This protection is provided by Windows, not by Security Essentials. The first thing I noticed was that a restricted user can't modify the hosts file. Real time protection was enabled during all tests. Both the virus and spyware definitions were version 1.69.64.0. The Virus definitions were created at 2:49AM. The tests were run under Windows XP SP3 on Octousing MSE version. It's easy to test and so I did, as described below. This made me wonder what happens if the hosts file gets modified while MSE is running. On my test Windows XP computer, an unmodified hosts file was left unchanged by the installation of Security Essentials. MSE doesn't always replace the hosts file. This may be a good decision, but it wasn't externalized, Gibson had to figure it out on his own. MSE gave him a new empty file after making a backup of the original. It turned out that when he installed Security Essentials, it replaced his hosts file.
