Resident Notification Question

[shelquis]

Each time I logon, I get a series of (currently six) small windows in the lower RH corner of my desktop, notifying me that Resident has allowed each of the (six) changes based on my white list. I haven't been successful in stopping those notifications. The Resident Log shows these six entries (which correspond to the six notification windows) for my most recent logon:

"6/12/2006 2:16:37 PM Allowed value "MSKDetectorExe" (new data: "C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup") changed in System Startup global entry!
6/12/2006 2:16:37 PM Allowed value "msci" (new data: "") deleted in System Startup global entry!
6/12/2006 2:16:37 PM Allowed value "Search Page" (new data: "http://www.google.com/") changed in Browser page!
6/12/2006 2:16:37 PM Allowed value "Search Page" (new data: "http://www.google.com/") changed in Browser page!
6/12/2006 2:16:37 PM Allowed value "Default_Search_URL" (new data: "http://www.google.com/") changed in Browser page!
6/12/2006 2:16:37 PM Allowed value "SearchAssistant" (new data: "http://www.google.com/") changed in Browser page!"

I tried to stop them by changing the entries for the last four in S&D Browser Pages. These are all Search related items. Before I made the change to Google (as presently shown), it was notifying about microsoft items in each of those four. I changed the four search related items from Microsoft to Google, checked Remember This and Approved the change in the S&D approval window that came up when I made each of the four changes. All that did was to change the notification from Microsoft to Google in those four items. I'm not sure how to fix the first two. In the Start Up list, there is no "msci" (and the notification says it was deleted). So how do I stop the notification? For the MSKDetector item, the startup page showed two, one was checked, one unchecked. I deleted the unchecked one. That didn't seem to have any effect on the Resident notifications. Would appreciate any help anyone can provide in eliminating these repetitive Resident Notifications. Thanks.

[md usa spybot fan]

shelquis:

Try refreshing TeaTimer's snapshots files and see if that gets rid of some of the messages you are getting at startup.

TeaTimer takes snapshots of Registry entries and compares these with the Registry at startup. Until these snapshots are updated you are likely to get pop-ups (at startup) of changes you made in the past. In other words, TeaTimer attempts to return the Registry to the state it was in when the snapshots were taken. This happens primarily when you reboot the system. To refresh TeaTimer's snapshot files:

• Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
  • TeaTimer closes.
  • TeaTimer's snapshot files are refreshed at this time.
• Restart TeaTimer:
  • Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
  • Double click TeaTimer.exe to start it.

This is speculation, but I believe this behavior is because of the following:

• It appears that when TeaTimer starts the snapshot files are read into memory and maintained there. The snapshot files only appear to be rewritten when TeaTimer closes. During system shutdown (or restart) it appears that TeaTimer is terminated before it has a chance to rewrite the snapshot files.

[shelquis]

Well, I'll be ...... Shutting down TeaTimer did it. When I read your post, I was skeptical because I had already taken a snapshot, a couple of times, of my system startup items when I was trying to figure this out. I did that by right clicking on the start up list in Tools. Those snapshots didn't fix the problem. They did eliminate the bold items each time, so I figured they were working. But turning off TeaTimer got rid of the logon notices I've been getting. Is turning off TeaTimer periodically a good practice? Does it cure other things too? Or is it something I should reserve for problems like my Notifcations that wouldn't clear? Thanks.

[Rednose]

You shut down TeaTimer, but did you restarted again as md usa spybot fan sugested ? Be sure you did/do that !

Greetz, Red.

[shelquis]

Yes, I followed instructions explicitly. They worked perfectly.

[Rednose]

Ok I just want to be sure that you did enable TeaTimer again, because that wasn't clear in your post

Greetz, Red.

[bitman]

shelquis: Another way to deal with this is to exit Teatimer just before you shutdown your PC for the night. Since this doesn't remove Teatimer from startup, it will run normally the next time you start Windows, so you don't have to browse to the Spybot folder to restart Teatimer manually.

Since these issues only occur when a significant registry modification occurs, you really only need to do it after such a notification is displayed.

[md usa spybot fan]

... I had already taken a snapshot, a couple of times, of my system startup items when I was trying to figure this out. I did that by right clicking on the start up list in Tools. Those snapshots didn't fix the problem.

The snapshot files for Spybot's Tools and TeaTimer are independent. They are all stored in one of the following folders:

• Windows 95 or 98:
  C:\Windows\Application Data\Spybot - Search & Destroy\Snapshots
• Windows ME:
  C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Snapshots
• Windows NT, 2000 or XP:
  C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots

The snapshots for the various Tools lists are:

• ActiveX
  
  • Code storage database.csv
• BHOs
  
  • Browser helper objects.csv
• System Startup
  • System startup.csv

The TeaTimer snapshots are series of .reg files stored in the same folder.

Is turning off TeaTimer periodically a good practice? Does it cure other things too? Or is it something I should reserve for problems like my Notifcations that wouldn't clear?

I personally only do it when I start getting notifications at system start (unless I'm experimenting for some reason). That's the only thing it cures as far as I know.

[shelquis]

[QUOTE=md usa spybot fan]The snapshot files for Spybot's Tools and TeaTimer are independent. QUOTE]

Thanks for the clarification. I had always assumed that taking a snapshot in any screen recorded the entire system, so it's good to know they're not. And thanks for the help in getting rid of the notifications.