Anti-Malware Engineering Team

This blog provides information about what's happening in the anti-malware technology team at Microsoft. We're the team that builds the core antivirus, antispyware, anti-rootkit, and related technology, which is then used across a number of Microsof


Windows Defender Beta 2: Update

  • Comments 23
  • Likes

Hi all,

We’ve gotten some great feedback from places like this blog and our support newsgroups about the recently released Windows Defender Beta 2. We really appreciate the enthusiastic participation!

Some of this feedback has allowed us to identify a couple of problems with our setup on non-English versions of Windows: 

  • We have a problem installing on systems which don’t have a group named “Users”. On these systems, the group typically exists but it is in another language.
  • Sometimes the link to Windows Defender creates a new group called “Programs” at the top of the start menu.

Our international users are very important to us and so we are currently testing an updated version that fixes these issues.  That update will be available soon through the same links where you installed the original version. Until we make this version available, users may follow the steps in KB915087 to workaround these issues and successfully install Windows Defender Beta 2.

Another problem that was appearing in the newsgroups:

  • Uninstalling and reinstalling can temporarily cause problems updating signatures.

This will automatically get fixed in the next update of our signatures, which is scheduled for Tuesday. Please see KB915105 for more information.

Finally, we have also received a few questions about the tray icon. A consistent point of feedback from Windows users is that there are just too many icons that appear in the system tray.  With this in mind, we decided not to display a system tray icon for Windows Defender if no action is needed.  This way, we can help the industry move towards a model where the items in the system tray are programs that need a user's attention instead of items that are simply running.  As always, your comments on this are welcome.

Thanks again for all the support and please keep the feedback coming !


  • The new behaviour of the system tray icon was confusing, but I'm a power user and I'm used to the "old way".  I checked the services to see if it was still running and then made the right guess about the new behaviour.

    What does bug me is that every time I use DameWare, the WD icon with the question mark appears and/or the balloon text appears and I have tell it all over again that the "application change" is approved.  If I go into the Tools, Allowed Items, it *is* still approved, so quit reminding me!!

  • I like the new interface, it's really clean and streamlined.

    Regarding the icon in the notification area (dudes, if Raymond Chen hears you talking about system tray, he'll kick you!), give us (power users) and option to turn it on (off by default is fine).

    I like the idea used in OneCare, a single icon that displays status from multiple services (AV, firewall, etc.) If there's some way you could combine the icon for AU, Windows Defender and the Firewall into one holistic icon, it would be great.

  • Removing the tray icon was a bad idea.  How is the average user meant to know if WD fails to load, or is compromised after attack by malware or virus?  What if an as yet undetectable virus or malware targets WD and shuts down its running processes?  We both know that there is *always* a window of opportunity when a new attack is not detectable.

  • I feel it is very important to know that you are being protected by Windows Defender, and the system tray icon is where this is needed. For applications that are just going in the background, and do not require much (if any) user intervention, a systray icon is not needed. However, Windows Defender is not one of these applications. Since you say you have recieved feedback in both directions, may I propose a simple solution? That is, make it an option.

    "Show Windows Defender Tray icon?"

    Make it off by default if the majority of feedback goes in that direction. However, security software should never be running and not show you. How do you know if real-time protection is doing anything if there's no tray icon?

  • I have been unable to use the product; whenever I try to get updates, I get this error from the system tray icon:

    windows defender unable to complete the update: 0x80240025

    btw: I could not find a way to provide feedback easily from the GUI, nor the website.  Perhaps a link to the newsgroup on the GUI or here?


  • Installation went very sweetly, like the idea of getting updated definitions from Windows Update and before the scheduled scan, however I also feel it should be made an option whether you want a tray icon running or not. Overall, well done, I like this product very much.

  • Defender updates are not working for me at all.  Here's my setup:
    - Windows XP Pro w/all updates installed (as of 2/18/06)
    - Have Windows Update configured via AD Group Policy to obtain updates from my company's WSUS server
    - Previously had Anti-Spyware Beta 1 installed
    - Did not remove Beta 1 before installing Beta 2
    - Installed Beta 2, it looked like it successfully removed Beta 1.  No install errors.
    - Rebooted after install
    - Attempted to update signature files, got "no updates required" message
    - Followed instructions in KB915087
    - Tried to update and now get, "Windows Defender was unable to complete the update: 0x8024402c"

    Any ideas?


    PS I like the new look.  It also displays correctly with large fonts; the previous version did not.

  • Even better, in my opinion, than a tray icon to assure people that WD is running would be to have it monitored by Security Center. That way, if ever WD failed, the user would get a warning from Security Center rather than having to notice that the WD icon has suddenly disapeared.

  • I'm glad the icon is gone, and I agree with the sentiment from the main blog post-- system tray icons should be used for gaining a person's attention, not for replacing the rest of the task bar. Besides, most people never see them anyway since Windows XP default setting is to "hide inactive icons" (which, btw, is the most irritating feature EVER in Windows with Desktop Cleanup coming in second). As a compromise, however, I agree with a couple other posts that have said there should be an option to enable the tray icon (off by default).

  • Yeah i agree with the other guys. The tray icon is definately essential, in my oppinion.

    I do have a problem though...Whenever i try to run the installer package, it just freezes at "Please wait while the installation wizard installs Windows Defender. This may take several minutes."

    Nothing loads up in the little white bar. Is this a known bug or something?

  • Please make it optional to have an icon in the notification area for Windows Defender. I stopped worrying about how many icons were in the notification area once someone showed me how to enable "Hide Inactive Icons" in the Taskbar and Start Menu Properties. It would be good if Windows Defender had an icon like the one for Windows OneCare, that one is green when status is good.

  • I've installed Defender beta 2 last week and today I saw its icon in the system tray (with a yellow exclamation mark). When I open Defender, it says: "You haven't scanned your computer in 4 days".. so nothing bizarre at this point. But When I click the "Start Scan" button I get the following error code: "0x80004003. Invalid Pointer"

    Brief Info:
    Windows Defender Version:  1.1.1051.0
    Engine Version: 1.1.1185.0
    Signature Version:  1.13.1276.3

    Runs on WinXP Pro (SP2) English version with Turkish format.


  • I was very confused by the lack of a system tray icon - made me feel uncertain as to whether it was really running or not, and thus nervous.  I think you should fix that.

  • I agree with Karl about the tray icon option idea, also what happend to the tracks eraser? I found that real useful for clearing my internet history & generally cleaning up other areas of my pc. It would be good as well, if we could be able to display the status of defender in the sp2 security center, so that i didn't have to open seperate apps to check my settings.

  • I don't have any problems with the system icon not being displayed.  Historically for products I deploy (a larger enterprise company), I try to hide/remove the icon whenever possible.  Having it only appear when there is an issue is a good idea, though I'd prefer that the 'mouse over' for the icon would give a 'Fisher Price' reason for why it is up, so that problem can be described without too much interaction with the system (using the KISS method).

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment