How to get rid of undesired Resident popups

[raffnixpert]

When I login to one of my restricted accounts of my WinXP Professional I get 6 identical Resident popup boxes (the topmost of them blinking) with the following text:
_______________________________________

Resident

13:50 Registry change denied
Identified as: User blacklist

Resident denied the change of
DefaultUserName (category Winlogon) based on
your blacklist.
________________________________________

I cannot right-click on the S&D systray icon and select any of the appearing context menu items because they disappear within fractions of a second. What can I do to stop these popups?

[spybotsandra]

Hello,

TeaTimer takes snapshots of Registry entries and compares these with the Registry at startup. Until these snapshots are updated you are likely to get pop-ups (at startup) of changes you made in the past. In other words, TeaTimer attempts to return the Registry to the state it was in when the snapshot was taken. This happens primarily when you reboot the system. To refresh TeaTimer's snapshot files:

* Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
o TeaTimer closes.
o TeaTimer's snapshot files are refreshed at this time.
* Restart TeaTimer:
o Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
o Double click TeaTimer.exe to start it.

If you periodically recycle TeaTimer the problem will be diminished but not necessarily totally eliminated. As an alternative you can periodically just shut down TeaTimer as outlined above without restarting it just prior to shutting down the system to refresh the snapshot files.

Best regards
Sandra
Team Spybot

[raffnixpert]

Right clicking Spybot's TeaTimer System Tray Icon is not possible since "the appearing context menu items disappear within fractions of a second" as I wrote in my first post. So I have to Ctrl+Alt+Del to close TeaTimer. After restarting Spybot TeaTimer using Windows Explorer the popups have gone and will stay off as long as I do not login as Administrator.

Once having logged in as Admin and doing a Windows restart (Change of User) or a complete system restart, the subsequent login as the User having the described problem will again produce the known 6 identical Resident popup boxes (the topmost of them blinking) informing me of Resident's denial of the "change of DefaultUserName (category Winlogon) based on my blacklist".

I know from my other WinXP accounts that right-clicking on the TT systray symbol gives me access to TT's White and Black Lists and I have seen there under "Allowed Registry changes" references to Winlogon. If I were able to access these lists, perhaps deleting such item(s) could solve the problem? Since I cannot access these lists via the systray context menu could you tell me please how to do it in Windows Explorer?

[md usa spybot fan]

raffnixpert:

What version of Spybot are you running (Spybot » Help » About)?

__________

If you check "Remember this decision" on a change, the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" similar registry changes for all future changes. Normally to edit that information:Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
Allowed registry changes
Blocked registry changes
Allowed processes
Blocked processes
You can review all the entries that you have stored by clicking on these buttons.
Since you indicated that you can not access TeaTimer's "White & Black List", you can try to edit the information directly.

The information for TeaTimer's "White & Black List" is stored in one of the following directories:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Excludes
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Excludes
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes
Windows Vista:
C:\ProgramData\Spybot - Search & Destroy\Excludes
The files that store the related "White & Black List" information for the categories is as follows:
Allowed registry changes - RegKeyWhite.sbe
Blocked registry changes - RegKeyBlack.sbe
Allowed processes - ProcWhite.sbe
Blocked processes - ProcBlack.sbe