Microsoft Windows Defender 1.1

Windows Defender did excel in behavior-based protection, which detects changes to key areas of the system without having to know anything about the actual threat. This type of protection is important in the case of a zero-day threat which runs rampant before security companies have a chance to patch their software. The program detected all additions to the 'Run' keys (HKCU and HKLM), all additions to the startup folder, all changes to the Internet Explorer Search and Start pages and changes to the Hosts file (which can redirect a URL to a malicious Web site).

Windows Defender is easy to understand and configure. There's little user interaction beyond the option of choosing a low, medium, or high level of security. Windows Defender was the only stand-alone antispyware program we tested for our October issue roundup that by default has a regularly scheduled scan (at 2 a.m. daily). In Vista, it is the only antispyware tool that integrates with Internet Explorer 7 Protected Mode to permit scanning of downloaded files before they are saved or executed. Warning: Telephone support for the program is expensive. After two free calls, you must pay $35 per request. E-mail and Web-based support is free.

Windows Defender is certainly better than nothing. It combats adware and offers behavior-based protection that should block many threats that might try to make unwelcome changes to your system, but if a Trojan horse or other piece of malicious spyware slips past Defender's first line of defense, you'll need something else to clean up the mess.

Ryan Naraine