Using Windows Defender

It's important to run a spyware protection tool whenever you're using your computer. Spyware and other potentially unwanted software can try to install itself on your computer any time you go online. It can also infect your computer when you install some programs using a CD or DVD. And some potentially harmful or unwanted software is programmed to run at unexpected times, not just when it is installed.

Windows Defender offers three ways to help keep spyware and other potentially unwanted software from infecting your computer:

  • Real-time spyware protection. Windows Defender alerts you when spyware or potentially unwanted software attempts to install itself or run on your computer. It also alerts you when programs attempt to change important Windows settings.
  • Microsoft SpyNet community. The online SpyNet community helps you see how other people respond to software that has not yet been classified for risks. Seeing if other members of the community allow software can help you choose whether to allow it on your computer. In turn, if you participate, your choices are added to the community ratings to help other people choose what to do.
  • Spyware scanning. You can use Windows Defender to scan for spyware and other potentially unwanted software that might be installed on your computer, to schedule scans on a regular basis, and to automatically remove any harmful software that is detected.

When you use Windows Defender, it's important to have up-to-date definitions. Definitions are files that act like an ever-growing encyclopedia of potential software threats. Windows Defender uses definitions to determine if software that it detects is spyware or other potentially unwanted software, and then to alert you to potential risks. To help keep your definitions up to date, Windows Defender works with Windows Update to automatically install new definitions as they are released. You can also set Windows Defender to check online for updated definitions before scanning.

Getting started

Follow these links to learn more about spyware and Windows Defender:

  • How to tell if your computer is infected with spyware
  • Spyware: frequently asked questions
  • Understanding Windows Defender alert levels
  • Understanding real-time spyware protection options
  • What is Software Explorer?

How to...

Follow these links for information about using Windows Defender:

  • Scan for spyware and other potentially unwanted software
  • Schedule when Windows Defender scans your computer
  • Keep Windows Defender definitions up to date
  • View the progress of a Windows Defender scan
  • Join the Microsoft SpyNet community
  • Clear the history in Windows Defender
  • Report suspicious software to Microsoft SpyNet
  • Remove or restore items quarantined by Windows Defender
  • Add or remove items from the Windows Defender allowed list
  • Remove spyware from your computer
  • Turn real-time spyware protection on or off
  • Turn Windows Defender on or off
  • Use Windows Defender with a firewall
  • Using Software Explorer


How to tell if your computer is infected with spyware

You might have some form of spyware on your computer if:

  • You notice new toolbars, links, or favorites that you did not intentionally add to your web browser.
  • Your home page, mouse pointer, or search program changes unexpectedly.
  • You type the address for a specific website (for example, a search engine), but you are taken to a different website without notice.
  • You see pop-up ads, even if you're not on the Internet.
  • Your computer suddenly starts running more slowly that it usually does.

There might be spyware on your computer even if you don't see any symptoms. These types of software can collect information about you and your computer without your knowledge or consent. To help protect your privacy and your computer, we recommend that you run Microsoft Windows Defender or another antispyware program at all times.

Related Topics

Using Windows Defender

Turn Windows Defender on or off

Remove spyware from your computer


Spyware: frequently asked questions

Here are answers to some common questions about spyware.

What is spyware?

Spyware is software that can install itself or run on your computer without providing you with adequate notice, consent, or control. Spyware might not display symptoms after it infects your computer but many harmful or unwanted programs can affect how your computer runs. Spyware can, for example, monitor your online behavior or collect information about you (including personally identifiable or other sensitive information), change settings on your computer, or cause your computer to run slowly.

How can I tell if I have spyware or unwanted software on my computer?

You probably have some form of spyware on your computer if:

    • You notice new toolbars, links, or favorites that you did not intentionally add to your web browser.
    • Your default home page, mouse pointer, or search program changes.
    • You type the address for a specific website (for example, a search engine) and you are taken to a different website without notice.
    • You see pop-up ads, even if you're not on the Internet.
    • Your computer suddenly begins to start or run slowly.

There might be spyware on your computer even if you don't see any symptoms. These types of software can collect information about you and your computer without your knowledge or consent. Running Windows Defender whenever you use your computer can help you find and remove such software.

Where does spyware and potentially unwanted software come from?

Unwanted software can be installed by websites, downloaded programs, or a program you might install from a CD, DVD, external hard disk, or a device. Spyware is most commonly installed through free software, such as file sharing, screen savers, or search toolbars.

Can I get spyware without knowing it?

