Using Client Security

Client Security offers three ways to help keep malware from infecting your computer:

  • Real-time protection. Client Security alerts you when malware attempts to install itself or run on your computer. It also alerts you when programs attempt to change important Windows settings.
  • SpyNet community. The online Microsoft SpyNet community helps you see how other people respond to software that has not yet been classified for risks. Seeing if other members of the community allow software can help you choose whether to allow it on your computer. In turn, if you participate, your choices are added to the community ratings to help other people choose what to do.
  • Scanning options. You can use Client Security to scan for malware that might be installed on your computer, to schedule scans on a regular basis, and to automatically remove any malware that is detected during a scan.

When you use Client Security, it's important to have up-to-date definitions. Definitions are files that act like an ever-growing encyclopedia of potential software threats. Client Security uses definitions to determine if software that it detects is malware, and then to alert you to potential risks. You can also set Client Security to check online for updated definitions before scanning.

Getting started

Follow these links to learn more about malware and Client Security:

  • How to tell if your computer is infected with malware
  • Malware: frequently asked questions
  • Understanding Client Security alert levels
  • Understanding Client Security real-time protection
  • What is Software Explorer?

Learn how to use Client Security

Follow these links for information about using Client Security:

  • Manually scan for malware and other potentially unwanted software
  • Respond to malware found on your computer
  • Schedule when Client Security scans your computer
  • Keep Client Security definitions up to date
  • View the progress of a Client Security scan
  • Join the Microsoft SpyNet community
  • View or clear the history in Client Security
  • Report suspicious software to Microsoft SpyNet
  • Add or remove items from the Client Security allowed list
  • Turn Client Security real-time protection on or off
  • Turn Client Security virus protection or spyware protection on or off
  • Turn Client Security on or off
  • Using Software Explorer


How to tell if your computer is infected with malware

You might have some form of malware on your computer if:

  • You notice new toolbars, links, or favorites that you did not intentionally add to your web browser.
  • Your home page, mouse pointer, or search program changes unexpectedly.
  • You type the address for a specific web site (for example, a search engine), but you are taken to a different web site without notice.
  • Files are automatically deleted on your computer.
  • Your computer is used to attack other computers.
  • You see pop-up ads, even if you're not on the Internet.
  • Your computer suddenly starts running more slowly that it usually does.

There might be malware on your computer even if you don't see any symptoms. This type of software can collect information about you and your computer without your knowledge or consent. To help protect your privacy and your computer, we recommend that you run Client Security at all times.

Related Topics


Malware: frequently asked questions

Here are answers to some common questions about malware.

What is spyware?

Spyware is software that can install itself or run on your computer without providing you with adequate notice, consent, or control. Spyware might not display symptoms after it infects your computer, but many malicious or unwanted programs can affect how your computer runs. Spyware can, for example, monitor your online behavior or collect information about you (including personally identifiable or other sensitive information), change settings on your computer, or cause your computer to run slowly.

What is a virus?

Computer viruses are software programs deliberately designed to interfere with computer operation, record, corrupt, or delete data, or spread themselves to other computers and throughout the Internet. Viruses often slow things down and cause other problems in the process.

How can I tell if I have malware or unwanted software on my computer?

You probably have some form of malware on your computer if:

    • You notice new toolbars, links, or favorites that you did not intentionally add to your web browser.
    • Your default home page, mouse pointer, or search program changes.
    • You type the address for a specific web site (for example, a search engine), but are taken to a different web site without notice.
    • Files are automatically deleted on your computer.
    • Your computer is used to attack other computers.
    • You see pop-up ads, even if you're not on the Internet.
    • Your computer suddenly begins to start or run slowly.

There might be malware on your computer even if you don't see any symptoms. This type of software can collect information about you and your computer without your knowledge or consent. Running Client Security whenever you use your computer can help you find and remove such software.

Where does malware and potentially unwanted software come from?

Unwanted software can be installed by web sites, downloaded programs, or a program you might install from a CD, DVD, external hard disk, or a device. Spyware is most commonly installed through free software, such as file sharing, screen savers, or search toolbars.

Can I get malware without knowing it?

Yes, some malware can be installed from a web site through an embedded script, or program in a web page. Some unwanted software requires your help to install through web pop-ups or free software that require you to accept a downloadable file. However, if you keep Windows up to date and don't reduce your security settings, you can minimize the chances of a spyware infection.

