used ResHacker-how can I reverse reg change?

[rambelmont]

Could not see full dialog box, so used ResHacker to fix that.

BUT I did not click "deny change" box before I closed TeaTimer - also did not click "remember decision".

So when I closed TeaTimer, it must have allowed the change. How I can locate the change and reverse it?

[md usa spybot fan]

rambelmont:

There is no automated process to reverse any Registry change decisions ("Allow change" or "Deny change") that you make with TeaTimer. You have to redo whatever you were doing so that the Registry change is done again (or manually edit the Registry).

In Teatimer 1.3 or 1.4, if you close TeaTimer's registry change dialog without answering "Allow change" or "Deny change" the registry change is denied.

To try and find out what registry entry may have been denied you must inspect Spybot's Resident.log. There are several ways to do that:

1. Right click on the TeaTimer (Spybot-SD Resident) system tray icon and select Show Log.
2. Go into Spybot > Mode > Advanced Mode > Tools > Resident.
3. Using Windows Explorer, navigate to the Resident.log file located in one of the following directories:
   
   • Windows 95 or 98:
     C:\Windows\Application Data\Spybot - Search & Destroy\Logs
   • Windows ME:
     C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
   • Windows NT, 2000 or XP:
     C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
   • Windows Vista:
     C:\ProgramData\Spybot - Search & Destroy\Logs
   
   Double click on Resident.log file and it should open with Notepad.

[rambelmont]

md usa

Excellent instructions - thank you.

You said that if the warning dialog closed before either box is chosen, then no change occurs. That made me think I was safe.

I did go to the resident log and it said:

8/24/2007 1:48:48 PM Denied value "ctfmon.exe" (new data: "") deleted in System Startup user entry!

Am I correct is translating this? The change was denied?

Thanks again for getting back so fast.
rambelmont

[md usa spybot fan]

Yes, the deletion of the startup entry for "ctfmon.exe" was denied.