Microsoft's free Windows Defender ships standard with Windows Vista and is available as a free download for Windows XP SP2. If it had presented itself as an anti-adware program, we'd be less hard on it, but Defender's Web site asserts that the software provides "Spyware protection for free," and in that claim it fails.

In tests performed by AV-Test.org, Windows Defender did detect all ten of the active adware threats it was exposed to. It detected less than 50 percent of the 46,352 inactive adware samples we threw at it--hardly admirable but middle of the road among the six products tested for our October 2007 issue's antispyware roundup "Die Spyware Die!" In disinfection tests, the program successfully removed 55 percent of adware files and Registry entries, missing PremiumSearch, (which messes with Internet Explorer's home page and favorites and produces pop-up ads) and Starware (which creates an IE search bar).

But with regard to spyware, the story is entirely different and somewhat by design. Microsoft says in its own product documentation that Windows Defender is not a replacement for full anti-virus protection--in contrast to the company's subscription-based Windows OneCare antimalware suite--and makes clear that Windows Defender won't block such virulent computer threats as password-stealing bots and Trojan horse programs, some of which can be classified as spyware. Sure enough, in our tests the program neither detected nor disinfected the ten active spyware threats we introduced. It did, however, detect 7 percent of the 6365 inactive password stealers we threw at it. It failed to detect any inactive rootkits.

Windows Defender did excel in behavior-based protection, which detects changes to key areas of the system without having to know anything about the actual threat. This type of protection is important in the case of a zero-day threat which runs rampant before security companies have a chance to patch their software. The program detected all additions to the 'Run' keys (HKCU and HKLM), all additions to the startup folder, all changes to the Internet Explorer Search and Start pages and changes to the Hosts file (which can redirect a URL to a malicious Web site).

Windows Defender is easy to understand and configure. There's little user interaction beyond the option of choosing a low, medium, or high level of security. Windows Defender was the only stand-alone antispyware program we tested for our October issue roundup that by default has a regularly scheduled scan (at 2 a.m. daily). In Vista, it is the only antispyware tool that integrates with Internet Explorer 7 Protected Mode to permit scanning of downloaded files before they are saved or executed. Warning: Telephone support for the program is expensive. After two free calls, you must pay $35 per request. E-mail and Web-based support is free.

Windows Defender is certainly better than nothing. It combats adware and offers behavior-based protection that should block many threats that might try to make unwelcome changes to your system, but if a Trojan horse or other piece of malicious spyware slips past Defender's first line of defense, you'll need something else to clean up the mess.

Ryan Naraine