Black List

[Sundancer2008]

I keep getting notice that I have denied F0D4B239-DA4B-4DF-81E4-DFEE4931A4AA User-specific browser toolbar
and that it can be found in the 'black list'.

I need to know where I can find this list.

[md usa spybot fan]

Sundancer2008:

TeaTimer – Registry change Black and White list.

If you checked "Remember this decision" on a change the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" changes. To edit this information:Right click on the TeaTimer system tray icon (actually labeled "Spybot-SD Resident") and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":

Allowed processes
Blocked processes
Allowed registry changes
Blocked registry changes

Note: If you don't see all four buttons, try expanding the window to the right.

You can review all the entries that you have stored by clicking on these buttons. The entries that you should review are in "Blocked registry changes". You can delete entries by clicking on the scripted black "X" to the right of the entry that you want to delete and then clicking the "OK" button when you're done. This will in effect make TeaTimer forget what you told it to remember so that during future changes to these items TeaTimer will issue a pop-up dialog rather then just a notification pop-up.

[Sundancer2008]

Thank you for your prompt reply.

[Sundancer2008]

I still have a problem. I inadvertently denied Teatimer entry, am sometimes to quick on the trigger and deny what I should accept.

I did succeed in bring up Teatimer's White & Black List. However you said there should be 4 buttons across the top of the list but there are no buttons. At the top above the message I have 2 buttons "Help" and "Archive Log". I expanded my window but there are no buttons across the top of the list.

[md usa spybot fan]

Sundancer2008:

It sounds like you are in the Tools » Resident facility in the Spybot GUI rather than the Black and White list.

Try the instructions again (you don't even have to have Spybot itself running to edit the Black and White list).

[Sundancer2008]

Finally understoor your msge dated June 4 yesterday, low and behold found the Black&White list with the 4 buttoms. I could not understand what you meant by 'TeaTime system tray icon'. I used the icon in my toolbar, checked 'settings' and got the list. I this what you meant?

However the 'Blocked Registry changes' is blank. June 5/08 I denied the following: value "SpybotSD TeaTimer" (new date:"") deleted in System Startup user entry. But when I go on 'Resident" in "Tools" in the program it is there as well as in 'Block-notes'.

How do I remove the deny:
1. in the Black List?
2. in the Bloc-Notes

OR

Ifr I archive the log in the SpybotSD program, uninstall and reinstall would it cause TeaTimer to ask the question again as if it were the first time?

As you can see I am no computer wizard, got your instructions on June 4 and it took until June 17 to find the B&W List but am very willing to learn.

Thank you for your patience.

[md usa spybot fan]

Sundancer2008:

I'm sorry for confusing you by using the term "system tray". The notification area in the taskbar and is sometimes called the system tray:
Windows System Tray Icons
http://support.microsoft.com/kb/310578

Your last post prior to today in this thread (Black List (http://forums.spybot.info/showthread.php?t=29055)) was on 2008-06-07. Then you started another thread about problems uninstalling on 2008-06-08:
Problems uninstalling
http://forums.spybot.info/showthread.php?t=29235
In that thread, I attempted to clarify where TeaTimer's icon could be found:


… TeaTimer's icon is actually titled "Spybot-SD Resident" and should be present in the taskbar notification area (system tray). It looks like a document or window with a padlock in the lower left hand corner. Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident. ...
Again, I'm sorry for confusing you.

Now, you apparently still have a problem and I'm confused. You seem to indicate that TeaTimer may still be running and is denying registry changes based on your black list, because you reposted in this thread (Black List (http://forums.spybot.info/showthread.php?t=29055)). Yet in the other thread you started (Problems uninstalling (http://forums.spybot.info/showthread.php?t=29235)) and last posted to on 2008-06-09, it seemed that you were just trying to complete the uninstall of Spybot.

Please clarify if:
Spybot is still running in its entirety.
If only certain functions of Spybot are running, such as TeaTimer and/or SDHelper.
If you are still messages that registry changes are being "Denied" based on your black list.

[Sundancer2008]

md usa spybot Fan

Yes I did begin the threadBlack List. I tried you instructions but in the wrong place, I was in Spybot S&D in Resident, got a list of denies and allowed but not the 4 bottoms. It took until yesterday to finally, really by accident, to fine the System Tray.

In the meantime I lost patience and decided to uninstall the whole program. I couldn't even do that so on June 8 I began the thread Problems uninstalling.At this time I still could not fine Spybot's TeaTimer System Tray Icon and even less the Spybot -S&D Resident.

