changing my homepage

[Guest]

Hi,
I installed Windows Defender to help with numerous issues that had sprung up
with programs that were preventing their own removal and have to say that
overall I have been satisfied with the program in this regard.

I am having a problem however, with Windows Defender changing my home page
on my IE every time it detects threats. I definitely don't want my home page
changed and although I know that some invasive worms can hi-jack my homepage,
none had before WD was installed. I know there has to be a setting that I
can turn off but I have not been able to find it.

Thank you for your help.

 

[Shiroy Choksey]

Hi Rob,

I was wondering if you could elaborate on what you mean by "everytime it
detects threats."

1. Which colour icon appears in the system tray / summary page of defender.
Is it Red / Yellow / Blue ?
2. What kind of threats are detected? Can you provide some threat names?
3. Is some external program continuosly modifying the home page?
4. Is your "Unknown Prompts" setting turned on (Tools > Options > Real Time
Protection Options > Software that has not been classified for risks) ?

If you need to find the setting that disables all Internet Explorer settings
protection, you can click to Tools > Options > Real-Time Protection. Uncheck
the box that says "Internet Explorer Configuration (Settings)"

* Please Note * : This is NOT recommended, as you will not be protected from
changes to your homepage, modifications to your IE Proxy settings,
installations of Browser Helper Objects (BHOs), or any other malicious
changes to your internet explorer settings).

Please let me know if this helps.

Thanks,
~Shiroy Choksey [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

Shiroy,
Thanks for speedy reply
Let me see if I can answer your questions pretty well

* The Notification Icon is Red
* Fotomoto is routinely being found, although I tell it to remove it
normally just quarantines.
* I run no programs that modify IE.
* No, Software not yet classified as risk is not active.
* The Tools > Options > Real-Time Protection. Uncheck

the box that says "Internet Explorer Configuration (Settings)" has been unchecked with no change in outcome.

* By every time, I mean that when I get a notification from Windows Defender
and tell it to Remove All, my home page is changed to the Microsoft "your
home page has been changed" page.

I hope this is enough information to fill in the picture for you. And thank
you for your assistance.
--
Rob J

Hi Rob,

I was wondering if you could elaborate on what you mean by "everytime it
detects threats."

1. Which colour icon appears in the system tray / summary page of defender.
Is it Red / Yellow / Blue ?
2. What kind of threats are detected? Can you provide some threat names?
3. Is some external program continuosly modifying the home page?
4. Is your "Unknown Prompts" setting turned on (Tools > Options > Real Time
Protection Options > Software that has not been classified for risks) ?

If you need to find the setting that disables all Internet Explorer settings
protection, you can click to Tools > Options > Real-Time Protection. Uncheck
the box that says "Internet Explorer Configuration (Settings)"

* Please Note * : This is NOT recommended, as you will not be protected from
changes to your homepage, modifications to your IE Proxy settings,
installations of Browser Helper Objects (BHOs), or any other malicious
changes to your internet explorer settings).

Please let me know if this helps.

Thanks,
~Shiroy Choksey [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.

Hi,
I installed Windows Defender to help with numerous issues that had sprung
up
with programs that were preventing their own removal and have to say that
overall I have been satisfied with the program in this regard.

I am having a problem however, with Windows Defender changing my home page
on my IE every time it detects threats. I definitely don't want my home
page
changed and although I know that some invasive worms can hi-jack my
homepage,
none had before WD was installed. I know there has to be a setting that I
can turn off but I have not been able to find it.

Thank you for your help.

 

[Shiroy Choksey]

Hi Rob,

I discussed your issue with the folks who write the definitions that detect
threats on the system, and they would really appreciate if you could send
them a sample of what you have. Sample submission involves sending us a copy
of the threat from your system. This will help us analyze it and figure out
more permanent removal mechanisms (if possible).

This site has all the instructions:
https://www.microsoft.com/security/portal/submit.aspx

You can fill in the details of this email into the comments section.

I will ensure that the right people investigate this issue.

Thanks,
~Shiroy Choksey [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.

Shiroy,
Thanks for speedy reply
Let me see if I can answer your questions pretty well

* The Notification Icon is Red
* Fotomoto is routinely being found, although I tell it to remove it
normally just quarantines.
* I run no programs that modify IE.
* No, Software not yet classified as risk is not active.
* The Tools > Options > Real-Time Protection. Uncheck

the box that says "Internet Explorer Configuration (Settings)" has been
unchecked with no change in outcome.

* By every time, I mean that when I get a notification from Windows
Defender
and tell it to Remove All, my home page is changed to the Microsoft "your
home page has been changed" page.

I hope this is enough information to fill in the picture for you. And
thank
you for your assistance.
--
Rob J

Hi Rob,

I was wondering if you could elaborate on what you mean by "everytime it
detects threats."

1. Which colour icon appears in the system tray / summary page of
defender.
Is it Red / Yellow / Blue ?
2. What kind of threats are detected? Can you provide some threat names?
3. Is some external program continuosly modifying the home page?
4. Is your "Unknown Prompts" setting turned on (Tools > Options > Real
Time
Protection Options > Software that has not been classified for risks) ?

If you need to find the setting that disables all Internet Explorer
settings
protection, you can click to Tools > Options > Real-Time Protection.
Uncheck
the box that says "Internet Explorer Configuration (Settings)"

* Please Note * : This is NOT recommended, as you will not be protected
from
changes to your homepage, modifications to your IE Proxy settings,
installations of Browser Helper Objects (BHOs), or any other malicious
changes to your internet explorer settings).

Please let me know if this helps.

Thanks,
~Shiroy Choksey [MSFT]

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hi,
I installed Windows Defender to help with numerous issues that had
sprung
up
with programs that were preventing their own removal and have to say
that
overall I have been satisfied with the program in this regard.

I am having a problem however, with Windows Defender changing my home
page
on my IE every time it detects threats. I definitely don't want my
home
page
changed and although I know that some invasive worms can hi-jack my
homepage,
none had before WD was installed. I know there has to be a setting
that I
can turn off but I have not been able to find it.

Thank you for your help.

 

[MacLeod]

Hi Shiroy,

I was wondering if you had an update to Rob's problem as I am having
the same issue with my sister's computer. Somehow her installation of
Windows Defender was compromised and she acquired the Win32 Fotomoto. I
downloaded and installed the final version. Now when her computer starts,
real-time protection immediately detects the Fotomoto and asks what action to
take. I tell it remove, but it quarantines instead. Real-time protection
will catch the Fotomoto 1-2 additional times. I turned off System Restore
and scanned again but it keeps coming back. This all started within the last
week, around 11/20/07 or so. Let me know if you have any thoughts. Meantime
I'll have her delete her temp files. Thanks.

 

[Bill Sanderson]

You might try updating both your antivirus and Windows Defender, restarting
in safe mode, and scanning with both the antivirus and Windows Defender.
You could even try a rootkit detector as well, such as AVG's.