Yes, some spyware can be installed from a website directly through an embedded script, or program in a webpage. Some unwanted software requires your help to install through web pop-ups or free software that require you to accept a downloadable file. However, if you keep Windows up to date and don't reduce your security settings, you can minimize the chances of a spyware infection.

What do I do when a pop-up won't close until I agree to install a program or change my home page?

Some websites will repeatedly display pop-ups asking you to install a toolbar or change your home page. When this happens, try closing the browser window. If the pop-ups still appear, right-click the Internet Explorer window button in the taskbar at the bottom of your screen, and then click Close Group. As a last resort, close any other programs you have open, and then restart your computer.

How can I prevent spyware?

Software products, such as Windows Defender, can protect your system by watching for spyware trying to install itself or run on your computer. Spyware protection programs can also scan your system automatically to find and remove spyware that might already be installed.

Keeping your Windows operating system up to date is also important. Microsoft often releases security updates to help prevent spyware from being installed without your knowledge. Most new antivirus programs have spyware protection, and should be kept up to date as well. We recommend that you turn on Automatic Updates for Windows, and that you update your spyware and antivirus programs regularly.

When you visit websites, do not automatically agree to download anything the site offers. If you download free software, such as file sharing programs or screen savers, read the license agreement carefully. Look for clauses where you must accept advertising and pop-ups from the company, or that the software will send certain information back to the software publisher. For more information about preventing spyware infections when you go online, go to the Microsoft Windows Defender website.

How do I remove unwanted software?

The best way to remove spyware is with an automated spyware protection program which scans for and removes potentially unwanted software from your computer. For more information about removing spyware and other unwanted software, see Using Windows Defender or Remove spyware from your computer.


Understanding Windows Defender alert levels

Alert levels help you choose how to respond to spyware and potentially unwanted software. While Windows Defender will recommend that you remove spyware, not all software that is detected is harmful or unwanted. The information in this table can help you decide what to do if Windows Defender detects potentially unwanted software on your computer.

Alert level | What it means | What to do
Severe | Widespread or exceptionally harmful programs, similar to viruses or worms, which negatively affect your privacy and the security of your computer, and can damage your computer. | Remove this software immediately.
High | Programs that might collect your personal information and negatively affect your privacy or damage your computer, for example, by collecting information or changing settings, typically without your knowledge or consent. | Remove this software immediately.
Medium | Programs that might affect your privacy or make changes to your computer that could negatively impact your computing experience, for example, by collecting personal information or changing settings. | Review the alert details to see why the software was detected. If you do not like how the software operates or if you do not recognize and trust the publisher, consider blocking or removing the software.
Low | Potentially unwanted software that might collect information about you or your computer or change how your computer works, but is operating in agreement with licensing terms displayed when you installed the software. | This software is typically benign when it runs on your computer, unless it was installed without your knowledge. If you're not sure whether to allow it, review the alert details or check to see if you recognize and trust the publisher of the software.
Not yet classified | Programs that are typically benign unless they are installed on your computer without your knowledge. | If you recognize and trust the software, allow it to run. If you do not recognize the software or the publisher, review the alert details to decide how to take action. If you're a SpyNet community member, check the community ratings to see if other users trust the software.

Related Topics

Join the Microsoft SpyNet community

Keep Windows Defender definitions up to date


Understanding real-time spyware protection options

Real-time protection alerts you when spyware and other potentially unwanted software attempts to install itself or run on your computer. You are also alerted if programs attempt to change important Windows settings.

You choose the software and settings that you want Windows Defender to monitor, but we recommend that you use all of the real-time protection options (also called agents). The following table explains each agent and why it is important.