After I uninstall any program I go into remove/delete, my Program Files and Document Settings to be sure all has been erased. This is when I found out that not all traces were removed. It was then that I discovered that if I turned the file blue and clicked Delete File in the column on the left the file seemed to be deleted. I then reinstalled the program hoping this would change things. Also no, nothing changed so I did it several times to no avail.

All this brings me to the message I send you yesterday and this is all because I was embarassed to let you know that I could not understand your instructions. So lets forget my messages about uninstalling and work from my last message in this thread.

In you message you asked me to:
Please clarify if:
Spybot is still running in its entirety. seems to be - downloaded a profram and Spybot asked permission seceral times. Also did a scan this morning it seemed to be working fine.
If only certain functions of Spybot are running, such as TeaTimer and/or SDHelper. Went into Resident Log - Bloc-notes and there are addition of past 'ALLOWED OR DENY' for every day.
If you are still messages that registry changes are being "Denied" based on your black list. Yes, it says the following: value "SpybotSD TeaTimer" (new date "") deleted in System startup user entry.

I hope this helps to clear up the confusion for both of us.

[wyrmrider]

Sundancer
have you gone to the upper left of the opening screen and Mode>advanced?
then taken a look at the items in "settings"
ignore products should give you the control you might be looking for

then go to "tools"
check the boxes then check the list on the left to see what is excluded in HOST file etc- you can edit

take a look at "resident"
where you can toggle SD helper and TTimer
IE users can harden ie with IE tweeks
post back if you're interested and I'll walk you through it

lock control panel does prevent you to getting to "internet options" from within internet explorer- but this is not a bad thing as it prevents the baddies from doing it either
you just set a handy shortcut on your desktop accessing via control panel :)

[md usa spybot fan]

Sundancer2008:

Since "Blocked registry changes" is empty is this still occurring?


I keep getting notice that I have denied F0D4B239-DA4B-4DF-81E4-DFEE4931A4AA User-specific browser toolbar
and that it can be found in the 'black list'.

I need to know where I can find this list.

[Sundancer2008]

I keep getting notice that I have denied F0D4B239-DA4B-4DF-81E4-DFEE4931A4AA User-specific browser toolbar
and that it can be found in the 'black list'.

I need to know where I can find this list.


Sundancer2008:

Since "Blocked registry changes" is empty is this still occurring?

No, but I don't know exactly what I did. I think I 'archived log' in resident, in program not systems tray, and uninstalled but I am not sure. So it asked me if I wanted to allow or deny so now it is allowed with a remember.

[md usa spybot fan]

Sundancer2008:


No, but I don't know exactly what I did. I think I 'archived log' in resident, in program not systems tray, and uninstalled but I am not sure. ...

If while in Spybot » Mode » Advanced Mode » Tools » Resident, you then you clicked "Archive log" that action would normally rename the current Resident.log file to Resident.yymmdd-hhmm.log (where yymmdd-hhmm is the date-time of the archive). The next activity of TeaTimer should establish a new Resident.log file.

The current Resident.log file can be accessed by going into Spybot » Mode » Advanced Mode » Tools » Resident.

You should be able to access both the Resident.log file and the archived Resident.yymmdd-hhmm.log file(s) with either of these two methods:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Previous reports. Look for the Resident.log file or the Resident.yymmdd-hhmm.log file you are interested in. Highlight it and then open it.
Method 2
The Resident.log file and the Resident.yymmdd-hhmm.log files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows Vista:
C:\ProgramData\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the file you are interested in, double click on it and it should open with Notepad.

... So it asked me if I wanted to allow or deny so now it is allowed with a remember.
I strongly suggest that that you not use the "Remember this decision" option unless there is an extremely compelling that you have to. By "extremely compelling" I mean a repetitive registry change that you continually have to answer and have decided should be allowed and what to automatically allow.

There are dangers in using the "Remember this decision" option particularly with the "Deny change". I have seen where it prevents the correction of a wrong decision and also were it has sent TeaTimer into a repetitive loop because some other element of the change affecting the registry is checking if the change was made and then if not reissuing that change.

I personally have do not have any changes where I used the "Remember this decision" and are stored in either the "Allowed registry changes" or "Blocked registry changes" within TeaTimer's "White & Black List".

[Sundancer2008]

Sundancer2008:

Since "Blocked registry changes" is empty is this still occurring?


No it asked the question and I approved it this time but I don't know what I did to make this happen. Probably beginner's luck.

[Sundancer2008]

md usa spybot Fan

I would like to take the opportunity to thank you for your patience and let you know that I have made a special section in a binder for every bit of advice you have given me. You can be sure that I will never us 'Remember this decision' ever again.

Will now go and follow your last msge to the letter. However I think the best advice is not to use 'remember this decision'.