Windows Defender (also Microsoft Security Essentials MSE) - Mini-Review

[IainB]

Originally posted:	2012-12-05
Last updated	2017-02-02

Basic Info

App Name	Windows Defender (also Microsoft Security Essentials MSE) (Anti-virus, spyware, and other malicious software detection/protection)
Thumbs-Up Rating
App URL	http://windows.microsoft.com/en-US/windows/security-essentials-download
App Version Reviewed	All $FREE versions and beta releases since Oct. 2010, including the current latest version:
User System Specs	Win 7-64 HP, Win8/8.1-64 and PRO, Win10-64 and PRO
Supported OSes	Bundled as "Defender" within Win8/8.1, and can be installed as "MSE" in Windows 7,Vista, and XP (64-bit/32-bit)
Support Methods	microsoft.com (link is to the download site). Updates to software and virus signature files are automatic, and can also be triggered via the Start menu to check for updates via Windows Update (in the Control Panel). Virus signature file updates can also be forced instantaneously from the application GUI. Help: is via links from the software GUI.
Upgrade Policy	Upgrades/updates are $FREE and loaded as above.
Trial Version Available?	For personal and small business use: $FREE Trial and Production version (they are one and the same). There is no PAID version.
Pricing Scheme	Defender is now bundled in Win8 and up, and MSE is $FREE For personal and small business use.

Intro and Overview:
Update 2015-05-14:
Protection for your PC

Windows Defender is now built-in to the Windows OS and helps guard your PC against viruses and other malware.
For a PC running an older version of Windows, you can download Microsoft Security Essentials.
______________________

Windows Defender Help quote:

Windows Defender is included with Windows and helps keep malware from infecting your PC in two ways:

• Providing real-time protection. Windows Defender notifies you when malware tries to install itself or run on your PC. It also notifies you when applications try to change important settings.
• Providing anytime scanning options. Windows Defender automatically scans your PC for installed malware on a regular basis, but you can also start a scan whenever you want. Windows Defender automatically removes (or temporarily quarantines) anything that's detected during a scan.

_______________________________________

This review follows on from a separate discussion thread in the DC Forum: Microsoft Security Essentials - new Beta out 2011-11-30 (updated 2012-07-11)
The virus-checking engine used by MSE used to be only available for businesses, and at a cost. It was regarded as being one of the best AV (Anti-Virus) tools available for business servers.
In October 2010 it was released for free for personal and small business users. I started using it as soon as the release was available, and it has been through several upgrades since then.
You can either use the released versions of MSE, or get on the beta or "pre-release" channel. (I have used both channels with no real problems.)
You can fit-and-forget MSE. The installation is straightforward. Once installed, everything is automatic, and seems to have been rock-solid stable (for me, at any rate). There are regular automatic virus signature file updates.
The user control is mainly around the setting of the default actions that are to be taken in the event of a malware detection at different threat levels - the actions are remove or quarantine. In the event, you can always tell MSE to ignore a given threat detection, thus it does not need to be blindly automatic or divorced from user control.

Over the time I have been using MSE on my PCs, it has detected several malwares, but my PCs have so far not been attacked by any really nasty viruses.

Description:
From the website:

Use Microsoft Security Essentials to help guard against viruses, spyware, and other malicious software. It provides real-time protection for your home or small business PCs.
Microsoft Security Essentials is free* and we designed it to be simple to install and easy to use. It runs quietly and efficiently in the background so you don't have to worry about interruptions or making updates.

• Here is an example of the main GUI tab:
          [attach]

[cyberdiva]

Thanks, Iain, for posting this.  It told me some things I didn't know and made me feel good about my decision to use MSE as my AV, along with MBAM Pro.  (I confess that the DC thread not long ago about MSE losing some German lab's endorsement after poor zero-day detections shook my confidence a little bit.)

[IainB]

...(I confess that the DC thread not long ago about MSE losing some German lab's endorsement after poor zero-day detections shook my confidence a little bit.)

