Resident denies Registry changes

[scotty_]

Spybot S&D 1.4 (detection update 2005-11-18)
Windows 98SE (IE 6.0)

For the last two months, each time I download to install, Resident pops up a window that it is denying the Registry change.
Here are two examples from the Resident Log.

22/11/05 23:32:23 Denied value "Zone Labs Client" (new data: "") deleted in System Startup global entry!

22/11/05 23:57:52 Denied value "{53707962-6F74-2D53-2644-206D7942484F}" (new data: "") added in Browser Helper Object!

I must have altered some setting because the previous entries all read "allowed value.......".

Could anyone advise me please? :)

[md usa spybot fan]

If you checked "Remember this decision" on a change the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" changes. Check and see if you have any entries stored for the registry entries that are being denied as follows:Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":

Allowed processes
Blocked processes
Allowed registry changes
Blocked registry changes

Note: If you don't see all four buttons, try expanding the window to the right.


You can review all the entries that you have stored by clicking on these buttons. The entries that you should review are in "Blocked registry changes". You can delete entries by clicking on the scripted black "X" to the right of the entry that you want to delete and then clicking the "OK" button when you're done. This will in effect make TeaTimer forget what you told it to remember so that during future changes to these items TeaTimer will issue a pop-up dialog rather then just a notification pop-up.

[scotty_]

Thanks for reply.

In my "White & Black List", there are no entries at all in any of the four lists.

FWIW
In the main display's "Tools" list, I have all options ticked except for the "Opt Out" one, and in "Tools"/"Resident" both the "SD Helper" and "Tea Timer" options are ticked.
In the Resident Log, the majority of entries prior to 12/9/05 show "allowed", but since then everything is "denied".

[md usa spybot fan]

If there are no entries in TeaTimer's "White & Black List", the only way that I know of that the changes to registry can be denied is by answering TeaTimer's pop-up dialog with "Deny change" or closing the dialog without selecting either "Allow change" or "Deny change".

[scotty_]

Thanks.
If I remember correctly, the pop-up doesn't ask - just states that it has denied the Registry change, then closes after a few seconds.

[aurorasb]

I, too, am having the problem with okay'ing or denying changes because the Resident pop-up only shows:

(a) remember
(b) info and
(c) a third button that's blank.

There's no way to allow a change!

Last evening while surfing the Resident popped up - and kept popping up - and allowed two changes. I'm unable to make any changes at this point as all are denied and I can't seem to make a change that would correct this problem.

Does anyone have any ideas as to how I can get a full Resident option screen and/or change a setting to somehow allow any changes I want to make?

Thank You

[md usa spybot fan]

aurorasb:

There is currently a bug in TeaTimer 1.4. Portions of TeaTimer's pup-up dialog overlay the "Allow change" and "Deny change" buttons. On my system the very top edges of the "Allow change" and "Deny change" buttons are showing and I am still able to select the options. I also can check "Remember this decision" since it is visible. If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change".

If you can't deal with the problem that way until it is fixed, you can:
Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
Solution to fix the pop-ups in TeaTimer
http://forums.spybot.info/showthread.php?t=122
Disable TeaTimer as follows:
Go into Spybot > Mode > Advanced Mode > Tools > Resident.
Uncheck the following:Resident "TeaTimer" (Protection of over-all system settings) Active.

[Skipper_Ro]

Right clicking on the Resident icon does bring up the white and black lists but they may/will appear blank unless you make them full screen and then magically the column labels and data appear. Clicking on the black Xs to the right deletes items.
Wish a bit more detail about this topic was in the tutorial and/or FAQs.

[scotty_]

Thanks, Skipper_Ro.

That's a great tip to remember - unfortunately, it shows my lists ARE actually empty.

So, I have downloaded ResHacker and used it as per "md usa spybot fan" 's tip and will just wait and see for now.

Watch this space...