Review license agreements before installing software.

When you visit web sites, do not automatically agree to download anything the site offers. If you download free software, such as file sharing programs or screen savers, read the license agreement carefully. Look for clauses where you must accept advertising and pop-ups from the company, or that the software will send certain information back to the software publisher. For more information, go to the Microsoft Forefront Client Security web site by going to http://www.microsoft.com and searching for 'Forefront Client Security'.


Understanding Client Security alert levels

Alert levels help you choose how to respond to malware and potentially unwanted software. While Client Security will recommend that you remove malware, not all software that is detected is malicious or unwanted. The information in this table can help you decide what to do if Client Security detects potentially unwanted software on your computer.

Alert level | What it means | What to do
Severe | Widespread or exceptionally malicious programs, similar to viruses or worms, which negatively affect your privacy and the security of your computer, and can damage your computer. | Remove this software immediately.
High | Programs that might collect your personal information and negatively affect your privacy or damage your computer, for example, by collecting information or changing settings, typically without your knowledge or consent. | Remove this software immediately.
Medium | Programs that might affect your privacy or make changes to your computer that could negatively impact your computing experience, for example, by collecting personal information or changing settings. | Review the alert details to see why the software was detected. If you do not like how the software operates or if you do not recognize and trust the publisher, consider blocking or removing the software.
Low | Potentially unwanted software that might collect information about you or your computer or change how your computer works, but is operating in agreement with licensing terms displayed when you installed the software. | This software is typically benign when it runs on your computer, unless it was installed without your knowledge. If you're not sure whether to allow it, review the alert details or check to see if you recognize and trust the publisher of the software.
Not yet classified | Programs that are typically benign unless they are installed on your computer without your knowledge. | If you recognize and trust the software, allow it to run. If you do not recognize the software or the publisher, review the alert details to decide how to take action. If you're a SpyNet community member, check the community ratings to see if other users trust the software.


Understanding Client Security real-time protection

Real-time protection alerts you when malware attempts to install itself or run on your computer. Depending on the alert level, you can choose one of these actions to apply to the software:

  • Ignore. Allows the software to be installed or run on your computer. If the software is still running during the next scan, or if it the software tries to change security-related settings on your computer, Client Security will alert you about this software again. Once Client Security suspends the software, Ignore is not available.
  • Quarantine. When Client Security quarantines software, it moves it to another location on your computer, and then prevents the software from running until you choose to restore it or remove it from your computer.
  • Remove. Permanently deletes the software from your computer.
  • Always Allow. Adds the software to the Client Security allowed list and allows it to run on your computer. Client Security will stop alerting you to risks that the software might pose to your privacy or your computer. Add software to the allowed list only if you trust the software and the software publisher.
  • Clean. When possible, Clean removes only the infected part of a file, not the entire file.

If you have enabled alerts for software that is not yet classified, you will receive alerts if programs that are not yet analyzed for potential risks attempt to change important Windows settings. Because the software is already running on your computer, you can choose one of these actions:

  • Permit. Allows the software to change security-related settings on your computer.
  • Deny. Prevents the software from changing security-related settings on your computer.

You can choose the software and settings that you want Client Security to monitor, but we recommend that you use all of the real-time protection options, called agents. The following table explains each agent and why it is important.