Real-time protection agent | Purpose
Auto Start | Monitors lists of programs that are allowed to automatically run when you start your computer. Spyware and other potentially unwanted software can be set to run automatically when Windows starts. That way, they can run without your knowledge and collect information. They can also make your computer start or run slowly.
System Configuration (settings) | Monitors security-related settings in Windows. Spyware and other potentially unwanted software can change hardware and software security settings, and then collect information that can be used to further undermine your computer's security.
Internet Explorer Add-ons | Monitors programs that automatically run when you start Internet Explorer. Spyware and other potentially unwanted software can masquerade as web browser add-ons and run without your knowledge.
Internet Explorer Configurations (settings) | Monitors browser security settings, which are your first line of defense against harmful content on the Internet. Spyware and other potentially unwanted software can try to change these settings without your knowledge.
Internet Explorer Downloads | Monitors files and programs that are designed to work with Internet Explorer, such as ActiveX controls and software installation programs. These files can be downloaded, installed, or run by the browser itself. Spyware and other potentially unwanted software can be included with these files and installed without your knowledge.
Services and Drivers | Monitors services and drivers as they interact with Windows and your programs. Because services and drivers perform essential computer functions (such as allowing devices to work with your computer), they have access to important software in the operating system. Spyware and other potentially unwanted software can use services and drivers to gain access to your computer or to try to run undetected on your computer like normal operating system components.
Application Execution | Monitors when programs start and any operations they perform while running. Spyware and other potentially unwanted software can use vulnerabilities in programs that you have installed to run harmful or unwanted software without your knowledge. For example, spyware can run itself in the background when you start a program that you frequently use. Windows Defender monitors your programs and alerts you if suspicious activity is detected.
Application Registration | Monitors tools and files in the operating system where programs can register to run at any time, not just when you start Windows or another program. Spyware and other potentially unwanted software can register a program to start without notice and run, for example, at a scheduled time each day. This allows the program to collect information about you or your computer or gain access to important software in the operating system without your knowledge.
Windows Add-ons | Monitors add-on programs (also known as software utilities) for Windows. Add-ons are designed to enhance your computing experience in areas such as security, browsing, productivity, and multi-media. However, add-ons can also install programs that will collect information about you or your online activities and expose sensitive, personal information, often to advertisers.

Related Topics

Turn real-time spyware protection on or off

Scan for spyware and other potentially unwanted software

Keep Windows Defender definitions up to date


What is Software Explorer?

Software Explorer in Windows Defender allows you to view detailed information about software that is currently running on your computer that can affect your privacy or the security of your computer. You can see, for example, which programs run automatically when you start Windows and information about how these programs interact with important Windows programs and services.

Software Explorer helps you monitor the following items:

  • Startup programs, which are programs that run automatically when you start Windows, with or without your knowledge.
  • Currently running programs, which are programs that are currently running onscreen or in the background.
  • Network-connected programs, which are programs or processes that can connect to the Internet or to your home or office network.
  • Winsock service providers, which are programs that perform low-level networking and communication services for Windows and programs that run on Windows. These programs often have access to important areas of the operating system.

Note

  • If you are running Windows 2000 Service Pack 4, you can't use Software Explorer to monitor network-connected programs.

Related Topics

Using Software Explorer

Understanding real-time spyware protections options


Scan for spyware and other potentially unwanted software

In Windows Defender, you can choose to run a "quick scan" of your computer or a "full system scan". If you suspect spyware has infected a specific area of your computer, you can customize a scan by selecting only the drives and folders that you want to check.

A quick scan checks the places on your computer's hard disk that spyware is most likely to infect. A full scan will check all files on your hard disk and all currently running programs, but it might cause your computer to run slowly until the scan is complete. We recommend that you schedule a daily quick scan. At any time, if you suspect that spyware has infected your computer, run a full scan.

To run a quick scan

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Scan.

To scan all areas of your computer

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click the Down arrow next to Scan, and then click Full Scan.

To scan specific areas of your computer only

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click the Down arrow next to Scan, and then click Custom Scan.
  3. Click Scan selected drives and folders, and then click Select.
  4. Select the files or folders that you want to scan, and then click OK.

Related Topics

Schedule when Windows Defender scans your computer

View the progress of a Windows Defender scan

Remove spyware from your computer


View the progress of a Windows Defender scan

You can view which type of Windows Defender scan is in progress and see how long it has been running.

To view the progress of a scan

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. If a scan is in progress, the progress is displayed until the scan is complete. If the scan is complete, the status will display the scan results, and the date and time that the scan completed.

Note

  • If a scan is in progress, you can also click the Windows Defender icon in the notification area to view the status of the scan.
  • To view when your computer was last scanned for spyware and other potentially unwanted software, check the Status area on the Windows Defender Home page.

Related Topics

Schedule when Windows Defender scans your computer

Turn real-time spyware protection on or off


Keep Windows Defender definitions up to date

Definitions are files that act like an encyclopedia of known spyware and other potentially unwanted software. Because spyware is continually being developed, Windows Defender relies on up-to-date definitions to determine if software that is trying to install, run, or change settings on your computer is potentially harmful.

Windows Defender works with Automatic Updates in Windows to automatically install the latest definitions. To make sure that Automatic Updates is on, click Start, click Control Panel, and then click Automatic Updates.

To automatically check for new definitions before scheduled scans (recommended)

To complete these steps, you must be logged on as Administrator or be a member of the Administrators group.

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Tools, and then click General Settings.
  3. Under Automatic scanning, make sure the Automatically scan my computer (recommended) check box is selected.
  4. Select the Check for updated definitions before scanning check box, and then click Save.

