found on a computer running Microsoft Windows. It attempts to scam the user into purchasing a "full version" of the software. The company and the individuals behind Bakasoftware operated under other different 'company' names, including Innovagest2000, Innovative Marketing Ukraine, Pandora Software, LocusSoftware, etc.
Trend Micro Internet Security is an antivirus and online security program developed by Trend Micro for the consumer market. According to NSS Lab comparative analysis of software products for this market in 2014, Trend Micro Internet Security was fastest in responding to new internet threats.
Avira Operations GmbH is a German multinational computer security software company mainly known for their Avira Free Security antivirus software. Avira was founded in 2006, but the antivirus application has been under active development since 1986, through its predecessor company H+BEDV Datentechnik GmbH. Since 2021, Avira is owned by American software company NortonLifeLock, after being previously owned by investment firm Investcorp.
Avast Antivirus is a family of cross-platform internet security applications developed by Avast for Microsoft Windows, macOS, Android and iOS. The Avast Antivirus products include freeware and paid versions that provide computer security, browser security, antivirus software, firewall, anti-phishing, antispyware, and anti-spam among other services.
Windows Defender no longer supports Windows 2000
If you install a different antimalware solution, Windows Defender disables its real-time protection but remains available.
Windows Defender is now called Windows Defender Antivirus
In Windows 10, version 1703 (also known as the Creators Update), the Windows Defender app is now part of the Windows Defender Security Center.
There appears to be no way to access the "classic UI" in 1803.
Since the new Windows 10 Update 1803, this no longer works. (Comments section)
Classic UI its gone on windows 10 enterprise 1803, try other way pls (Comments section)
In previous versions a link to [...] MSASCui.exe" opened the program in the "classic" user interface but no longer.
the "Classic" Windows Defender interface has been removed in the 1803 version of Windows 10
Windows Defender Security Center is now called Windows Security.
Formerly known as Windows Defender, Microsoft Defender Antivirus still delivers the [...]