Real-time protection agent | Purpose
Auto Start | Monitors lists of programs that are allowed to automatically run when you start your computer. Malware can be set to run automatically when Windows starts. That way, it can run without your knowledge and collect information. It can also make your computer start or run slowly.
System Configuration (Settings) | Monitors security-related settings in Windows. Malware can change hardware and software security settings, and then collect information that can be used to further undermine your computer's security.
Internet Explorer Add-ons | Monitors programs that automatically run when you start Internet Explorer. Malware can masquerade as web browser add-ons and run without your knowledge.
Internet Explorer Configurations (Settings) | Monitors browser security settings, which are your first line of defense against malicious content on the Internet. Malware can try to change these settings without your knowledge.
Internet Explorer Downloads | Monitors files and programs that are designed to work with Internet Explorer, such as ActiveX controls and software installation programs. These files can be downloaded, installed, or run by the browser itself. Malware can be included with these files and installed without your knowledge.
Services and Drivers | Monitors services and drivers as they interact with Windows and your programs. Because services and drivers perform essential computer functions (such as allowing devices to work with your computer), they have access to important software in the operating system. Malware can use services and drivers to gain access to your computer or to try to run undetected on your computer like normal operating system components.
Application Execution | Monitors security-related settings and redirected folders used by Windows Explorer. Malware can use some settings to monitor your network traffic without your knowledge. Malware can also redirect special folders, like your My Documents folder, to a new locations.
Application Registration | Monitors tools and files in the operating system where programs can register to run at any time, not just when you start Windows or another program. Malware can register a program to start without notice and run, for example, at a scheduled time each day. This allows the program to collect information about you or your computer or gain access to important software in the operating system without your knowledge.
Windows Add-ons | Monitors add-on programs (also known as software utilities) for Windows. Add-ons are designed to enhance your computing experience in areas such as security, browsing, productivity, and multimedia. However, add-ons can also install programs that will collect information about you or your online activities and expose sensitive, personal information, often to advertisers.
On Access Protection | Monitors when programs begin running. Client Security alerts you when it detects certain software specified in the definitions. In severe cases, the detected software can be suspended from running until you choose to take action.


What is Software Explorer?

Software Explorer in Client Security allows you to view detailed information about software that is currently running on your computer and that can affect your privacy or the security of your computer. You can see, for example, which programs run automatically when you start Windows and information about how these programs interact with important Windows programs and services.

Software Explorer helps you monitor the following items:

  • Startup programs, which are programs that run automatically when you start Windows, with or without your knowledge.
  • Currently running programs, which are programs that are currently running on the screen or in the background.
  • Network-connected programs, which are programs or processes that can connect to the Internet or to your home or office network.
  • Winsock service providers, which are programs that perform low-level networking and communication services for Windows and programs that run on Windows. These programs often have access to important areas of the operating system.

Note

  • If you are running Windows 2000 Service Pack 4, you can't use Software Explorer to monitor network-connected programs.


Manually scan for malware and other potentially unwanted software

In Client Security, you can choose to run a quick scan of your computer or a full system scan. If you suspect malware has infected a specific area of your computer, you can customize a scan by selecting only the drives and folders that you want to check.

A quick scan checks the places on your computer's hard disk that malware is most likely to infect and scans all currently running programs. A full scan will check all files on your hard disk and all currently running programs, but it might cause your computer to run slowly until the scan is complete. At any time, if you suspect that malware has infected your computer, run a quick scan.

In addition to manually running scans, you can schedule scans to run automatically. For more details, see Schedule when Client Security scans your computer.

To run a quick scan

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Scan.

To scan all areas of your computer

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click the Down arrow next to the Scan button, and then click Full Scan.

To scan specific areas of your computer only (custom scan)

You can select specific locations on your computer for Client Security to scan. However, if malware is detected, Client Security will then run a quick scan so the detected items can be removed from other areas of your computer, if needed.

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click the Down arrow next to the Scan button, and then click Custom Scan.
  3. Click Scan selected drives and folders, and then click Select.
  4. Select the files or folders that you want to scan, and then click OK.

Using advanced scanning options

When scanning your computer, you can choose from the following additional options:

  • Scan the contents of archived files and folders for potential threats. Scanning these locations might increase the time required to complete a scan, but malware can attempt to "hide" in these locations.
  • Use heuristics to detect potentially harmful or unwanted behavior by software that hasn't been analyzed for risks. Client Security uses definition files to identify known threats, but it can also detect and alert you about potentially harmful or unwanted behavior by software that is not yet listed in a definition file. For more information about definition files, see Keep Client Security definitions up to date.
  • Create a restore point before applying actions to detected items. Because you can set Client Security to automatically remove detected items, selecting this option allows you to restore system settings in case you want to use software that you didn't intend to remove.
  • Do not scan these files or locations. Use this option to select any files and folders that you don't want Client Security to scan.
  • Do not scan these file extensions. Use this option to specify file extensions that you don't want Client Security to scan.
  • Do not scan files accessed by these processes. Use this option to identify processes that can access files without Client Security scanning the files.

To choose advanced scanning options

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click the Tools button, and then click Options.
  3. Under Advanced options, configure the options that you want to use.
  4. When you have finished configuring advanced options, click Apply.


