Windows Defender.

Hernan,

I'm writing this from (and checking things out) on a WinXP SP3 version of Defender... I believe some options might be different on Vista and/or WIn7 --- so keep this in mind.

1)  You can simply leave the High/Medium/Low Alert items on "Default action (definition-based)".   These determine what you want Defender to SUGGEST to you in its DISPLAY (aka "ASK") "when items with these alert levels are detected".

Trying to be more precise, Defender will indeed ASK you what you want it to do when it finds "questionable" items.   While ASKING you, it will also offer its SUGGESTION about how it believes you should proceed.   You can then accept its suggestion, or choose to override it.

For HIGH RISK items, it will suggest you remove the item immediately.

For MEDIUM RISK items, "Review the alert details to see why the software was detected. If you do not like how the software operates or if you do not recognize and trust the publisher, consider blocking or removing the software".

For LOW RISK items, "This software is typically benign when it runs on your computer, unless it was installed without your knowledge. If you're not sure whether to allow it, review the alert details or check to see if you recognize and trust the publisher of the software".

By changing from "Default action (definition-based)" to any of the alternative choices (Ignore/Remove/Quarantine), that should only affect the SUGGESTION that Defender will offer you when it ASKS.   As an extreme (BAD) example, if you set HIGH RISK items to "Ignore", then upon finding a high risk item, rather than suggesting you delete (or at the very least, quarantine) it, it will instead follow your instructions, and only suggest you ignore it.

So I have... and suggest you... simply allow it to display the defaults... for what it suggests you do. 

Note:  If you have enabled the automatic scan option, I would UNcheck the box marked "Apply default actions to items detected during a scan".   Leaving it checked would have it automatically remove a "high risk" item --- even if it later turns out to be a F/P.   By UNchecking, it will display the item, with its "recommendation" that you remove it --- but allowing YOU the ultimate decision as to how to proceed (e.g., you can ignore it if you believe it's an F/P, until you have time to investigate and confirm your suspicions).

2) Yes, UNfortunately, it is NORMAL for Defender to classify some "well-known" programs, including WinPatrol, as "Not yet classified".   It's been doing that for as long as I remember, and so I don't expect things to change at this point.   On my system, the following are also "not yet classified":

Cyberlink PowerCinema DVD Launcher

two of my Intel Wireless-Adapter applications

a 3rd-party time-clock synchronization

And "Adobe Reader's Speed Launcher" is classified as "in progress" ---- whatever THAT means!

Bottom line, it's normal.  Nothing to do, nothing to worry about.

3)  for SpyNet, yes, I would join it at the advanced level.   By doing so, you're giving Microsoft permission to learn about the spyware problems (if any) encountered on your computer.   Consequently, they are maintaining the largest such database in the world.   Unfortunately, I have never seen an update notice from them... and can't possibly explain why they haven't classified a program as popular as WinPatrol.   regardless, I'm willing to share such information with them.

See more here:   http://en.community.dell.com/support-forums/virus-spyware/f/3522/p/19168512/19291498.aspx#19291498

In particular, I'm quoting Joe53's entry there:

One benefit of joining SpyNet is that knowing how other Windows Defender users chose to respond to a program may help you decide how to do so. It can also provide Microsoft with useful data that can improve the software.

 I must confess I too was initially reluctant to use SpyNet, because of privacy concerns. I saw this from Bill Castner, whose advice I've always trusted:

 "Defender benefits from the feedback of 100s of millions of computers: scanned monthly by the Malicious Software Removal Tool (MSRT) (700 million every Month), by OneCare installations, and by Forefront installations, as well as others running Windows Defender (~ 35 million computers) who participate in SpyNet. This means that alone of the anti-malware utilities, Windows Defender has the largest base of actual incident as well as heuristically determined anomalies on which to develop its definition and other updates. There is not a competitive product that can match the reporting base of Defender."

============================

For more information on Defender, see http://naut.homestead.com/files/Free/castner.html