If you don't use scheduled scans, or if you don't get updates automatically, you should check for new definitions at least once a week. To help protect your computer, Windows Defender will notify you if your definitions are out of date for more than seven days.

To check for new definitions manually

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click the Down arrow next to Help, and then click About Windows Defender.
  3. In the Windows Defender dialog box, click Check for Updates.

Related Topics

Scan for spyware and other potentially unwanted software

Join the Microsoft SpyNet community

Spyware: frequently asked questions


Remove unwanted software from your computer

[This version of Windows Defender is still in development, so some Help information might be inaccurate or missing.]

Remove spyware from your computer

Follow the steps below in order until the spyware is removed.

Use a spyware scanner and removal tool

Windows Defender is the spyware protection program from Microsoft that you can download and install for Windows. When Windows Defender is on, you're alerted if spyware and other potentially unwanted software tries to run or install itself on your computer. You choose if you want to ignore, quarantine, or remove each item that is detected. See how to use Windows Defender to scan for spyware and other potentially unwanted software.

Spyware scanners are also frequently included in antivirus programs. If you have already installed an antivirus program, check to see if that program includes spyware protection features or if you can add them as an update, and then scan your computer regularly. You can see a list of other spyware protection programs at the Microsoft Security at Home website.

Troubleshoot removing spyware

Spyware can sometimes infect areas of your computer that are difficult to clean without causing further problems. If a spyware protection program notifies you that it can't remove spyware, follow any directions provided by the program. If that doesn't work, try these options:

  • Check Add or Remove Programs for items that don't belong on your computer

    • Use this method with extreme caution. The control panel lists many programs, most of which are not spyware. Many spyware programs use special installation methods to avoid showing up in Add or Remove Programs. Occasionally a spyware program will offer an uninstall option and can be removed with this method. Only remove programs you can positively identify as spyware and do not remove programs that you might want to keep, even if you don't use them very often. To learn how to remove programs, search for "Change or remove a program" in Help and Support.

  • Restore your computer to how it was before it was infected by spyware

    • If you can identify when the spyware was installed, you might be able to use System Restore to restore your computer to the state that it was in before the problem started. You can use Software Explorer in Windows Defender to find the installation date for some programs. To learn how to restore your computer to a previous state, search for "System Restore" in Help and Support.

  • Reinstall Windows

    • Some spyware has the ability to hide itself so well that it cannot be removed. If you still see evidence of spyware after trying the first two solutions listed here, you might need to reinstall Windows and your programs.

    Warning

    • Reinstalling Windows will remove spyware, but it will also delete your files and programs. If you have to reinstall Windows, make sure that you backup your documents and files, and that you have access to the installation discs you will need to reinstall your programs.

Related Topics

Using Windows Defender

Join the Microsoft SpyNet community

Spyware: frequently asked questions


Report suspicious software to Microsoft SpyNet

If you join the SpyNet community, and if Windows Defender detects software on your computer that has not yet been classified for risks, you might be asked to send a sample of the software to Microsoft SpyNet for analysis. When you're prompted, Windows Defender displays a list of files that can help analysts determine if the software is harmful. You can choose to send some or all of the files in the list.

To send files to Microsoft SpyNet

  • If you suspect that a file or program on your computer might be spyware, you can send it to Microsoft. Complete the online instructions for reporting suspicious software to Microsoft SpyNet.

To report software that might be incorrectly classified

  • If Windows Defender alerts you about software that you don't believe is harmful or unwanted, you can report the problem to Microsoft by completing the False Positive Report Form on the Microsoft Security at Home website.

Related Topics

Remove spyware from your computer

How to tell if your computer is infected with spyware

Remove or restore software quarantined by Windows Defender


Remove or restore items quarantined by Windows Defender

To complete these steps, you must be logged on as Administrator or be a member of the Administrators group.

When Windows Defender quarantines software, it moves it to a another location on your computer, and then prevents the software from running until you choose to restore it or remove it from your computer.

To remove or restore quarantined items

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Tools, and then click Quarantined items.
  3. Review each item and then, for each, click Remove or Restore. If you want remove all quarantined items from your computer, click Remove All.

Warning

  • Do not restore software with severe or high alert ratings. If allowed to run, these items can harm your privacy or the security of your computer.

Related Topics

Understanding Windows Defender alert levels

Add or remove items from the Windows Defender allowed list

Clear the history in Windows Defender


Add or remove items from the Windows Defender allowed list

To complete these steps, you must be logged on as Administrator or be a member of the Administrators group.