View the progress of a Client Security scan

You can view which type of Client Security scan is in progress and see how long it has been running.

To view the progress of a scan

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. If a scan is in progress, the progress is displayed until the scan is complete. If the scan is complete, the status will display the scan results, and the date and time that the scan completed.

Note

  • If a scan is in progress, you can also click the Client Security icon in the notification area to view the status of the scan. To choose when the icon should appear in the notification area, click Tools, click Options, and then, under Real-time protection options, click the option that you want.
  • To view when your computer was last scanned for malware, check the Status area on the Forefront Client Security Home page.


Keep Client Security definitions up to date

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

Definitions are files that act like an encyclopedia of known malware and other potentially unwanted software. Because malware is continually being developed, Client Security relies on up-to-date definitions to determine if software that is trying to install, run, or change settings on your computer is potentially unwanted or malicious software.

Client Security works with Automatic Updates in Windows to automatically install the latest definitions. To make sure that Automatic Updates is on, click Start, click Control Panel, and then click Performance and Maintenance. Click System, and then click the Automatic Updates tab.

To check for new definitions automatically before scheduled scans

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Tools, and then click Options.
  3. Under Automatic scanning, make sure the Automatically scan my computer (recommended) check box is selected.
  4. Select the Check for updated definitions before scanning check box, and then click Save.

If you don't use scheduled scans, or if you don't get updates automatically, you should check for new definitions at least once a week. To help protect your computer, Client Security will notify you if your definitions are out of date for more than seven days.

To check for new definitions manually

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click the Down arrow next to Help, and then click Check for updates.


Report suspicious software to Microsoft SpyNet

If you join the Microsoft SpyNet community, and if Client Security detects software on your computer that has not yet been classified for risks, you might be asked to send a sample of the software to Microsoft SpyNet for analysis. When you're prompted, Client Security displays a list of files that can help analysts determine if the software is malicious. You can choose to send some or all of the files in the list.

To send files to Microsoft SpyNet

  • If you suspect that a file or program on your computer might be spyware, you can send it to Microsoft. Complete the online instructions for reporting suspicious software to Microsoft SpyNet by going to http://www.microsoft.com and searching for 'report a possible spyware problem to Microsoft'.


Respond to malware found on your computer

Client Security can detect malware or potentially unwanted software on your computer by using real-time protection or by scanning. When Client Security detects malware or potentially unwanted software, you can review the item, apply the recommended action, or choose Smart Clean, remove, quarantine, clean, ignore, or allow the item.

Note

  • If you choose Always Allow for an item, Client Security will stop alerting you to risks that the software might pose to your privacy or your computer. Add software to the allowed list only if you trust the software and the software publisher.

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

To take recommended actions on malware or potentially unwanted software

You can choose to have Client Security take the recommended action on the malware. The recommended action is defined by the following hierarchy: by your Client Security administrator (these settings take highest precedence), settings you configured in Client Security, or the definition file from Microsoft.

  • To take recommended actions on malware found through real-time protection, either click the Client Security warning balloon, or right-click on the Client Security system tray icon and then click Take recommended action.

To review and specify actions to apply to detected malware or potentially unwanted software

  1. Right-click the Client Security system tray icon, and then click Review detected items.
  2. Click Review and then in the Client Security window, click Review items detected by real-time protection. The Apply actions to detected items page appears.
  3. For each item listed under Select an action to apply, select the item, review the information that Client Security displays about the item, and then select the action that Client Security should take on the item.
  4. After you have reviewed each item and selected an action, click Apply Actions.

To take action on malware by using Smart Clean

You can use Smart Clean to manage malware detected through real-time protection or through scans. For more information about Smart Clean, see About Smart Clean.

  • To take action on malware by using Smart Clean, click the Smart Clean button in the Client Security window or on the warning dialog box.


Add or remove items from the Client Security allowed list

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

If you trust software that Client Protection has detected, you can stop Client Protection from alerting you to risks that the software might pose to your privacy or your computer. To stop being alerted, you need to add the software to the Client Protection allowed list. If you decide that you want to monitor the software again later, you can remove it from the Client Protection allowed list at any time.

To add an item to the allowed list

  • The next time Client Security alerts you about the software, on the Action menu in the Alert dialog box, click Always Allow.

To remove an item from the allowed list

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Tools, and then click Allowed items.
  3. Select the item that you want to monitor again, and then click Remove From List.

