Remember This

[wk357mag]

Since updating to the newest Beta (1.5 addon) Everytime I set my rig to do a checkdisc on next reboot, A popup window from TeaTimer comes up. No problem, but when I select the "Remember This" option and hit ALLOW button, it never remembers it.

[PepiMK]

If you right-click the TeaTimer icon, open the Settings window and there look at "Allowed registry changes", do you see one entry


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute=...

there?

Is it still there if you manually close and restart TeaTimer?

[wk357mag]

If you right-click the TeaTimer icon, open the Settings window and there look at "Allowed registry changes", do you see one entry

there?

Is it still there if you manually close and restart TeaTimer?

That HKEY isnt there, even after I set it to run disk check on next reboot. Though the popup window does show and continue as normal. I have included a screen shot of the ONE entry listed in the black/white list

[wk357mag]

wait, I made a mistake (its early here)

There is a long list of ALLOWED things. There is ALOT listed (screen shot)

[PepiMK]

Could you maybe upload that image to ImageShack or something and link to it? It's that small as an attachment that I can't read a single thing :D:

[wk357mag]

http://www.thatshisname.net/images/allowed.gif

Sorry, I didnt check that after I posted it

[PepiMK]

Hmmm...
Could this registry value be a REG_MULTI_SZ? That would explain the separated lines :sick: Will check!

update: for the display, it was "fixed" by displaying line breaks as backslashes. Even upon remembering, the form showed no line breaks. But after restarting TeaTimer it did, so we added the backslashes as linebreak indicators there as well. Should work now, let's see if I can still get it into tomorrows updates or one for the weekend maybe.

[wk357mag]

thanks for your time

[wk357mag]

http://www.thatshisname.net/images/1.gif

http://www.thatshisname.net/images/2.gif

The RED dot on pic#2 is the only thing that doesnt get repeated everytime. Other then that, each time I set it to do a scan on reboot, it will have a popup like pic#1 and I DO choose to remember!

BTW, I have gotten todays updates to include all the BETA ones as well.

Do you need any other info from me?

[PepiMK]

So that is with todays beta? Damn ;)
I tested it with a bunch of test keys without anything repeating :sick:
At least the entries now show up as correct lines in the whitelist...

Against those variants (items appearing in different order) I guess there's not a lot we could/should do - who knows when a changed order may be something one wants to actually know (anti-rootkit moved in load order to a later position or something). But the number of variantions there should be limited, so after remembering half a dozen or so, nothing further should come... I guess I'll have to check that PDBoot... maybe the way it reboot kills TeaTimer the hard way? TeaTimer will now save changes to the white/blacklists way more often, but I'll have to check that I guess...

[wk357mag]

Keep in mind that this remembered correctly, with older version.

[PepiMK]

Actually I'm not quite sure older versions supported REG_MULTISZ properly... it may have worked only because it just remembered the first line or so ;) Will have to look that up in the history...

[wk357mag]

Hey Pepi,

I find no issue with the 1.5.0.6 version

[PepiMK]

That's good to hear :)

Public release of the new TeaTimer should be T-4 days then probably :laugh:

[nOInfectIOn]

no issue with the 1.5.0.6 version
sounds perfect ;)

That's good to hear
sounds interesting :)
- parallel-universe, or am I to tired to find a link?

[nOInfectIOn]

...to tired...?
:), well, seems I´m still to tired... :)
Where is the download-link for TT 1.5.0.6?
Thx for help!

[md usa spybot fan]

nOInfectIOn:

To download (and install) the most resent ßTeaTimer 1.5 (teatimer1506):
Go into Spybot > Mode > Advanced mode > Settings > Settings.
Page down the option tree until you see a section titled "Web update" (just past half way down).
In the "Web update" section check the following option:
Display available beta versions.
Click Spybot-S&D (left pane).
Click "Search for Updates" (right pane).
When the list of available updates appears, check the following item:
ßTeaTimer 1.5 - !Resident protection update (1 MB) - 2007-02-14
Click Download Updates.

[nOInfectIOn]

@md usa spybot fan:

Herzlichen Dank (many thanks with heart) :)!

Your advisory was perfect!
Everything is working normal and fine (at the moment, after first reboot ;))