If you trust software that Windows Defender has detected, you can stop Windows Defender from alerting you to risks that the software might pose to your privacy or your computer. The next time Windows Defender alerts you about the software, on the Action menu, select Always Allow. If you want to monitor the software again later, you need to remove it from the Windows Defender allowed list.

Note

  • If Windows Defender alerts you about software and, on the Action menu in the alert dialog box, you select Ignore, you allow the software to run on your computer. If the software acts suspiciously at a later time, Windows Defender will alert you about the software again or automatically apply actions that you have set for each type of alert.

To remove an item from the allowed list

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Tools, and then click Allowed items.
  3. Select the item you want to monitor again, and then click Remove.

Warning

  • Do not allow software with severe or high alert ratings to run on your computer. These items can harm your privacy or the security of your computer.

Related Topics

Understanding Windows Defender alert levels

How to tell if your computer is infected with spyware

Remove or restore items quarantined by Windows Defender


View or clear the history in Windows Defender

To complete these steps, you must be logged on as Administrator or be a member of the Administrators group.

The history displays actions you've applied to spyware and other potentially unwanted software that Windows Defender has detected on your computer.

To view or clear the history

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click History.
  3. To permanently delete all items in the list, click Clear History.

Related Topics

Scan for spyware and other potentially unwanted software

Remove or restore items quarantined by Windows Defender

How to tell if your computer is infected with spyware


Using Software Explorer

Changing how a program runs on your computer, such as blocking Internet or network connections and ending processes, can cause problems with Windows and other programs that you use. Use Software Explorer to change how a program runs on your computer only if you are certain the program is causing a problem.

To use some Software Explorer options, you must be logged on as Administrator or be a member of the Administrators group.

To view software running on your computer using Software Explorer

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Tools, and then click Software Explorer.
  3. In the Category list, select the type of software that you want to monitor.

Note

  • If you are running Windows 2000 Service Pack 4, you can't use Software Explorer to monitor network-connected programs.

Understanding Software Explorer details

Software Explorer displays basic information about programs such as the program name, publisher, and version. Depending on the category you choose, you might also see these important types of information.

Auto Start | Indicates if the program is registered to start automatically when Windows starts.
Startup Type | The location where the program is registered to start automatically when Windows starts, for example, in the registry or the All Users Startup Folder.
Ships with Operating System | Indicates if the program was installed as part of your Windows installation.
Classification | Indicates if the program has been analyzed for risks to your privacy and the security of your computer.
Digitally Signed By | Indicates if the software has been signed and if so, if the publisher listed has signed it. If not, we recommend that you do not trust the publisher information provided with the software, and that you review more details before choosing if you trust the software itself.

Related Topics

What is Software Explorer

Report suspicious software to Microsoft SpyNet


Schedule when Windows Defender scans your computer

To complete these steps, you must be logged on as Administrator or be a member of the Administrators group.

We recommend that you schedule a daily quick scan. A quick scan will check the areas of your computer that spyware and other potentially unwanted software is most likely to infect. If you want Windows Defender to check all files and programs on your computer, run or schedule a full scan.

To enhance the security of your computer, you can choose to automatically remove spyware and other potentially unwanted software if is detected during a scan.

To schedule scans

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Tools, and then click General Settings.
  3. Under Automatic scanning, select the Automatically scan my computer (recommended) check box, and then select the frequency, time of day, and type of scan that you want to run.
  4. To automatically remove spyware or other potentially unwanted software after a scan, select the Apply actions on detected items after scanning check box.
  5. Under Default actions, select the action that you want to apply to each Windows Defender alert, and then click Save.

Note

  • If Windows Defender alerts you about software and, on the Action menu in the alert dialog box, you select Ignore, you are allowing the software to run on your computer. If the software acts suspiciously at a later time, Windows Defender will alert you about the software again or automatically apply actions that you have set for each type of alert. If you trust the software and do not want Windows Defender to automatically remove or quarantine it, see the topic Add or remove items from the Windows Defender allowed list.

Related Topics

Scan for spyware and other potentially unwanted software

View the progress of a Windows Defender scan

Turn real-time spyware protection on or off

Understanding Windows Defender alert levels


Join the Microsoft SpyNet community

By joining the online community, you can see how other people respond to Windows Defender alerts. Not all software that is detected is spyware but Windows Defender alerts you if software has not yet been classified for risks. Seeing how other people respond to each item can help you choose what to do. In turn, if you participate, your choices are added to the community ratings to help other people take action. In Windows Defender, community ratings are displayed as a bar graph that shows the percentage of users who have allowed each item.