Warning

  • Do not allow software with severe or high alert ratings to run on your computer because it can put your privacy and the security of your computer at risk.


View or clear the history in Client Security

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

The history displays actions you've applied to malware and other potentially unwanted software that Client Security has detected on your computer.

To view or clear the history

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click History.
  3. To delete all items in the list, click Clear History.


Using Software Explorer

Changing how a program runs on your computer, such as blocking Internet or network connections and ending processes, can cause problems with Windows and other programs. Use Software Explorer to change how a program runs on your computer only if you are certain the program is causing a problem.

To use some Software Explorer options, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

To view software running on your computer using Software Explorer

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Tools, and then click Software Explorer.
  3. In the Category list, select the type of software that you want to monitor.

Note

  • If you are running Windows 2000 Service Pack 4, you can't use Software Explorer to monitor network-connected programs.

Understanding Software Explorer details

Software Explorer displays basic information about programs, such as the program name, publisher, and version. Depending on the category you choose, you might also see these important types of information.

Auto Start | Indicates if the program is registered to start automatically when Windows starts.
Startup Type | The location where the program is registered to start automatically when Windows starts; for example, in the registry or the All Users Startup Folder.
Classification | Indicates if the program has been analyzed for risks to your privacy and the security of your computer. Note: Some programs that ship with the operating system, such as Internet Explorer or Windows Explorer, can be described as Not yet classified. This occurs if Forefront Client Security detects that additional software, such as a browser add-on or another software utility, is running with the program.
Ships with Operating System | Indicates if the program was installed as part of your Windows installation.
Digitally Signed By | Indicates if the software has been signed and, if so, if the publisher listed has signed it. If not, we recommend that you do not trust the publisher information provided with the software, and that you review more details before choosing if you trust the software itself.


Why can't I change a Client Security setting?

Whether or not you can change Client Security settings depends upon how the Client Security administrator has configured protection for the computer you're using. A Client Security administrator has three ways of preventing users from changing settings.

  • Your Client Security administrator can apply a policy to computers in your organization that prevents all users from changing Client Security settings. If the Client Security administrator applies this type of policy to your computer, you can open Client Security but you cannot change the settings. For example, if your Client Security administrator applies a policy to enable real-time protection on your computer, then the real-time protection settings will be grayed out when you open Client Security on your computer.
  • Your Client Security administrator can apply a policy that restricts access to the Client Security interface on the computers that the policy is applied to. In this case, the restriction applies to all users who log on to the computer. Users only have access to balloon tips and threat dialogs.
  • Finally, your Client Security administrator can apply a policy that allows local administrators to limit access to Client Security to users with local administrator privileges or allow access to all users. The following procedure describes this process.

To configure access to the Client Security interface

  1. Clicking Start, click Programs, click Microsoft Forefront, and then click Forefront Client Security.
  2. Click Tools, and then click Options.
  3. If you want to limit control of Client Security to administrators, under Administrator options, clear the Allow everyone to use this program check box.

    If you want to allow all users of this system to control of Client Security, select the Allow everyone to use this program check box.

  4. Click Save.


Schedule when Client Security scans your computer

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

We recommend that you schedule a daily quick scan. A quick scan will check the areas of your computer that malware is most likely to infect. If you want Client Security to check all files and programs on your computer, run or schedule a full scan.

To enhance the security of your computer, you can choose to automatically remove malware if it is detected during a scan.

To schedule scans

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Tools, and then click Options.
  3. Under Automatic scanning, select the Automatically scan my computer (recommended) check box, and then select the frequency, time of day, and type of scan that you want to run.
  4. To automatically remove malware after a scan, select the Apply default actions to items detected during a scan check box.
  5. Under Default actions, select the action that you want to apply to each Forefront Client Security alert, and then click Save.

Notes

  • You can't select a default action for software with a severe alert rating because Client Security automatically removes it or alerts you to remove it. If software has not yet been classified for potential risks to your privacy or your computer, you must review information about the software and then choose an action.
  • If Client Security alerts you about software and you choose to ignore it by selecting Ignore in the list of available actions, you are allowing the software to run on your computer. If the software acts suspiciously at a later time, Client Security will alert you about the software again or automatically apply actions that you have set for each type of alert. If you trust the software and do not want Client Security to automatically remove or quarantine it, see Add or remove items from the Client Security allowed list.


