TeaTimer

[mpossoff]

Hi all a friend of mine told me SB has real time protection called TeaTimer?

How do I access TeaTimer?

Marc

[md usa spybot fan]

To enable TeaTimer:
Go into Spybot > Mode > Advanced Mode (say "Yes" to the warning if necessary) > Tools > Resident.
Check the following:Resident "TeaTimer" (Protection of over-all system settings) Active.

Please note: There is currently a bug in TeaTimer 1.4. Portions of TeaTimer's popup dialog overlay the "Allow change" and "Deny change" buttons. On my system the very top edges of the "Allow change" and "Deny change" buttons are showing and I am still able to select the options. I also can check "Remember this decision" since it is visible. If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change". If you close the dialog without answering "Allow change" or "Deny change" the registry change is denied. Note that if you close the popup dialog without answering it the registry change will be denied.

If you can't deal with the problem that way until it is fixed, you can:
Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
Solution to fix the pop-ups in TeaTimer
http://forums.spybot.info/showthread.php?t=122
Disable TeaTimer as follows:
Go into Spybot > Mode > Advanced Mode > Tools > Resident.
Uncheck the following:Resident "TeaTimer" (Protection of over-all system settings) Active.

[mpossoff]

I'm not too verse with computers...are you saying that it may do some harm?

Not sure what you're saying.

Marc


To enable TeaTimer:
Go into Spybot > Mode > Advanced Mode (say "Yes" to the warning if necessary) > Tools > Resident.
Check the following:Resident "TeaTimer" (Protection of over-all system settings) Active.

Please note: There is currently a bug in TeaTimer 1.4. Portions of TeaTimer's popup dialog overlay the "Allow change" and "Deny change" buttons. On my system the very top edges of the "Allow change" and "Deny change" buttons are showing and I am still able to select the options. I also can check "Remember this decision" since it is visible. If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change". If you close the dialog without answering "Allow change" or "Deny change" the registry change is denied. Note that if you close the popup dialog without answering it the registry change will be denied.

If you can't deal with the problem that way until it is fixed, you can:
Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
Solution to fix the pop-ups in TeaTimer
http://forums.spybot.info/showthread.php?t=122
Disable TeaTimer as follows:
Go into Spybot > Mode > Advanced Mode > Tools > Resident.
Uncheck the following:Resident "TeaTimer" (Protection of over-all system settings) Active.

[stevek]

No it will not do harm. The "bug" is in the graphics not displaying properly in the teatimer popup. The teatimer program functions properly.

The "solution to popups in teatimer" thread that MD USA referenced above explains it.

Also, if my memory is correct, the installation of Teatimer is not default. A box needs to be checked during installation in order to install Teatimer.

[mpossoff]

what are the advantages and disadvantages of TeaTime?

Should we have it activated?

And...now I have a SB icon near my clock in the bottom right hand corner with a "lock" icon over the SB icon.

Marc

[md usa spybot fan]

what are the advantages and disadvantages of TeaTime?
TeaTimer in general:

There are two distinct functions within TeaTimer. One is rule based the other is not:
TeaTimer Processes Monitor (Rule based).
TeaTimer monitors processes that are called or initiated in the system. If the process being called or initiated matches a list of known malicious processes in Spypot’s detection files, the process is terminated and an alert is issued to notify you and allow you to make choices as to how to handle the same process during future detections. TeaTimer terminates the application before asking because threats like toll dialers are time critical - they have to be terminated before they can connect.


TeaTimer Registry Monitor (Not rule based).
TeaTimer monitors approximately 35 registry keys. If any change is made to one of the registry keys that TeaTimer is monitoring it appears that the change is actually made to the registry. When TeaTimer recognizes that the change has been made it checks to see if there is a stored "Remember this decision" entry that covers the change. If there is, TeaTimer uses that information and just issues a pop-up notification of the action it took. If not a TeaTimer popup dialog is issued. If you "Allow change" the change nothing is done. If you "Deny change" the change the registry change is reversed (note if you exit out of the pop-up dialog it arrears that TeaTimer denies the registry change (reverses it). Checking the "Remember this decision" option during the popup dialog stores the information for that change so that similar changes in the future will be handled automatically. After you answer the pop-up dialog TeaTimer issues a pop-up notification of the action you took.

You cannot reverse any Registry change decisions ("Allow change" or "Deny change") that you make with TeaTimer. You have to redo whatever you were doing so that the Registry change is done again (or manually edit the Registry). That is why it is important to remember that:
If you allow all changes, you would be no worse off than if I didn't have Teatimer Enabled at all.
If you deny the wrong change you can adversely affect the stability, functionality and security of your system.


Should we have it activated?
TeaTimer is an Advanced mode feature. Don't take the warning that you receive when going into Advanced mode lightly.


Warning

The advanced mode of Spybot-S&D offers more options than the default mode; but those also include
some that can do harm to your system if you are not sure what you are doing.
Do you really want to switch to advanced mode?
[Yes] [No]

And...now I have a SB icon near my clock in the bottom right hand corner with a "lock" icon over the SB icon.
The system tray icon that you are describing is TeaTimer's system tray icon. Right clicking on the icon displays options for controlling various features of not only TeaTimer but also other features of Spybot.