Spyware is continually developed, so SpyNet ratings also help Microsoft determine which software to investigate. For example, if many people remove software that has not yet been classified, Microsoft will analyze the software, determine if it is spyware, and if needed, update the Windows Defender definitions.

Definitions are files that act like an encyclopedia of potential threats. Up-to-date definitions help Windows Defender detect the latest spyware threats and keep them from infecting your computer. Even if software is not spyware but operates in a way that might be harmful or unwanted, up-to-date definitions allow Windows Defender to alert you to potential risks.

To join the Microsoft SpyNet community

To complete these steps, you must be logged on as Administrator or be a member of the Administrators group.

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Tools, and then click Microsoft SpyNet.
  3. Select the level of community participation you want—basic or advanced—and then click Save.

Related Topics

Scan for spyware and other potentially unwanted software

Understanding Windows Defender alert levels

Read the Windows Defender privacy statement


Turn real-time spyware protection on or off

To complete these steps, you must be logged on as Administrator or be a member of the Administrators group.

To help prevent spyware and other unwanted software from infecting your computer, turn on Windows Defender real-time protection and select all real-time protection options. Real-time protection alerts you when spyware and other potentially unwanted software attempts to install itself or run on your computer. You are also alerted if programs attempt to change important Windows settings.

To turn real-time protection on or off

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Tools, and then click General Settings.
  3. Under Real-time protection options, select the Turn on real-time protection (recommended) check box.
  4. Select the options that you want. To help protect your privacy and your computer, we recommend that you select all real-time protection options.
  5. Under Choose when Windows Defender should notify you, select the options you want, and then click Save.

Related Topics

Understanding real-time spyware protection options

Keep Windows Defender definitions up to date

Schedule when Windows Defender scans your computer


Turn Windows Defender on or off

To complete these steps, you must be logged on as Administrator or be a member of the Administrators group.

When Windows Defender is on, you will be alerted when spyware and other potentially unwanted software tries to install itself, run on your computer, or change important Windows settings. Windows Defender will also check for new definitions, regularly scan for spyware and other potentially unwanted software, and automatically remove any harmful software that it finds.

To turn Windows Defender on or off

  1. Open Windows Defender. (Click Start, click Programs, and then click Windows Defender.)
  2. Click Tools, and then click General Settings.
  3. Under Protection options, select or clear the Use Windows Defender to help protect my computer check box, and then click Save.

Related Topics

Understanding Windows Defender alert levels

Keep Windows Defender definitions up to date


System requirements for installing Windows Defender

To install Windows Defender, you must be logged on as Administrator or be a member of the Administrators group. Your computer or all computers on a network for which you want to install the program must meet these requirements.

Processor | Pentium 233 MHz or higher processor; Pentium III recommended
Operating system | Microsoft Windows 2000 Service Pack 4, Windows XP Service Pack 2, or Windows Server 2003 Service Pack 1
Random Access Memory (RAM) | 64 MB RAM (minimum); 128 MB RAM (recommended)
disk space | 20 MB of available hard disk space
Web browser | Internet Explorer 6.0 or later

Notes

  • Windows Defender does not run on Windows ME, Windows 98, or Windows NT operating systems.


Using Windows Defender with a firewall

To join the Microsoft SpyNet community, download software updates, and get the latest definitions for Windows Defender, your computer must be connected to the Internet. To help protect your computer when you go online, make sure that you turn on Windows Firewall.

If you use a different firewall, check the publisher's documentation to see how to allow the program, MSASCui.exe, to access Transmission Control Protocol (TCP) port 80.

Related Topics

Join the Microsoft SpyNet community

Keep Windows Defender definitions up to date

Spyware: frequently asked questions


Remove Windows Defender from your computer

To prevent problems with removing Windows Defender, save your work and close any open programs before you begin.

To remove Windows Defender

  1. Close Windows Defender. If the program is not open but is performing a scan or another activity, right-click the Windows Defender icon in the notification area, and then click Exit.
  2. Click Start, click Control Panel, and then click Add or Remove Programs.
  3. Click Windows Defender, and then click Remove.
  4. Follow the instructions to uninstall the program.

Related Topics

System requirements for installing Windows Defender

Spyware: frequently asked questions


Windows Defender License Terms

MICROSOFT PRE-RELEASE SOFTWARE LICENSE TERMS

MICROSOFT WINDOWS DEFENDER BETA 2 SOFTWARE FOR MICROSOFT WINDOWS 2000, WINDOWS XP, AND WINDOWS SERVER 2003

These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. Please read them. They apply to the pre-release software named above, which includes the media on which you received it, if any. The terms also apply to any Microsoft:

  • updates,
  • supplements,
  • Internet-based services, and
  • support services (if any)

for this software, unless other terms accompany those items. If so, those terms apply.

