BleepingComputer.com: Spybot - Registry Changes.....i Don't Know What To Do!

Since I downloaded Spybot I've had pop-up boxes asking should I allow certain registry changes. I may have allowed changes I shouldn't have or not to one's I should....I just don't know.

On the whole I like spybot but don't like this registry stuff as I don't have a clue about it. Any advice?

Thanks

A general rule to follow:
If you're installing a program, that you trust, and it asks about a registry change, Allow it.
If you're not installing any programs, and it asks about a registry change, Deny it.

If you permanently allowed something you shouldn't have, or permanently blocked something you shouldn't have, by putting a check next to Remember this decision, you can reverse the changes.

Right-click on the TeaTimer system tray icon, and select Settings.
This will bring up TeaTimer's "White & Black List".
There are four (4) Buttons accross the top of the "White & Black List":

* Allowed processes
* Blocked processes
* Allowed registry changes
* Blocked registry changes

If you don’t see all four buttons, try expanding the window to the right, by clicking on the edge of the window, and dragging it.

The buttons you're looking for in the "White & Black List" are, Allowed registry changes, and Blocked registry changes.
You can review all the entries that you've stored.
You can also delete entries by clicking on the scripted black "X", to the right of the entry.
When your finished, click the OK button.
This will make TeaTimer "forget", what you told it to remember.
During future changes to these items, TeaTimer will issue a pop-up dialog, asking if you want to Allow, or Deny, the change.

If you have any questions about a particular entry, you can post about it here, and I'm sure someone will be able to help you out.

tg1911, on May 1 2007, 12:45 PM, said:

Thank you for your reply. I looked where you pointed me and there was only one item in the blocked area so I clicked on the x and it went. Maybe in the past I have clicked to block but not to remember and if so maybe there are other changes but too late to worry about that now. I'd prefer not to be given the choice of changing the registry as I don't understand what to do there. Is there a way to use Spybot without that part of it?

Regards

Open Spybot, up in the top left click on MODE and choose ADVANCED. Down at the bottom left, click on TOOLS.

In the pane that comes up, click RESIDENT. Uncheck RESIDENT TEATIMER.

This should stop the questions, but you realise that you have lost the realtime protection that you were being asked about.

Cheers

tg1911, you mentioned installing programs. I assume this goes for upgrades of various trusted programs and windows updates as well that might change registry entries. It would seem that checking the remember box should be the default so as to allow time to research any changes and to allow reversing our possible bad choices. Although I use a computer daily for both work and pleasure, I'm still pretty clueless when it comes to the registry etc. I suppose this bodes well for the future of bc

rowal5555, on May 2 2007, 10:45 AM, said:

I'm thinking maybe I'd be better getting Spybot off my computer rather than mess up the registry. If I do what you suggest wouldn't my AOL spyware just do the same as the Spybot without the teatimer thingy?

You don't need to remove Spybot, as it's still a good tool for doing the occasional scan, for malware.
Since no program will catch everything, it's a good idea to use several programs to detect, and remove, malware.
If AOL has a real time spyware scanner, then you can disable TeaTimer, as rowal5555 suggested, and just use Spybot, when you do your routine maintenance scans.


mightyvh,

Quote

Correct.

It's when your surfing the web, and the registry change warning pops up, that you want to Deny the change.
This indicates, there is something that the site is trying to install on your computer, without your knowledge.

Quote

I assume you're talking about having Deny, and the remember box, checked, by default.
The problem with that, is say you're installing a Windows update, that requires a registry change.
If it was denied, and the decision remembered, you would have to go into the White & Black List, remove the entry, then go back and reinstall the update, because by not allowing the registry change the first time, the update would have failed.
So, you end up having to install the update, twice, unless you forget to uncheck the remember box, then it becomes a vicious cycle of ..... install, remove from list, install, remove from list, install, ..........

If it's a trusted program, site, or update, Allow it.
If it's something unexpected, Deny it, and if you change your mind later, you can always go back, and remove it from the list.

