Protect Your Computer with Windows Defender

Scheduled scans of your computer. By default, Windows Defender performs a quick scan of the most likely places for spyware to infect your computer every night at 02:00.

Real-time protection. Windows Defender alerts you when malicious programs try to run or install themselves.

Known legitimate programs. Windows Defender takes no action for known legitimate programs, allowing them to run normally.

Known malicious or potentially unwanted programs. Windows Defender does not allow known malicious programs to run normally. Instead, Windows Defender recommends options for dealing with the program based on the reported severity of the malicious program. You can ignore the alert, or you can remove or disable the program. Removing the program deletes it. Disabling the program puts it into a quarantine list that you'll learn how to access a bit later in this article.

Unknown programs. If you are an advanced member of the SpyNet community, or if you enable the Software that has not yet been classified for risks checkbox under Notification Options in the Options menu, Windows Defender will also alert you about unknown programs. For programs that Windows Defender doesn't already know about, it let's you decide whether the program should run. Windows Defender also gives you the option of sending information to Microsoft SpyNet about the program and the choice you made about allowing the program to run. As more people in the SpyNet Community report a particular program, this information allows Microsoft to make better decisions about what is and isn't spyware.

Use recommended settings. This option installs definition updates and also enlists your computer as basic member of the Microsoft SpyNet Community. When you remove or allow an unknown program, Windows Defender sends information about that program and the choice you made to SpyNet.

Install definition updates only. This option installs new definitions but does not enroll your computer in the SpyNet Community.

Ask me later. This option allows you to postpone the decision.

Quick scan. Windows Defender scans areas of your computer that are at the highest risk for spyware and also scans currently running programs. By default, Windows Defender runs a quick scan of your computer every night, so you probably don't need to worry too much about running quick scans manually. Just for peace of mind, I might run a quick scan of my computer after letting someone else use my computer or installing new software.

Full scan. Windows Defender scans all files on all hard disks and also scans all currently running programs. A full scan takes considerably longer to run than a quick scan, so it's best to run the full scan when you don't need your computer for a while. Even though you can continue working while the scan is in progress, things may seem a bit slower. Run a full scan any time you suspect that spyware may have been installed on your computer.

Custom scan. Windows Defender scans selected drives and folders. Run a custom scan when you suspect that a particular program or set of files may be malicious.

Auto Start. This option monitors programs that start with Windows and warns you when a program attempts to add itself to this list.

System Configuration (Settings). This option monitors Windows security settings and warns you when a program attempts to change them.

Internet Explorer Add-ons. This option monitors programs that start with Microsoft Internet Explorer and warns you when a program attempts to add itself to this list.

Internet Explorer Configurations (Settings). This option monitors Internet Explorer security settings and warns you when a program attempts to change these settings.

Internet Explorer Downloads. This option monitors add-ins for Internet Explorer and warns you when a program attempts to add itself to Internet Explorer.

Services and Drivers. This option monitors services and drivers and warns you if a program attempts to make changes to them.

Application Execution. This option monitors when programs start and any operations they perform while running.

Application Registration. This option monitors tools and files in the operating system where programs can register to run at any time, not just when you start Windows or another program.

Windows Add-ons. This option monitors add-on programs for Windows and warns you when an unknown or malicious program attempts to add itself to the list.

Scan the contents of archived files and folders for potential threats. I recommend leaving this option enabled. Many spyware programs masquerade as self-extracting archive files.

Use heuristics to detect potentially harmful or unwanted behavior by software that hasn't been analyzed for risks. Heuristics allows Windows Defender to detect potentially malicious activities for files that are not already in its set of spyware definitions. Using this feature incurs a slight performance penalty and can potentially increase the chances that a non-malicious program is flagged as malicious. However, the performance penalty is barely noticeable on modern computers, and the chance of false positives is a small price to pay for catching new malicious programs before they can do any harm.

Do not scan these files or locations. If Windows Defender repeatedly flags files that you know to be safe, you can make those files exempt from scanning.

Use Windows Defender. This option turns Windows Defender off or on.

Allow users to use Windows Defender. When enabled, non-administrative users can run scans and can also view potentially sensitive information such as the Windows Defender history. Consider turning this option off if you have limited user accounts on the computer (such as children's accounts in a household) that you would prefer not be able to scan the computer.

Startup programs. These are programs that start when Windows starts. You can use Software Explorer to disable a program from starting with Windows.

Tip: Check out the Scheduled Tasks already set up on your computer to make sure that the default time is a good one for you. To check scheduled tasks, click Start, point to All Programs, point to Accessories, and then look in the System Tools folder. With Automatic Updates, virus scanners, disk tune-ups, and other automated activities, it's always best to make sure tasks don't interfere with one another.

Currently running programs. These are programs that are running in the current session. This includes startup programs if they are currently running, so you may see programs that fall into both these categories. Software Explorer does allow you to end a process, but be careful when doing so: Doing so can often have unexpected results, such as the loss of data. If possible, close the program the normal way, instead.

Network-connected programs. These are programs that can connect to the network or the Internet. When you select a network-connected program, you are able to end the process or block any listening port the program uses to accept connections from the Internet. When blocked, the program can still send and receive solicited information from the Internet.

Winsock service providers. These are programs that perform low-level network functions for programs and services.