Yes, I think that you may be referring to this discussion in DCF on 2012-11-30: Microsoft Security Essentials loses AV-TEST certification

I don't think that it was necessarily anything to panic about though.

[Carol Haynes]

Just to add - Windows 8 includes MSE as standard, there is no download. Really annoying that new machines come with it turned off and some adware (McAfee, Norton, Trend, Kaspersky) installed as a replacement.

Given the number of people I have seen ripped off by McAfee and Norton and their shoddy business practices (in particular ignoring auto renewal opt out) I would argue that they are fast becoming malware themselves.

[f0dder]

I don't think that it was necessarily anything to panic about though.

Me neither.

I wonder how much the extortion gang established antivirus companies paid for the Pretty Funky Weighting required for the low MSE rating?

[SQUIDMAN]

PC world and Cnet both gave this software pretty strong praise, I also use CC Cleaner, Spy Bot search and destroy, and Iorbit AV, all free. 

[TaoPhoenix]

I used to use Norton some ... ten(?) years ago. A Bunch of free stuff in the middle. Come on, with the dev power MS had, you know they could have done it in like 1999, they politically chose not to.

So finally someone did some PR math and decided to do it in house, and it's not bad. Nothing is perfect, but ... not bad. 10 years too late, but whatever, that's how MS works.

[Carol Haynes]

I am waiting for the prosecution in the EU given that it is included in Win8 and switched on as standard.

I suspect one of the reasons MS didn't do it earlier is because of all the anti-trust lawsuits they were facing - which makes it all the odder that the included it with Win8 ???

[wraith808]

I am waiting for the prosecution in the EU given that it is included in Win8 and switched on as standard.

If they do, they're shortsighted.

I suspect one of the reasons MS didn't do it earlier is because of all the anti-trust lawsuits they were facing - which makes it all the odder that the included it with Win8 ???

Probably because of the fact that many people don't know what they should get for AV, and the companies are taking advantage of that on Windows.  And since the firewall thing flew, I don't see any reason why this shouldn't.

[IainB]

2013-01-04: Minor update. Updated the review in the opening post with the latest version numbers. Only the 2 definitions files have in fact changed since the original review dated 2012-12-05, so the software itself is unchanged.

Old/previous:
   Antimalware Client Version: 4.1.522.0
   Engine Version: 1.1.9002.0
   Antivirus definition: 1.141.1057.0
   Antispyware definition: 1.141.1057.0
   Network Inspection System Engine Version: 2.1.8904.0
   Network Inspection System Definition Version: 18.36.0.0

Current/latest
   Antimalware Client Version: 4.1.522.0
   Engine Version: 1.1.9002.0
   Antivirus definition: 1.141.3134.0 <-----New
   Antispyware definition: 1.141.3134.0 <----- New
   Network Inspection System Engine Version: 2.1.8904.0
   Network Inspection System Definition Version: 18.36.0.0

[Darwin]

Thanks for the review, Iain. I used MSE exclusively, and without any problems, for about 3 years (2009 to 2012). I now have a Norton AV subscription (base AV, no firewall or anything else), because in April 2012, on my Windows 7 install, MSE stopped working entirely. After fussing and farting around for a couple of days trying to fix it (including loading an image file predating it ceasing to function), I started researching alternatives and settled on Norton. I am REALLY pleased/impressed - this is not the Norton that I recall from 2003 or so - as the hit on my computer resources is nil and the AV functions well.

Now, in July I started running Windows 8 preview, then the RTM version, and could probably be running MSE. However, havning paid for three years of Norton protection (got a deal when I purchased), and I can't bring myself to dump Norton, yet... I did dump Bitdefender, VIPRE and Spyware Doctor with AV with years left on their respective subscriptions when they started to hog resources, so we'll see how this goes in the future.

[TaoPhoenix]

For me for some time now MSE runs really heavily at boot up, enough so that I am starting to think about replacing it. There was a report elsewhere with the generally disturbed tone that AV isn't as good as most people hope it is, remarking on some delays for it to pick up brand new malware. MSE scored straight in the middle of their tests, with a couple of (newer?) companies I hadn't heard of scoring higher. 

