Hi,
I installed Windows Defender to help with numerous issues that had sprung up
with programs that were preventing their own removal and have to say that
overall I have been satisfied with the program in this regard.

I am having a problem however, with Windows Defender changing my home page
on my IE every time it detects threats. I definitely don't want my home page
changed and although I know that some invasive worms can hi-jack my homepage,
none had before WD was installed. I know there has to be a setting that I
can turn off but I have not been able to find it.

Thank you for your help.
--
Rob J

Hi Rob,

I was wondering if you could elaborate on what you mean by "everytime it
detects threats."

1. Which colour icon appears in the system tray / summary page of defender.
Is it Red / Yellow / Blue ?
2. What kind of threats are detected? Can you provide some threat names?
3. Is some external program continuosly modifying the home page?
4. Is your "Unknown Prompts" setting turned on (Tools > Options > Real Time
Protection Options > Software that has not been classified for risks) ?

If you need to find the setting that disables all Internet Explorer settings
protection, you can click to Tools > Options > Real-Time Protection. Uncheck
the box that says "Internet Explorer Configuration (Settings)"

* Please Note * : This is NOT recommended, as you will not be protected from
changes to your homepage, modifications to your IE Proxy settings,
installations of Browser Helper Objects (BHOs), or any other malicious
changes to your internet explorer settings).

Please let me know if this helps.

Thanks,
~Shiroy Choksey [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.





"Rob J" <(E-Mail Removed)> wrote in message
news:A13B781B-215D-46A1-B953-(E-Mail Removed)...
> Hi,
> I installed Windows Defender to help with numerous issues that had sprung
> up
> with programs that were preventing their own removal and have to say that
> overall I have been satisfied with the program in this regard.
>
> I am having a problem however, with Windows Defender changing my home page
> on my IE every time it detects threats. I definitely don't want my home
> page
> changed and although I know that some invasive worms can hi-jack my
> homepage,
> none had before WD was installed. I know there has to be a setting that I
> can turn off but I have not been able to find it.
>
> Thank you for your help.
> --
> Rob J

Shiroy,
Thanks for speedy reply
Let me see if I can answer your questions pretty well

* The Notification Icon is Red
* Fotomoto is routinely being found, although I tell it to remove it
normally just quarantines.
* I run no programs that modify IE.
* No, Software not yet classified as risk is not active.
* The Tools > Options > Real-Time Protection. Uncheck
> the box that says "Internet Explorer Configuration (Settings)" has been unchecked with no change in outcome.
* By every time, I mean that when I get a notification from Windows Defender
and tell it to Remove All, my home page is changed to the Microsoft "your
home page has been changed" page.

I hope this is enough information to fill in the picture for you. And thank
you for your assistance.
--
Rob J


"Shiroy Choksey" wrote:

> Hi Rob,
>
> I was wondering if you could elaborate on what you mean by "everytime it
> detects threats."
>
> 1. Which colour icon appears in the system tray / summary page of defender.
> Is it Red / Yellow / Blue ?
> 2. What kind of threats are detected? Can you provide some threat names?
> 3. Is some external program continuosly modifying the home page?
> 4. Is your "Unknown Prompts" setting turned on (Tools > Options > Real Time
> Protection Options > Software that has not been classified for risks) ?
>
> If you need to find the setting that disables all Internet Explorer settings
> protection, you can click to Tools > Options > Real-Time Protection. Uncheck
> the box that says "Internet Explorer Configuration (Settings)"
>
> * Please Note * : This is NOT recommended, as you will not be protected from
> changes to your homepage, modifications to your IE Proxy settings,
> installations of Browser Helper Objects (BHOs), or any other malicious
> changes to your internet explorer settings).
>
> Please let me know if this helps.
>
> Thanks,
> ~Shiroy Choksey [MSFT]
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
>
>
>
> "Rob J" <(E-Mail Removed)> wrote in message
> news:A13B781B-215D-46A1-B953-(E-Mail Removed)...
> > Hi,
> > I installed Windows Defender to help with numerous issues that had sprung
> > up
> > with programs that were preventing their own removal and have to say that
> > overall I have been satisfied with the program in this regard.
> >
> > I am having a problem however, with Windows Defender changing my home page
> > on my IE every time it detects threats. I definitely don't want my home
> > page
> > changed and although I know that some invasive worms can hi-jack my
> > homepage,
> > none had before WD was installed. I know there has to be a setting that I
> > can turn off but I have not been able to find it.
> >
> > Thank you for your help.
> > --
> > Rob J
>
>
>

Hi Rob,

I discussed your issue with the folks who write the definitions that detect
threats on the system, and they would really appreciate if you could send
them a sample of what you have. Sample submission involves sending us a copy
of the threat from your system. This will help us analyze it and figure out
more permanent removal mechanisms (if possible).