[mpossoff]

Hi all not very computer literate and would to ask some questions.

I have SB now.

TeaTimer is set.

Do we still have to scan w/SB even though we have TeaTimer on?

In other words my perception is since I have TeaTimer on I'm under the impression SB is on real time prevention without having to manually scan?

Also since TT is on do we have to manually update?

One more question...

In Immunize I'm trying to "check" Browser Helper but for some reason I'm not able to. I keep clicking in the box but no check mark is appearing.

Marc

[mpossoff]

I'm not following you.

You said "TeaTimer is an Advanced mode feature. Don't take the warning that you receive when going into Advanced mode lightly."

My question is as someone who isn't much computer literate but wants my pc protected as best as possible is should I have TeaTimer activated or not? I've had it activated since I first installed SB.

Marc


TeaTimer in general:

There are two distinct functions within TeaTimer. One is rule based the other is not:
TeaTimer Processes Monitor (Rule based).
TeaTimer monitors processes that are called or initiated in the system. If the process being called or initiated matches a list of known malicious processes in Spypot’s detection files, the process is terminated and an alert is issued to notify you and allow you to make choices as to how to handle the same process during future detections. TeaTimer terminates the application before asking because threats like toll dialers are time critical - they have to be terminated before they can connect.


TeaTimer Registry Monitor (Not rule based).
TeaTimer monitors approximately 35 registry keys. If any change is made to one of the registry keys that TeaTimer is monitoring it appears that the change is actually made to the registry. When TeaTimer recognizes that the change has been made it checks to see if there is a stored "Remember this decision" entry that covers the change. If there is, TeaTimer uses that information and just issues a pop-up notification of the action it took. If not a TeaTimer popup dialog is issued. If you "Allow change" the change nothing is done. If you "Deny change" the change the registry change is reversed (note if you exit out of the pop-up dialog it arrears that TeaTimer denies the registry change (reverses it). Checking the "Remember this decision" option during the popup dialog stores the information for that change so that similar changes in the future will be handled automatically. After you answer the pop-up dialog TeaTimer issues a pop-up notification of the action you took.

You cannot reverse any Registry change decisions ("Allow change" or "Deny change") that you make with TeaTimer. You have to redo whatever you were doing so that the Registry change is done again (or manually edit the Registry). That is why it is important to remember that:
If you allow all changes, you would be no worse off than if I didn't have Teatimer Enabled at all.
If you deny the wrong change you can adversely affect the stability, functionality and security of your system.


TeaTimer is an Advanced mode feature. Don't take the warning that you receive when going into Advanced mode lightly.


Warning

The advanced mode of Spybot-S&D offers more options than the default mode; but those also include
some that can do harm to your system if you are not sure what you are doing.
Do you really want to switch to advanced mode?
[Yes] [No]

The system tray icon that you are describing is TeaTimer's system tray icon. Right clicking on the icon displays options for controlling various features of not only TeaTimer but also other features of Spybot.

[md usa spybot fan]

Do we still have to scan w/SB even though we have TeaTimer on?

In other words my perception is since I have TeaTimer on I'm under the impression SB is on real time prevention without having to manually scan?
TeaTimer only monitors registry changes it does not necessarily prevent malware from being downloaded. Yes you should still scan!

I suggest that you read the following which may help prevent infection:
So how did I get infected in the first place?
http://forums.spybot.info/showthread.php?t=279

Also since TT is on do we have to manually update?
Yes you should still update!


In Immunize I'm trying to "check" Browser Helper but for some reason I'm not able to. I keep clicking in the box but no check mark is appearing.
Is it possible that you are running from a Limited account that does not have authority to may changes such as adding a Internet explorer Browser Helper Object? Also, since you are running TeaTimer are you getting a pop-up dialog as follows and doing an "Allow change" on it?


Spybot - Search & Destroy

Spybot - Search & Destroy has detected an important
registry entry that has been changed

Category: Browser Helper Object
Change: Value added
Entry: {53707962-6F74-2D53-2644-206D7942484F}

[mpossoff]

Should TT be set or not is my question?

Marc


TeaTimer only monitors registry changes it does not necessarily prevent malware from being downloaded. Yes you should still scan!

I suggest that you read the following which may help prevent infection:
So how did I get infected in the first place?
http://forums.spybot.info/showthread.php?t=279

Yes you should still update!


Is it possible that you are running from a Limited account that does not have authority to may changes such as adding a Internet explorer Browser Helper Object? Also, since you are running TeaTimer are you getting a pop-up dialog as follows and doing an "Allow change" on it?


Spybot - Search & Destroy

Spybot - Search & Destroy has detected an important
registry entry that has been changed

Category: Browser Helper Object
Change: Value added
Entry: {53707962-6F74-2D53-2644-206D7942484F}