PDA

View Full Version : Remember This



wk357mag
2007-01-03, 13:35
Since updating to the newest Beta (1.5 addon) Everytime I set my rig to do a checkdisc on next reboot, A popup window from TeaTimer comes up. No problem, but when I select the "Remember This" option and hit ALLOW button, it never remembers it.

PepiMK
2007-01-03, 14:10
If you right-click the TeaTimer icon, open the Settings window and there look at "Allowed registry changes", do you see one entry


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute=...

there?

Is it still there if you manually close and restart TeaTimer?

wk357mag
2007-01-03, 16:22
If you right-click the TeaTimer icon, open the Settings window and there look at "Allowed registry changes", do you see one entry

there?

Is it still there if you manually close and restart TeaTimer?

That HKEY isnt there, even after I set it to run disk check on next reboot. Though the popup window does show and continue as normal. I have included a screen shot of the ONE entry listed in the black/white list

wk357mag
2007-01-03, 16:49
wait, I made a mistake (its early here)

There is a long list of ALLOWED things. There is ALOT listed (screen shot)

PepiMK
2007-01-03, 17:39
Could you maybe upload that image to ImageShack or something and link to it? It's that small as an attachment that I can't read a single thing :D:

wk357mag
2007-01-03, 17:48
http://www.thatshisname.net/images/allowed.gif

Sorry, I didnt check that after I posted it

PepiMK
2007-01-04, 14:26
Hmmm...
Could this registry value be a REG_MULTI_SZ? That would explain the separated lines :sick: Will check!

update: for the display, it was "fixed" by displaying line breaks as backslashes. Even upon remembering, the form showed no line breaks. But after restarting TeaTimer it did, so we added the backslashes as linebreak indicators there as well. Should work now, let's see if I can still get it into tomorrows updates or one for the weekend maybe.

wk357mag
2007-01-04, 20:43
thanks for your time

wk357mag
2007-01-05, 15:51
http://www.thatshisname.net/images/1.gif

http://www.thatshisname.net/images/2.gif

The RED dot on pic#2 is the only thing that doesnt get repeated everytime. Other then that, each time I set it to do a scan on reboot, it will have a popup like pic#1 and I DO choose to remember!

BTW, I have gotten todays updates to include all the BETA ones as well.

Do you need any other info from me?

PepiMK
2007-01-05, 23:42
So that is with todays beta? Damn ;)
I tested it with a bunch of test keys without anything repeating :sick:
At least the entries now show up as correct lines in the whitelist...

Against those variants (items appearing in different order) I guess there's not a lot we could/should do - who knows when a changed order may be something one wants to actually know (anti-rootkit moved in load order to a later position or something). But the number of variantions there should be limited, so after remembering half a dozen or so, nothing further should come... I guess I'll have to check that PDBoot... maybe the way it reboot kills TeaTimer the hard way? TeaTimer will now save changes to the white/blacklists way more often, but I'll have to check that I guess...

wk357mag
2007-01-06, 00:43
Keep in mind that this remembered correctly, with older version.

PepiMK
2007-01-06, 19:30
Actually I'm not quite sure older versions supported REG_MULTISZ properly... it may have worked only because it just remembered the first line or so ;) Will have to look that up in the history...

wk357mag
2007-02-16, 14:16
Hey Pepi,

I find no issue with the 1.5.0.6 version

PepiMK
2007-02-17, 19:16
That's good to hear :)

Public release of the new TeaTimer should be T-4 days then probably :laugh:

nOInfectIOn
2007-02-17, 21:01
no issue with the 1.5.0.6 version
sounds perfect ;)

That's good to hear
sounds interesting :)
- parallel-universe, or am I to tired to find a link?

nOInfectIOn
2007-03-01, 21:32
...to tired...?
:), well, seems I´m still to tired... :)
Where is the download-link for TT 1.5.0.6?
Thx for help!

md usa spybot fan
2007-03-01, 21:57
nOInfectIOn:

To download (and install) the most resent ßTeaTimer 1.5 (teatimer1506):
Go into Spybot > Mode > Advanced mode > Settings > Settings.
Page down the option tree until you see a section titled "Web update" (just past half way down).
In the "Web update" section check the following option:
Display available beta versions.
Click Spybot-S&D (left pane).
Click "Search for Updates" (right pane).
When the list of available updates appears, check the following item:
ßTeaTimer 1.5 - !Resident protection update (1 MB) - 2007-02-14
Click Download Updates.

nOInfectIOn
2007-03-01, 23:14
@md usa spybot fan:

Herzlichen Dank (many thanks with heart) :)!

Your advisory was perfect!
Everything is working normal and fine (at the moment, after first reboot ;))