allowed registry change pop-up

[codysmom]

Hi All....I need your help......
I've had AOL for years and Spybot since 2003--now with version 1.4 and regular updates.....
About a month ago, I installed an AOL Connectivity Update.....Since then, I get a TeaTime pop-up reminding me of the allowed registry change....This happens every time I log on to the computer....And of course, it's adding an entry in the TeaTimer log every time.....
I'd like to stop these pop-ups....I think I know how but I'd like confirmation etc....Here's what I think I need to do:
1----Rt Click Spybot in Sys Tray
2----Click EXIT Spybot S&D Resident
3----Using Windows Explorer, go to C>Prog>Spybot>TeaTimer
4----Double-click TeaTimer to re-start it
Is this right...??
Thanx

[md usa spybot fan]

Right.

If the cause of the problem is because TeaTimer's snapshot files are out of sync with the registry, that should solve the problem. If the reason that the messages are coming up is because AOL is re-adding the registry entry at each startup, it will not.

[codysmom]

I'll try the steps to see what happens....

Thanx for your help.....:)

[codysmom]

I followed the steps but ran into a puzzle.....:confused:

I share the computer with my husband....We each have a separate Windows Sign On (as well as separate Aol screen names etc)....

I was logged onto my Windows Sign On when I "Exited" the TeaTimer....I then logged off of My "side" and logged onto Husband's "side"....I wanted to see if I need to follow the same steps on his side etc......Once His Desktop came up, a Spybot pop-up appeared....It said---"Winlogon...Value changed...DefaultUser Name"......It also showed "old data" with my name and "new data" with his name.....I "X'd" the pop-up which 'denied' the change......

I logged off of Husbands and went back over and logged on to My 'side'.....No pop-up.....

I checked the TeaTimer log and found the following entry--

9/10/2006 6:12:19 AM Denied value "DefaultUserName" (new data: "Roy") changed in Winlogon!

***There are no further entries about the AOL Host etc...I've been back and forth between both Windows LogOns as well as logging onto AOL on both....So, I 'think' the AOL issue is ok......

But-now I'm facing how to handle resolution of the "DefaultUserName" issue...

Any suggestions will be greatly appreciated.....Thanx

[md usa spybot fan]

Other people have made the same observation when switching user accounts. See:
Teatimer reports account name change
http://forums.spybot.info/showthread.php?t=6074

[codysmom]

Thanx for the reference.....I was hoping it was gonna give me steps to resolve....Sadly, it didn't......

In my case, the pop-up is just with my husbands account...It doesn't happen when I log onto mine.....And, neither of us has checked the block "remember this change"......So, bringing up the Settings shows nothing in the Blocked Registry Changes category......

Any other suggestions.....??.........Thanx

[md usa spybot fan]

Actually the registry entry is changed when you logon back onto your account also. However, because TeaTimer's snapshot files contain your username in the "DefaultUserName" entry it is not recognized by TeaTimer as a change.

[codysmom]

Hi md usa spybot fan......That's what I thought.....So, should I start over again but this time Exit TeaTimer on each account before re-activating on each....??

Thanx for your reply and any additional help.....

[md usa spybot fan]

I do not think that you are going to be able get around the "DefaultUserName" change by refreshing TeaTimer's snapshot files. The value that is being changed is stored in the HKEY_LOCAL_MACHINE registry hive which is common to all accounts on the system. The TeaTimer snapshot file for this entry (RegGNTCVWL-Global.reg) is also common to all accounts. So no matter what user account you refresh TeaTimer's snapshot files from, the entry will contain that user's name (unless you logged on to that account using quick switch). Every time you logon to the other user's account (not using quick switch) TeaTimer will recognize it as a change.

I suggest that the next time you get a TeaTimer dialog message for "DefaultUserName" do an "Allow change" with a "Remember this decision" and just let the change occur in the future.

[codysmom]

Hi md usa spybot fan....

Was sure hoping you were gonna say that my suggestion would work....A girl can dream...!!!....

As much as I like Spybot (and it's added protection of TeaTimer), I must say each time I run into a problem it has to do with our 2 account set-up and/or TeaTimer.....ie---I even have to do scans on each account...

I have AVG and AdAware too and each of them handles everything from one account for the whole system......

I sure hope the next version of Spybot will eliminate this 'more than one account' problem....

Again, thanx for your help on this...

[codysmom]

Hi md usa spybot fan---again..

I re-read your response and it raises a question.....You said----"Every time you logon to the other user's account (not using quick switch) TeaTimer will recognize it as a change."........

I'm familiar with the "switch" feature but neither my husband nor I ever use it...We always 'totally' log off...In fact, the only time I go from one account to another is to do a Spybot scan.....

My point is---When you say ----"Every time you logon...etc.."----Are you saying we should have been getting the "DefaultUserName" pop-up all along since we don't use the "switch" feature....??....
We've never had the "DefaultUserName" pop-up until 9/10/06.....(the day I resolved the "Host Manager" pop-up caused by the AOL update).....

Sorry to drag this issue out like this...I just want to be sure I have a correct understanding of this......Thanx again and again.....I really appreciate you time on this.......

[md usa spybot fan]

codysmom:

A great deal of the following is speculation however I think it is factual.

It appears that when TeaTimer starts it reads the registry keys it is monitoring for changes and compares them with its snapshot files. Any discrepancies are handled by TeaTimer as changes to the registry. After this initial comparison with the snapshot files everything is handled in memory and the snapshot files are only rewritten when TeaTimer terminates.

The problem that you encountered with the AOL registry entry stemmed from the fact the TeaTimer's snapshot files were out of sync with the register because it appears that during logoff or system shutdown TeaTimer is terminated before the snapshot files are refreshed. You were able to correct this by refreshing the snapshot files.

It appears that the monitoring of the following registry entry was not one of the original registry entries monitored by TeaTimer:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"DefaultUserName"="username"
The monitoring of that registry entry appears that it may have been added with the 2006-05-05 updates (not really sure of the date). Although TeaTimer was monitoring that registry entry for changes, without a snapshot file of that registry entry to compare it against it was not recognizing changes to that registry entry at startup. By refreshing TeaTimer's snapshot files to fix the AOL entry problem you created the snapshot file that is now reporting the "DefaultUserName" change at startup.

If I am correct in my explanation of your observations, then you started using TeaTimer prior to when TeaTimer started monitoring the "DefaultUserName" entry on 2006-05-05 and the create date of the following snapshot file would be 2006-09-10 when you refreshed TeaTimer's snapshot files:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots\RegGNTCVWL-Global

[codysmom]

md usa spybot fan

You're absolutely right.....Upgraded to ver 1.4 (from 1.3) in Jan, 06 with TeaTimer turned on; doing updates monthly.....

Having done various 'installs' of software; updates; etc that involved turning TeaTimer off and back on...and never running into this problem, it now makes sense to find out one of the Spybot updates changed the way TeaTimer handles the snapshot files.....

So I guess it comes down to, as you suggested "accepting and remembering" the change and be done with it.......

Thanx for the explanation.....