By using the software, you accept these terms. If you do not accept them, do not use the software.

As described below, using some features also operates as your consent to the transmission of certain standard computer information for Internet-based services.

  1. USE RIGHTS. If you comply with this agreement, you have the right to install and use one copy of the software on your computer until December 31, 2006, or until the date we release a commercial version of the software, whichever date is first.
  2. TIME-SENSITIVE SOFTWARE. The software will stop running on December 31, 2006. You will not receive any other notice. You will not receive any further updates when the software stops running.
  3. PRE-RELEASE SOFTWARE. This software is a pre-release version. It will not work the way a final version of the software will. We may change it for the final, commercial version. We also may not release a commercial version of the software.
  4. POTENTIALLY UNWANTED SOFTWARE. The software will search your computer for "spyware," "adware" and other potentially unwanted software ("Potentially Unwanted Software"). If it finds Potentially Unwanted Software, the software will ask you if you want to ignore, disable (quarantine) or remove it. The software will only remove or disable Potentially Unwanted Software as you instruct it. Removing or disabling the Potentially Unwanted Software may cause other software on your computer to stop working, and it may cause you to breach a license to use other software on your computer, if the other software installed the Potentially Unwanted Software on your computer as a condition of your use of the other software. You should read the license agreements for other software before authorizing the removal of any Potentially Unwanted Software. By using this software, it is possible that you will also remove or disable software that is not Potentially Unwanted Software. You are solely responsible for selecting which Potentially Unwanted Software the software removes or disables.
  5. FEEDBACK. If you give feedback about the software to Microsoft, you give to Microsoft, without charge, the right to use, share and commercialize your feedback in any way and for any purpose. You also give to third parties, without charge, any patent rights necessary for their products, technologies and services to use or interface with any specific parts of a Microsoft software and service that includes the feedback. You will not give feedback that is subject to a license that requires Microsoft to license its software or documentation to third parties because we include your feedback in them. These rights survive this agreement.
  6. SCOPE OF LICENSE. The software is licensed, not sold. The software is protected by copyright and other intellectual property laws and treaties. This agreement only gives you some rights to use the software. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with technical limitations in the software that only allow you to use it in certain ways. You may not:
    • work around the technical limitations in the software;
    • reverse engineer, decompile or disassemble the software or the Potentially Unwanted Software definitions that work with the software, except and only to the extent that applicable law expressly permits, despite this limitation;
    • use the Potentially Unwanted Software definitions separately from the software;
    • make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;
    • publish the software for others to copy;
    • distribute the software to any third party;
    • rent, lease or lend the software;
    • transfer the software or this agreement to any third party; or
    • use the software to provide commercial software hosting services.
  7. INTERNET-BASED SERVICES. Microsoft provides Internet-based services with the software. It may change or cancel them at any time.
    1. Consent for Internet-based Services. The software features described below connect to Microsoft or service provider computer systems over the Internet. In some cases, you will not receive a separate notice when they connect. You may switch off these features or not use them. For more information about these features, see the software documentation. By using these features, you consent to the transmission of the information described below. Microsoft does not use this information to identify or contact you.
    2. Updated Definition Files. When you install the software, or when you use the software, you may choose to obtain updated Potentially Unwanted Software definitions automatically when you connect to the Internet. The software uses the updated definitions to detect new Potentially Unwanted Software.
    3. Spynet. When you install the software, or when you use the software, you may choose to share information about Potentially Unwanted Software and their signatures with SpyNet. SpyNet is a network community that connects users of the software together to identify and share information about Potentially Unwanted Software. This community reports potential threats identified by features in the software to the SpyNet servers that catalog and update the system to help protect users of the software from new spyware threats.
    4. Misuse of Internet-based Services. You may not use these services in any way that could harm them or impair anyone else's use of them. You may not use these services to try to gain unauthorized access to any service, materials, account or network by any means.
  8. SUPPORT SERVICES. Because this software is "as is," we may not provide support services for it.
  9. EXPORT RESTRICTIONS. The software is subject to U.S. export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations, end users and end use. For additional information, see www.microsoft.com/exporting .
  10. DISCLAIMER OF WARRANTIES. THE SOFTWARE IS LICENSED "AS-IS." YOU BEAR THE RISK OF USING IT. MICROSOFT GIVES NO EXPRESS WARRANTIES, GUARANTEES OR CONDITIONS. YOU MAY HAVE ADDITIONAL CONSUMER RIGHTS UNDER YOUR LOCAL LAWS THAT THIS AGREEMENT CANNOT CHANGE. TO THE EXTENT PERMITTED UNDER YOUR LOCAL LAWS, MICROSOFT EXCLUDES THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
  11. LIMITATION ON AND EXCLUSION OF DAMAGES. MICROSOFT'S LIABILITY UNDER THIS AGREEMENT IS LIMITED. YOU CAN RECOVER FROM MICROSOFT AND ITS SUPPLIERS ONLY DIRECT DAMAGES UP TO U.S. $5.00. YOU CANNOT RECOVER ANY OTHER DAMAGES, INCLUDING CONSEQUENTIAL, LOST PROFITS, SPECIAL, INDIRECT OR INCIDENTAL DAMAGES. THIS LIMITATION APPLIES TO:
    • ANYTHING RELATED TO THE SOFTWARE, SERVICES, CONTENT (INCLUDING CODE) ON THIRD PARTY INTERNET SITES, OR THIRD PARTY PROGRAMS, AND
    • CLAIMS FOR BREACH OF CONTRACT, BREACH OF WARRANTY, GUARANTEE OR CONDITION, STRICT LIABILITY, NEGLIGENCE, OR OTHER TORT TO THE EXTENT PERMITTED BY APPLICABLE LAW.