This site has all the instructions:
https://www.microsoft.com/security/portal/submit.aspx

You can fill in the details of this email into the comments section.

I will ensure that the right people investigate this issue.

Thanks,
~Shiroy Choksey [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.






"Rob J" <(E-Mail Removed)> wrote in message
news:B47F75AC-D1EC-4A43-A53A-(E-Mail Removed)...
> Shiroy,
> Thanks for speedy reply
> Let me see if I can answer your questions pretty well
>
> * The Notification Icon is Red
> * Fotomoto is routinely being found, although I tell it to remove it
> normally just quarantines.
> * I run no programs that modify IE.
> * No, Software not yet classified as risk is not active.
> * The Tools > Options > Real-Time Protection. Uncheck
>> the box that says "Internet Explorer Configuration (Settings)" has been
>> unchecked with no change in outcome.
> * By every time, I mean that when I get a notification from Windows
> Defender
> and tell it to Remove All, my home page is changed to the Microsoft "your
> home page has been changed" page.
>
> I hope this is enough information to fill in the picture for you. And
> thank
> you for your assistance.
> --
> Rob J
>
>
> "Shiroy Choksey" wrote:
>
>> Hi Rob,
>>
>> I was wondering if you could elaborate on what you mean by "everytime it
>> detects threats."
>>
>> 1. Which colour icon appears in the system tray / summary page of
>> defender.
>> Is it Red / Yellow / Blue ?
>> 2. What kind of threats are detected? Can you provide some threat names?
>> 3. Is some external program continuosly modifying the home page?
>> 4. Is your "Unknown Prompts" setting turned on (Tools > Options > Real
>> Time
>> Protection Options > Software that has not been classified for risks) ?
>>
>> If you need to find the setting that disables all Internet Explorer
>> settings
>> protection, you can click to Tools > Options > Real-Time Protection.
>> Uncheck
>> the box that says "Internet Explorer Configuration (Settings)"
>>
>> * Please Note * : This is NOT recommended, as you will not be protected
>> from
>> changes to your homepage, modifications to your IE Proxy settings,
>> installations of Browser Helper Objects (BHOs), or any other malicious
>> changes to your internet explorer settings).
>>
>> Please let me know if this helps.
>>
>> Thanks,
>> ~Shiroy Choksey [MSFT]
>>
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>>
>>
>>
>>
>> "Rob J" <(E-Mail Removed)> wrote in message
>> news:A13B781B-215D-46A1-B953-(E-Mail Removed)...
>> > Hi,
>> > I installed Windows Defender to help with numerous issues that had
>> > sprung
>> > up
>> > with programs that were preventing their own removal and have to say
>> > that
>> > overall I have been satisfied with the program in this regard.
>> >
>> > I am having a problem however, with Windows Defender changing my home
>> > page
>> > on my IE every time it detects threats. I definitely don't want my
>> > home
>> > page
>> > changed and although I know that some invasive worms can hi-jack my
>> > homepage,
>> > none had before WD was installed. I know there has to be a setting
>> > that I
>> > can turn off but I have not been able to find it.
>> >
>> > Thank you for your help.
>> > --
>> > Rob J
>>
>>
>>

Hi Shiroy,

I was wondering if you had an update to Rob's problem as I am having
the same issue with my sister's computer. Somehow her installation of
Windows Defender was compromised and she acquired the Win32 Fotomoto. I
downloaded and installed the final version. Now when her computer starts,
real-time protection immediately detects the Fotomoto and asks what action to
take. I tell it remove, but it quarantines instead. Real-time protection
will catch the Fotomoto 1-2 additional times. I turned off System Restore
and scanned again but it keeps coming back. This all started within the last
week, around 11/20/07 or so. Let me know if you have any thoughts. Meantime
I'll have her delete her temp files. Thanks.

You might try updating both your antivirus and Windows Defender, restarting
in safe mode, and scanning with both the antivirus and Windows Defender.
You could even try a rootkit detector as well, such as AVG's.

"MacLeod" <(E-Mail Removed)> wrote in message
news9025D4C-1A57-4912-ABA7-(E-Mail Removed)...
> Hi Shiroy,
>
> I was wondering if you had an update to Rob's problem as I am having
> the same issue with my sister's computer. Somehow her installation of
> Windows Defender was compromised and she acquired the Win32 Fotomoto. I
> downloaded and installed the final version. Now when her computer starts,
> real-time protection immediately detects the Fotomoto and asks what action
> to
> take. I tell it remove, but it quarantines instead. Real-time protection
> will catch the Fotomoto 1-2 additional times. I turned off System Restore
> and scanned again but it keeps coming back. This all started within the
> last
> week, around 11/20/07 or so. Let me know if you have any thoughts.
> Meantime
> I'll have her delete her temp files. Thanks.