In addition to TeaTimer, I use SpywareGuard, which performs basically the same function.
I have had instances, where TeaTimer catches things that SpywareGuard misses, and vise versa.
I use them both, to check up on one another.

Thanks again for the reply. I think I will take the suggestion of rowal5555 and put off the teatimer and yours also to leave Spybot so that I could run whenever. I might even go have a wee peek at the SpywareGuard you mention too

Thanks again everyone


Mod Edit: Edited to remove unnecessary quote. ~tg

This post has been edited by tg1911: 04 May 2007 - 02:52 AM

You're quite welcome, mischievous.
If there's anything else we can help you with, don't hesitate to ask.

Hi mischievous.

There is a sister programme to SpywareGuard called SpywareBlaster - http://www.javacoolsoftware.com/spywareblaster.html.
I use both of these together with Spybot and SuperAntispyware Pro, which seems to do the trick.

Cheers

rowal5555, on May 4 2007, 09:14 AM, said:

I've had a look at both mentioned sites and will download them later today. I've also stopped teatimer but now know I can still run it along side AOL spyware.I think what I'm being adviced to do is run a few different programs so will give it a try. What always showed up in both AOL and Spybot were tracking stuff and although both programs seemed to block them, five minutes later if I ran either program the same stuff was back and I wondered why bother! I thought these programs once allowed to block a site would stop it for all times in the future too.

One last point if I may. I have read on here "NOT" to have two different anti-virus programs as they could conflict with each other and have also read post's that offer hints on safety for your computer, so my question is this, when I have more than one Spyware program downloaded, do I have to turn Aol or others off when I am running whichever one I pick to use?

I know, I don't ask much....do I

The tracking stuff that keeps coming up are probably tracking cookies. While they may be considered an invasion of privacy, they are not harmful to your system.

From Wikipedia:

Quote

That is correct. You must have ONE Firewall and ONE AntiVirus only. Then you can have as much antispyware as you are comfortable with, and your system will handle. You will get varying advice on this matter so you try various things and go with what works for you.

[quote name='Budapest' date='May 4 2007, 09:48 AM' post='513266']
The tracking stuff that keeps coming up are probably tracking cookies. While they may be considered an invasion of privacy, they are not harmful to your system.

OK so on one of my Spyware programs I have to click if I want it to show tracking cookies, if I uncheck this box then these won't show up, right? Thanks for the info about the cookies. I only really want to make sure there is nothing harmful getting on my computer and it looks like this is nothing to worry about.

I personally keep Tea-timer on and advise to do so, although it is not needed it is a handy tool.

If i can just add mischievous, if you follow the route rowal5555 walked you through in turning off Tea-timer protection, just have a browse in the option of 'Start Up' programmes on your way there.

That will contain a list of the programmes that start up when you PC does, these are there because they place themselves in the start up of your registry, these listed items are what Tea-timer was popping up and warning you about. Now most in there will have ome strange name or a combination of letters or digits, and will not make any sense to you, but open up google and type each one in one by one and do a search. You will find many results pop up for websites that offer you the answer as to what the item is and what it is needed for. You will tend to find this will give you the answer to knowing if your entry is safe or not.

Dont just go with the first result you find on google, it may just be a link to a web that suggests it could be a virus, scroll through the list read the short term responses, you will find most if not all are harmless and just running from programmes you have added.

If you find everything is fine, then jsut go to the option of turning Tea-Timer off, do so, then turn it back on again. It will refresh the pop ups you keep getting and, will only pop up again if you install a programme or update Windows. If you know this is happening, then allow it. If you get one pop up at random, then thats when you use caution, and when it does pop up, keep it on the screen, open up your browser and search for whatever it is trying to install itself in your registry, that way you will have a good idea if you should allow it or not, its worth doing this instead of just saying NO, because it maybe a value a perfectly genuine programme already on your system is updating, and as always, if you have anymore questions or just not sure what to allow or deny, then just come back to BC and someone here will help you out.

Happy Surfing