Unless it's just really good at background protection, I can sorta count the number of MSE blocking events on one hand all last year.

[IainB]

In October 2010, I heard about and downloaded MSE for trial as soon as I read about its being released free for personal and small business use. Previously, I had tended to follow my eldest son's advice and used Avast! and then AVG. When I asked him about MSE (he was supporting the network operation for a kiwi bank at the time) he exclaimed "It's free? I didn't know about that. We use the MSE virus-checking engine on our servers and it's regarded as being one of the best there is. It has to be a good deal at free. Go for it."

The only real trouble I have had so far with MSE was when a critical Windows Update affecting MSE just would not complete, so I deinstalled MSE, ran CCleaner at max clean level, restarted everything, and then reinstalled MSE, and then the update went OK. I suspect that the problem was of my own making, as I had been switching between MSE ß releases and final releases, and I reckon I could have got the registry entries for MSE versions in a bit of a conflicting bind.
I have not otherwise experienced MSE causing any problems - e.g., a severe CPU load or lockup as may have been the case in some comments above.

[IainB]

2013-08-24: Minor update and new example of threat (Worm) quarantine.
Latest version details updated:

• Antimalware Client Version: 4.3.215.0
• Engine Version: 1.1.9800.0
• Antivirus definition: 1.157.246.0
• Antispyware definition: 1.157.246.0
• Network Inspection System Engine Version: 2.1.9800.0
• Network Inspection System Definition Version: 107.2.0.0

[IainB]

2015-05-14: Opening post updated and renamed as "Defender/MSE" to reflect the reality and implications of Defender now being built-in to (bundled with) the Windows OS for Windows 8 and upwards, though it is still available separately as "MSE" for earlier versions of Windows.

[Curt]

With a lifetime key, I am a long time user of Agnitum Outpost Security Suite Pro. But I too have made the swift to MSE ("4.8.204.0" since yesterday) because there is never any fuss, it is always working, and working discretely.

[Innuendo]

With a lifetime key, I am a long time user of Agnitum Outpost Security Suite Pro. But I too have made the swift to MSE ("4.8.204.0" since yesterday) because there is never any fuss, it is always working, and working discretely.

With MSE there is never any fuss because it rarely detects any malware on a person's system...even when you are sitting and watching all your files be deleted. If you want a free alternative to paid solutions, give BitDefender Free a look. It has excellent detection rates & doesn't beat you over the head with advertisements to purchase the pro version.

[tomos]

If you want a free alternative to paid solutions, give BitDefender Free a look. It has excellent detection rates & doesn't beat you over the head with advertisements to purchase the pro version.

odd, they dont seem to give any reason to buy the full version (or did I miss it?)
I mean why bother paying 60$ if the free version is so good?

[IainB]

UPDATE 2017-02-02: Given that there has been some recent discussion on some blogs/forums by "technical IT people with no axe to grind and who could be expected to know what they were talking about" regarding the merits (or otherwise) of some AV (Anti-Virus) products, I thought I should update this thread (and the opening post of this Mini-Review) accordingly.
So I shall add: Is Antivirus Software a Waste of Money?

In the ongoing discussions, there was a general argument that most AV products could be akin to a scam and in some cases as bad as a virus, with the sole exception of Microsoft's MSE/Defender.

I found this interesting because I had independently - and based on experience - already arrived at this potential conclusion some years back. In particular, for example, the experience of Norton/Symantec AV, as an OEM install, being notoriously cuckoo-like and hostile to other AV software to the extent that it blocks out Defender and puts hooks all over the ruddy registry - so much so that it even needs to have it's own special tool made by Symantec, to completely expunge it from the OS. Hence, "Like a virus."



As it says in the OP review notes:

Conclusions:
Windows Defender aka MSE is an excellent AV tool. Performs as designed, and very well.
There are other AV tools, but to a large extent they would seem to have been eclipsed or made redundant by Defender/MSE, as the latter would now seem to be the de facto anti-virus application and virtually a no-brainer for the majority of PC users