Join the Microsoft SpyNet community

Client Security detects known malware and other potentially unwanted software. This includes software that has not yet been analyzed for risks and any changes made to your computer by that software. By joining the online Microsoft SpyNet community, you can see how other people have responded to alerts about software that has not yet been analyzed. Seeing how other people have responded can help you decide what to do. If you choose to participate, the actions that you take for these alerts are added to the community ratings to help other people.

Malware is continually developed, so SpyNet ratings also help Microsoft determine which software to investigate. For example, if many people deny changes by software that has not yet been classified, Microsoft will analyze the software, determine if it is malware, and if needed, update the Client Security definitions. Up-to-date definitions help Client Security detect the latest malware threats and keep them from infecting your computer. Even if software is not malware, Client Security alerts you if it detects that software is operating in a way that might be malicious or unwanted.

If you join Microsoft SpyNet, Client Security automatically sends information to Microsoft about malware, potentially unwanted software, and software or changes by software that has not yet been analyzed for risks. The actions that are applied to the software are also reported to Microsoft. For more information about reports, read the Client Security privacy statement on the Microsoft Forefront Client Security Web site by going to http://www.microsoft.com and searching for 'Forefront Client Security privacy statement'.

To join the Microsoft SpyNet community

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Tools, and then click Microsoft SpyNet.
  3. Select the level of community participation you want by clicking Join with a basic membership or Join with an advanced membership, and then click Save.


Turn Client Security on or off

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

When Client Security is on, you will be alerted when malware tries to install itself, run on your computer, or change important Windows settings. If you use the default settings, Client Security will also check for new definitions, regularly scan for malware, and automatically remove any malware that it finds.

To turn Client Security on or off

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Tools, and then click Options.
  3. Under Administrator options, select or clear the Use the program check box, and then click Save.


Turn Client Security virus protection or spyware protection on or off

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

Client Security lets you separately turn on or off virus protection and spyware protection. Using one does not require that you use the other; however, it is recommended that you use both.

To turn Client Security protection for viruses or spyware on or off

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Tools, and then click Options.
  3. Under Administrator options, be sure the Use the program check box is selected. If this check box is cleared, all Client Security protection is disabled for this computer.
  4. To control virus protection, clear or select the Protect my system from viruses and other malicious software check box.
  5. To control spyware protection, clear or select the Protect my system from spyware and potentially unwanted software check box.
  6. Determine if you want users of this system who do not have administrator privileges to have control of Client Security. To do so, select or clear the Allow everyone to use this program check box.
  7. Click Save.


Turn Client Security real-time protection on or off

To complete these steps, you must have permission from your Client Security administrator and be logged in to your computer as an administrator.

To help prevent malware from infecting your computer, turn on Client Security real-time protection and select all real-time protection options. Real-time protection alerts you when malware attempts to install itself or run on your computer. You are also alerted if programs attempt to change important Windows settings.

To turn real-time protection on or off

  1. Open Client Security by clicking Start, clicking Programs, clicking Microsoft Forefront, and then clicking Forefront Client Security.
  2. Click Tools, and then click Options.
  3. Under Real-time protection options, select the Use real-time protection (recommended) check box.
  4. Select the options that you want. To help protect your privacy and your computer, we recommend that you select all real-time protection options.
  5. Under Choose if Client Security should notify you about, select the options you want, and then click Save.


Client Security License Terms

You can read the Client Security license terms on the Microsoft Forefront Client Security Web site by going to http://www.microsoft.com and searching for 'Forefront Client Security license terms'.


Read the Client Security privacy statement

Your privacy is important to us. You can read the privacy information about Client Security on the Microsoft Forefront Client Security Web site by going to http://www.microsoft.com and searching for 'Forefront Client Security privacy statement'.


About Smart Clean

Smart Clean is a feature that further helps to protect your computer from malware. If you choose Smart Clean, Client Security applies the default actions for detected software by using your current settings. If the default action fails, the next action recommended by Client Security or your administrator is automatically applied. In most cases, Smart Clean quarantines malware when the attempt to clean or remove the malware fails.

Smart Clean also removes detected software that does not have an action associated with it.

If you do not choose Smart Clean, Client Security applies the default action. If the default action fails, an error message appears and Client Security takes no further action.