    IT ALSO APPLIES EVEN IF MICROSOFT KNEW OR SHOULD HAVE KNOWN ABOUT THE POSSIBILITY OF THE DAMAGES. THE ABOVE LIMITATION OR EXCLUSION MAY NOT APPLY TO YOU BECAUSE YOUR COUNTRY MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL, CONSEQUENTIAL OR OTHER DAMAGES.

  12. LEGAL EFFECT. This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.
  13. APPLICABLE LAW.
    1. United States. If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles. The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.
    2. Outside the United States. If you acquired the software in any other country, the laws of that country apply.
  14. ENTIRE AGREEMENT. This agreement and any amendments to it, and the terms for supplements, updates, Internet-based services and support services are the entire agreement for the software and support services.

Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.

Remarque: Ce logiciel étant distribué au Québec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en français.

EXONÉRATION DE GARANTIE. Le logiciel visé par une licence est offert " tel quel ". Toute utilisation de ce logiciel est à votre seule risque et péril. Microsoft n'accorde aucune garantie ou condition expresse. Vous pouvez disposer de droits de consommateur additionnels que vous conférent vos lois locales, que la présente licence ne peut modifier. Dans la mesure permise par vos lois locales, les garanties implicites de qualité marchande, d'adaptation à un usage particulier et d'absence de contrefaçon sont exclues.

LIMITATION DES DOMMAGES-INTÉRÊTS ET EXCLUSION DE RESPONSABILITÉ POUR LES DOMMAGES. Vous pouvez obtenir de Microsoft et de ses fournisseurs une indemnisation en cas de dommages directs uniquement à hauteur de 5,00 $ US. Vous ne pouvez prétendre à aucune indemnisation pour les autres dommages, y compris les dommages spéciaux, indirects ou accessoires et pertes de bénéfices.

Cette limitation concerne:

  • TOUTE MATIÈRE RELIÉE AU LOGICIEL, AUX SERVICES OU AU CONTENU (Y COMPRIS LE CODE) FIGURANT SUR DES SITES INTERNET D'UNE TIÈRCE PARTIE OU DANS DES PROGRAMMES D'UNE TIÈRCE PARTIE, ET
  • LES RÉCLAMATIONS AU TITRE DE VIOLATION DE CONTRAT OU DE GARANTIE, OU AU TITRE DE RESPONSABILITÉ STRICTE, DE NÉGLIGENCE OU D'UNE AUTRE FAUTE DANS LA LIMITE AUTORISÉE PAR LA LOI EN VIGUEUR.

Elle s'applique également, même si Microsoft connaissait ou devrait connaître l'éventualité d'un tel dommage.

Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilité pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas à votre égard.

EFFET JURIDIQUE. Le présent contrat décrit certains droits juridiques. Vous pourriez avoir d'autres droits prévus par les lois de votre pays. Le présent contrat ne modifie pas les droits que vous confèrent les lois de votre pays si celles ci ne le permettent pas.


Read the Windows Defender privacy statement

Your privacy is important to us. You can read the privacy information about Windows Defender on the Microsoft Security at Home website.