How does Win defender work?

[Guest]

I run a small website and i was asked how windows defender works, so if
anyone knows please answer...
btw: i mean the way how it knows that something is spyware

 

[Guest]

You might have some form of spyware on your computer if:

• You notice new toolbars, links, or favorites that you did not
intentionally add to your web browser.

• Your home page, mouse pointer, or search program changes unexpectedly.

• You type the address for a specific website (for example, a search
engine), but you are taken to a different website without notice.

• You see pop-up ads, even if you're not on the Internet.

• Your computer suddenly starts running more slowly that it usually does.


There might be spyware on your computer even if you don't see any symptoms.
This type of software can collect information about you and your computer
without your knowledge or consent. To help protect your privacy and your
computer, we recommend that you run Windows Defender or another antispyware
program at all times.

I hope this post is helpful.
- -- --


LEARNING
Education is an ornament in prosperity and a refuge in
adversity.-----Aristotle

 

[Robinb]

it knows because it receives updates from Microsoft almost every week which
helps protect your computer.
It runs as a service in the backround not as an application and uses very
little memory so you really do not even know it is running most of the time,
the same goes for when it scans.
One antispyware program is not enough to protect you, you need several.
good examples are:
AVG Antispyware
Ad Aware 2007
Spybot Search and Destroy
Spywareblaster
SuperAntispyware
These all come with free versions that you can manually run.
I recommend SuperAntispyware Pro instead of the free version because it runs
a residential shield and also plays nice with Windows Defender. it also
gets into windows root systems and gets out trojans and spyware others
cannot.
I stil recommend you get the free versions- they will be a stand alone and
you manually do the scans .
robin

 

[Dave M]

Defender is a signature based scanner including some heuristic
capabilities:

http://wiki.castlecops.com/Different_classes_of_security_software#Signature_based_scanners:-

 

[Bill Sanderson]

Dave M has given a good reference. Microsoft's description can be found
here:

http://www.microsoft.com/athome/security/spyware/software/about/overview.mspx

and the nearby pages would probably be of interest to someone asking that
question.

 

[Guest]

Dave M, Have you used any of those behavior blocking programs ? Or recommend
something that blocks anything from being installed-downloaded or tries to
change
your settings instantly. A very small resource using program that sits in
your system
tray (like spyware guard) that just blocks anything with RTP untill you ok
it. And
freeware. Ron

 

[Dave M]

Yes, Ron. I used Cyberhawk for a while and found it fit pretty well with
Defender, since they use different approaches (which is a sterling idea,
IMO) and they didn't conflict. I'm not sure where that application sits at
the moment though, trial or whatever. I thought I was getting some
suspicious activity from it (madCodeHook injector: mchInjDrv) and
uninstalled, but later came to realize it was A-squared doing that to me
all along and not Cyberhawk. It was always the first to recognize
suspicious things... like eicar, and it came out looking good on my spycar
tests, as it should have since it's a behavior blocker. Wilders security
forums generally follow the application. The only thing is, like SpyNet,
you are asked, perhaps required, to give back some info to them while it's
running.

 

[Anonymous Bob]

Yes, Ron. I used Cyberhawk for a while and found it fit pretty well with
Defender, since they use different approaches (which is a sterling idea,
IMO) and they didn't conflict. I'm not sure where that application sits at
the moment though, trial or whatever.

Cyberhawk was bought by PcTools and renamed ThreatFire.

Bob Vanderveen

 

[Alan D]

I recommend SuperAntispyware Pro instead of the free version because it
runs a residential shield and also plays nice with Windows Defender.

Robin, are you running all three - SAS Pro and Defender and AVG/AS - in
rtp, now? Or have you dropped the AVG AS rtp in favour of SAS Pro?

 

[Robinb]

no, I am only running AVG antispyware on one computer in realtime with WD
the other I have Superantispyware Pro on it running in real time.
You should only run one besides WD in realtime
robin

 

[Robinb]

I like them both equally, but with Superantispware you get lifetime updates
and upgrades
With AVG antispyware you get updates for 2yrs
If you decide on avg antispyware you should still get the free version of
superantispyware and visa versa
robin

 

[Guest]

Bob can't believe it but Threat Fire is something i just started to look at.
Dave and Bob (sounds like a television show) if you think of anything else
would you bring it to my attention please. Thanks Ron
BTW Ever use Avorax Shield ? Another BTW Dave I'm very suspicious of
A-Squared - A'2 or what ever their called now. I think they goad.

 

[Dave M]

The collective knowledge in this group is truly amazing. Thanks for that
pointer Bob, I just downloaded the free version for another look and the
price is right.

http://www.threatfire.com/features/

 

[Dave M]

Could be, I've had it loaded for a while and it's picked up a couple of
keylogger registry entries as well as the usual cookies. The problem I
found with it is that injection module. It was picked up continually by
Defender in the event log. Research indicates that the smaller companies
like A2 use purchased code... and that particular purchased one has the
potential for harm in the wrong hands.

Sorry no experience with Avorax Shield, but Wilder's is a great resource
(if you can handle the opinionated opinions and there are lots of hits
in their forums on that one.

 

[Anonymous Bob]

The collective knowledge in this group is truly amazing. Thanks for that
pointer Bob, I just downloaded the free version for another look and the
price is right.

http://www.threatfire.com/features/

I'm looking forward to your review.<g>

Bob Vanderveen

 

[Guest]

Me also Thanks Bob and Thanks again Dave, I'm going to take the dive. Ron

 

[Alan D]

I'm very suspicious of
A-Squared - A'2 or what ever their called now. I think they goad.

'goad'?? Could you explain please, Ron?

 

[Alan D]

If you decide on avg antispyware you should still get the free version of
superantispyware and visa versa

I have AVG Antispyware because it's built into the AVG security suite, and
I've just renewed my subscription to that for another year, having found no
good reason to change during that time. However, no one should be without
the free Superantispyware, in my book. I'd wondered about buying the Pro
version just to support them. I wasn't sure what would happen if I ran that
with rtp alongside AVG AS, but you seem to find no problems? Also of course
it would mean shutting off Defender's rtp and losing its system change
monitoring.

 

[Guest]

Goad is when a program scan says it found something but really didn't to
make you feel like it's working and maybe i should buy the better version.

Example of a discription of another product: - client app's scan reporting
poor; client requires installation of Microsoft .NET framework; free scan
prone to false positives that work as goad to purchase;

 

[Robinb]

i would not run superspyware and avg antispyware together in real time
protection.
They might not play friendly this way.
The AVG antispyware is in your avg internet suite and it already runs in
real time and since you have no issues with it you should keep that one.
Run superantispyware as your free program and start it manually, do not
allow it to startup on "boot up"

robin