Teatimer Whitelist issue

[jack_frost]

I will say upfront that I have already tried to get an answer to this question on the Castlecops Spybot forum, but I'm still in the dark. I am new to this whole forum thing, so I hope this is not regarded as unacceptable double posting. The real issue for me is trying to understand in more detail how the Whitelist operates and how to use it effectively - just as much as fixing the specific problem outlined below.

The issue:

I am trying to prevent realsched.exe (aka TkBellExe), the automatic update aspect of Realplayer, from automatically adding itself to system startup every time I open Realplayer. I was under the impression that Teatimer was meant to stop registry changes without permission.

However, Whenever I run msconfig and remove realsched from startup, I get a message from Teatimer saying: "Resident allowed the change of TkBellExe (category System Startup global entry) based on your white list."

However, as soon as I run Realplayer, realsched.exe is immediately added again to the allowed startup processes. I have tried unticking realsched from within system startup in Spybot, but exactly the same thing happens. As soon as I run Realplayer it reappears as a new allowed startup program in Spybot's system startup list.

I have tried deleting the following entry in the Whitelist of "allowed registry changes":
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe="C:\Program Files\Common Files\Real\Update_OB\Realsched.exe"

I would like to know how Realsched.exe got into my whitelist of allowed registry changes in the first place and how I get rid of them. I certainly can't remember ever giving Spybot permission to put them there and I can't work out how to add them to "Blocked registry changes" or "Blocked processes".

The "Resident" section of Spybot shows that I have removed Realsched from startup multiple times and that it is then immediately allowed again. The log of changes says:
13/12/2006 13:29:10 Allowed value "MSConfig" (new data: "") deleted in System Startup global entry!
13/12/2006 13:32:23 Allowed value "TkBellExe" (new data: ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot") added in System Startup global entry!
13/12/2006 13:38:25 Allowed value "TkBellExe" (new data: "") deleted in System Startup global entry!
13/12/2006 13:38:33 Allowed value "MSConfig" (new data: "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto") added in System Startup global entry!
13/12/2006 13:40:42 Allowed value "TkBellExe" (new data: "") deleted in System Startup global entry!
13/12/2006 13:40:49 Allowed value "MSConfig" (new data: "") deleted in System Startup global entry!
13/12/2006 13:41:48 Allowed value "TkBellExe" (new data: ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot") added in System Startup global entry!
13/12/2006 13:47:11 Allowed value "TkBellExe" (new data: "") deleted in System Startup global entry!
13/12/2006 13:48:09 Allowed value "MSConfig" (new data: "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto") added in System Startup global entry!
13/12/2006 15:08:38 Allowed value "PrevxOne" (new data: "") deleted in System Startup global entry!
13/12/2006 21:44:30 Allowed value "TkBellExe" (new data: "") deleted in System Startup global entry!
13/12/2006 21:47:48 Allowed value "MSConfig" (new data: "") deleted in System Startup global entry!
14/12/2006 08:47:14 Allowed value "TkBellExe" (new data: "") deleted in System Startup global entry!
14/12/2006 09:05:41 Allowed value "TkBellExe" (new data: ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot") added in System Startup global entry!
14/12/2006 09:07:22 Allowed value "TkBellExe" (new data: "") deleted in System Startup global entry!
14/12/2006 09:12:27 Allowed value "TkBellExe" (new data: ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot") added in System Startup global entry!

[jack_frost]

I forgot to put in my system information:
I am running Windows XP home SP2, Spybot + Teatimer, Zone Alarm free, AVG antivirus free, Superantispyware free, Spywareblaster and Sitehound toolbar. As far as I can see I am not running any other programs which may be protecting startup items.

[md usa spybot fan]

Information is added to Allowed registry changes (White List) if you checked "Remember this decision" when answering TeaTimer's registry change dialog with "Allow change".

To edit this information:Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":

Allowed processes
Blocked processes
Allowed registry changes
Blocked registry changes

Note: If you don't see all four buttons, try expanding the window to the right.

You can review all the entries that you have stored by clicking on these buttons.

Click on "Allowed registry changes" button. Locate the entry for:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"=""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot"

Delete the entry by clicking on the scripted black "X" to the right of the entry and then clicking the "OK" button when you're done. This will in effect make TeaTimer forget what you told it to remember so that during future changes to these items TeaTimer will issue a pop-up dialog rather then just a notification pop-up.

[PepiMK]

Hmmmm...
I doubt RealPlayer would add itself to our whitelist, since that would more or less classify it as malware (which some argument its anyway ;) ), so it was probably what md usa spybot fan described :)
But to hint about a feature of the new TeaTimer: it has also an improved detection there - if some application adds itself to TeaTimers whitelist file, TeaTimer ignores the change if it is running, or asks you if you want to re-verify all entries next time it is run (if it was not during the change).

[jack_frost]

Thanks for your replies - I thought you might be interested in the solution I have finally discovered from another source, which works perfectly:

1) Right click on the Spybot icon in your system tray and then click on settings, remove the TKBell entry under 'Allowed registry changes' by clicking on the cross after its name and click on ok.

2) Then go to the resident section in Spybot and turn Teatimer off and back on again, this will make it take a new system snapshot. The next time you get a pop up requesting permission for TKBell to run click on the box 'remember my decision' and then click the box to 'deny permission'. By doing this TKBell will be added to the 'Blocked registry changes' section (your Black List) in your settings and you should not have this problem any more.