[johnwrites]

Right clicking on the Resident icon does bring up the white and black lists but they may/will appear blank unless you make them full screen and then magically the column labels and data appear. .

Mine are blank even with fulll screen? I have version 1.4 fully updated

[md usa spybot fan]

Mine are blank even with fulll screen? I have version 1.4 fully updated
The information in the lists is only populated when you answer a TeaTimer pop-up dialog with "Remember this decision".

[scotty_]

My Resident pop-up is now offering a choice, and accepting "allow Registry changes" (happened twice during download of IE6 critical update just now) - that's a relief. :crowned:

I cannot remember if I changed any particular options, but right-clicking the Resident icon in the taskbar and selecting "Resident", shows a window with only two ticks - for "display dialog when blocking"and "use Resident in IE sessions".
In the main Spybot application, the window after selecting "Tools" and the"Resident" line has both options ticked for "SD Helper" and "TeaTimer".
Hope this helps anyone else afflicted .

( I have applied the TeaTimer pop-ups visibility solution suggested by MD USA SPYBOT FAN and it works well, thanks). :bigthumb:

[madysen]

I also have no data on the "Black and White" list screen. (I know I have selected "Remember this decision" before.)
Anyway, I downloaded the Critical Update to my Win98SE system today, but had the same problem as others here with the popup window. The change that the Windows Update wanted to apply was denied.

12/19/05 9:02:05 AM Denied value "wextract_cleanup0" (new data: "rundll32.exe C:\WINDOWS\SYSTEM\advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\TEMP\IXP000.TMP\"") added in System Startup global entry!

Any advice on how to allow this change is greatly appreciated! Thanks in advance.

[md usa spybot fan]

madysen:

There is no facility within Spybot/TeaTimer to reverse changes made to the registry. You have to redo whatever you were doing so that the Registry change is done again (or manually edit the Registry).

Although I can't be sure, the entry that was denied appears to be a something designed to finalize the update and cleanup your system.

The only suggestion that I have is:
To turn off TeaTimer:
Go into Spybot > Mode > Advanced Mode > Tools > Resident
Uncheck (if checked) the following:
Resident "TeaTimer" (Protection of over-all system settings) Active.
Make sure that TeaTimer is not running by checking for the TeaTimer System Tray Icon. If the icon is there:
Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident. TeaTimer should close.
Do a system restore to a point prior to installing the "Critical Update to my Win98SE".

Additional notes: TeaTimer Workaround/Fix

When the final version of Spybot 1.4 was released it unfortunately contained a defect in the code that displays the TeaTimer’s user interface for answering options in the registry change monitor portion of the program. The “Allow change” and “Deny change” buttons are not displayed properly in the pop-up dialog. On my system the very top edges of the "Allow change" and "Deny change" buttons are showing and I am still able to select the options (see the attachment for button locations). On some systems the "Allow change" and "Deny change" buttons are not visible at all. I also can check "Remember this decision" since it is visible (as can most people). If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change".

Please be aware that if you close TeaTimer's popup dialog without answering it, the registry change will be denied.

If you can't deal with the problem that way until it is fixed, you can:
Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
Solution to fix the pop-ups in TeaTimer
http://forums.spybot.info/showthread.php?t=122
Disable TeaTimer as follows:
Go into Spybot > Mode > Advanced Mode > Tools > Resident.
Uncheck the following:Resident "TeaTimer" (Protection of over-all system settings) Active.

[madysen]

Thank you for taking the time to help me.
A co-worker tells me I can't do a system restore since I have Win98..
But I will work on this tomorrow.
Wonder if the fact that this step in the Windows Update was not completed is a big deal?

[md usa spybot fan]

madysen:

I'm sorry, my mistake. I misread read your post. I was thinking that you had ME vs. SE. System restores are only possible with ME and XP. :o

[madysen]

Ok, thanks.
Should I try to manually change the Registry? Any tips so I don't royally mess things up?

[kawikasan]

Thank you for the help. Hope I can return the favor sometime soon.