The majority of companies offer bootable images of their tools. These images can be copied on USB devices or optical discs.

Microsoft has now made available a public beta version of Windows Defender Offline Tool, a software designed to help users remove malware from their Windows PC.

Windows Defender Offline helps protect your PC from malware. Use this tool to install Windows Defender Offline on a startup device, such as a CD, DVD, or a USB flash drive. If your PC later becomes infected with malware, you can use that device to start your PC in a “clean” environment and attempt to remove threats.

The program is offered as a 32-bit or 64-bit web installer for the Windows operating system. Please note the architecture of the installer needs to correspond to the architecture of the target system that you want to scan for viruses. The web installer downloads 214 Megabytes of data at the time of testing. The data can be burned to CD or DVD, put on a USB flash drive or saved as an ISO file.

USB devices will be formatted by the installer. The user is informed about that step during setup.

It is interesting to note that the setup looks almost identical to that of Microsoft Standalone System Sweeper which is also currently offered as a beta version. It looks as if Microsoft has made the decision to rename the program to Windows Defender Offline Tool.

Windows users can then boot from the newly created media to scan their computer for malicious software traces. The interface of the program that you boot into looks almost identical to the Microsoft Security Essentials interface.

This is probably done to provide Windows users with an interface that they know how to work with. Microsoft recently made the announcement that they would integrate Security Essentials into their upcoming operating system Windows 8. (via Mike)

The basic rule is that if you are running a good anti-malware program, other anti-malware programs conflict with it in certain ways so you only run one, not two or three. In this case, the PC being used as an example is running excellent anti-malware software and, as it turns out, Windows Defender has disabled the manual scan option for that security software. This is how you can disable Windows Defender easily and potentially remedy such problems.

Open Windows Defender by typing the name in the search box at the Start menu and then press enter. Again, do not disable this if this is your only protection and you are not using other anti-malware.

Go to Tools at the top menu and click Options. Click Administrator. You will have to be using the Administrator account. If prompted for an administrator password, provide it.

Uncheck the box next to “Use this program” and then click the Save button. You will now see a message that the program has been turned off.

That is all there is to it. If you want to turn Windows Defender on again, simply open the program the same way and click on the “click here to turn it on” link in the “this program is turned off” window on startup.. If you want to ensure that it never gets turned on again, open the Services panel through the Control Panel and find Windows Defender. You may also type “services.msc” in the start menu and then find Windows Defender in the list and double-click it. Now change the Startup type to Disabled.

Next, click Apply and Windows Defender will not turn on by default for any reason. You can reset this in the future if you need to. Remember, this article is in no way stating that this is something you have to do, just that you can do it. The decision is yours. Be certain that your computer is protected against malware with a high quality, Windows 7 compatible anti-malware suite. To learn more about compatible security programs for Windows 7, visit the Microsoft website.

Kaspersky removed the virus diligently enough, but it had left her with an annoying and recurring Windows Defender 0X80070006 error code whenever she started her PC.  This code, if you do a quick search on Google is “Application failed to initialise” though it was clear to me straight away what had happened and it’s so common I thought I’d write it up here.

Windows Defender has been a staple component of Windows since the famous XP Service pack 2 that introduced it.  It’s a basic anti malware app that runs automatically in the background on your PC and helps keep it free of nasties.  It’s no substitute for a commercial anti-malware app though, MalwareBytes being my all-time favourite, and as such many third-party anti-virus programs disable it when you install them.  Kaspersky is no exception to this but on this occasion, as also happens so many times, something went wrong and Windows Defender wasn’t disabled, or wasn’t disabled correctly.

This is a simple-enough problem to fix and can be done in just a few simple steps.  I thought I’d talk you through those steps here.

The first thing to do is to open the Servicespanel in Windows.  While Windows Defender is to all intents and purposes a program, it’s not installed as a normal program.  Instead it runs as a Windows service, much in the same way your print spooler or your firewall does.

The best way to find services is just to type the word services into the search box in the Start Menu.  You’ll see in figure 1 that the services panel has an icon that’s a couple of cogs, a large one and a small one (it’s highlighted here).  Click on this option to open the services panel.

Fig 1

When the services panel opens you’ll see a very long list of a great many Windows services as in Figure 2, they’ll by default all be listed in alphabetical order.  Scroll down the list until you find Windows Defender.

Once you have Windows Defender visible in the services panel, right-click on it and select Properties from the context menu that appears.

Fig 2

After you’ve selected the properties for Windows Defender, a small dialog window will appear showing all the options for that service.  You can see this in Figure 3.  In the centre of this window is an option to select the service’s Startup Type.  This is the option you’ll want to change as, most likely, your new anti-virus software has failed to disable Windows Defender and its service is still running.

Just changing this Startup Type behaviour to Disabled and pressing the OK button in the window is enough to fix the problem.  You can now close the services window and restart your PC.  Now you won’t get the error any more as Windows Defender will no longer be running and there won’t be any conflicts between it and your new anti-virus software.

Fig 3

It can be verytempting to look down the list in the Services panel to see what else you may or may not need.  By default Windows 7 is very good at only running services that are actually required.  You may find that the Tablet PC Input Service is running, and if you don’t have a touch-enabled computer you can safely disable this service too.  I would alwaysadvise against shutting down any other services however.  Some are required for Windows to start and operate, and others are required by third-party software (including your anti-virus software).

You should always be extremely careful disabling Windows services unless you know exactly what they are!  Doing so could cause your computer to become unstable or even unable to start.

This information is then made available to the different Microsoft users throughout the world to make sure that when they suffer a similar issue they can take appropriate actions. It also gathers the information of the two services, Microsoft Security Essentials and Microsoft Defender to make sure that they are functioning at an optimal level. You can interpret this information for setting your personal computer with conditions which secure your computer from any malware abuse.

Microsoft Security Essentials presents two types of membership to users, basic and advanced. From basic members, SpyNet obtains information such as the origin of the software, the actions taken by Microsoft Security Essentials or the users, as well as whether the actions were helpful or not. It also collects some personal activity information. As an advanced member, in addition to the personal information, SpyNet also sends information such as hardware or software type, IP addresses, web browser, operating system, and so on. Though Microsoft does not use this information for any other purpose, some of you might not wish to have your personal information floating out there for others to see.

Microsoft does not allow its functionalities to be accessed until you are a member of the community and you share information with it. But there are alternatives, as always. Below you will find the information that you need to get access to all the functionalities of Microsoft Security Essentials and Microsoft Defender without having to share your personal details.

You can use the following two methods:

Blocking SpyNet by Changing Registry Entries

Here you will need to change the registry entries in your computer using the Registry Editor. Do this by following these simple steps:

• Click on Start menu from your windows desktop.
• Go to Run Dialog and type “Regedit” in the open field and click OK. The “Registry Editor” window will open as seen in figure 1.

• In the left pane navigate to the following path,
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
• Click on “Edit” and then “Permissions” option to open the permissions for SpyNet Dialog box.
• Select the username, for which you want to disable SpyNet, from the “Group or user names” pane.
• Check the “Full Control” box to allow editing. This will give the selected user full control over the SpyNet key.

The dialog box should look like figure 2.

After selecting value as 0, the Microsoft SpyNet screen will look like the snapshot as in figure 4. Note that both membership options are not selected.

Blocking SpyNet Using Host Files

Both Microsoft Security Essentials and Windows Defender use the following domains to communicate with the Microsoft server:

• Spynet2.microsoft.com
• Spynettest.microsoft.com

Modify your hosts file by adding the following addresses:

• 127.0.0.1 Spynet2.microsoft.com
• 127.0.0.1 Spynettest.microsoft.com

You can find the hosts file at the following location: C:\WINDOWS\system32\drivers\etc

Open the file using Notepad and follow the instructions given in the file.

This procedure will not affect your spyware definitions and or its ability to update.

Windows Defender has been integrated into Windows 7 by Microsoft. The program is automatically running after installation of the operating system. A basic Microsoft SpyNet membership is set as the default relationship to Spynet. Users can configure the option to send data to Microsoft during Windows 7 installation in the “Help protect your computer and improve Windows automatically” screen. The default option is to use recommended settings which will enable Microsoft SpyNet. The other two options provided are to only install important updates or to make the operating system ask later again.

A basic membership will send basic information to Microsoft including malicious software that has been detected, where that software came from and actions that have been applied by the user or by the program automatically.

Personal information might be send (such as form data) and Microsoft stated that they would not use the information to identify the user.

At least some Windows 7 users might want to change their membership level to avoid that reports are send to Microsoft.

This can be done directly in Windows Defender. The easiest way to start the program is to type [defender] in the search programs and files box of the start menu which should display the Windows Defender entry. The program can then be started either with the mouse or by pressing the return key on the computer keyboard.

Microsoft SpyNet can then be disabled by going to Tools > Microsoft SpyNet. This opens the following screen:

The default setting is “join with a basic membership”. Selecting “I don’t want to join Microsoft SpyNet at this time” instead will disable Microsoft SpyNet on the computer system so that no information are transferred to Microsoft.

Users who have Microsoft Security Essentials installed on the other hand need to disable Microsoft SpyNet in the Windows Registry where they need to locate the Registry key Hkey_LocaL_Machine\Software\Microsoft\Microsoft Antimalware\SpyNet\.

The Registry parameter SpyNetReporting needs to be set to 0 to disable the reporting to Microsoft.

Windows Defender comes with the usual options to automatically update the program and schedule regular system scans to protect the computer system. Default actions for low, medium and high alerts can be defined that will be executed by the anti-spyware program automatically.

Microsoft’s anti-spyware solution comes with the interesting advanced tool Software Explorer which can display extensive information about startup programs, currently running programs, network connected programs and Winsock service providers.

Each program and provider is sorted by company which makes it easier to find non-Microsoft programs that are running or connected to the computer system.

Microsoft has improved Windows Defender over the years. The company did receive lots of criticism in the beginning which can be attributed to a low spyware detection rate. Several anti-spyware products have performed better in tests, outlined here or here. Please note that the tests linked in this article have been performed about 10 months ago and that the situation may have changed in the mean time.

Which leads to the question: Are you running anti-spyware software? If so which?

The question that I’m asking myself is if you really need the Windows Defender if you have been using programs like ad-aware or spybot before and I think the answer is pretty obvious: No, Windows Defender is not needed. It might be fine for users who do not know and care about spyware and could help those users protect their computers in a more secure way from spyware and spam but everyone else should really stay with the program that they have been using before.

This is backed up by some tests, for instance by Suzi Turner from Zdnet, who used a virtual spyware infected system and tested the efficiency of Windows Defender. She came to the conclusion that Windows Defender was only able to detect 65% to 75% of the Spyware that was installed on the system compared to the commercial programs Spyware Doctor and Spyware Sweeper.

I personally think that Windows Defender is just another program that does not excel in what it should do. The same can be said for other softwares from Microsoft like the Windows Firewall for instance. I would advise everyone to either use other freely available tools to scan and protect your pc from spyware and spam or buy a commercial product that lives up to its promises. It is furthermore a good idea to test your system from time to time with a tool like Hijack This just to make sure nothing bypassed your anti-spyware program.