View Full Version : SB resident not working with FireFox
I have had SpyBot for quite a while now. I think I was using IE when I first downloaded it if that makes any difference.
Anyway. I noticed today when I check the settings tab on the icon in the sys tray, there are no listings in either "alllowed processes" tabs.
I'm not sure its even running when I use Firefox. By that I mean I have never had an alert or alarm regarding a website or intrusion. And again there are no listings of any "allowed or blocked" processes or registeries.
So,.... Is it working with Firefox???
Thx
md usa spybot fan
2006-12-18, 05:56
There are entries in "Allowed processes" or "Blocked processes" only if you have received a process termination dialog from TeaTimer and overridden the default option for handling that process.
If you have never received a process termination dialog from TeaTimer similar to the following:
Spybot - Search & Destroy
Spybot - Search & Destroy has encountered and
terminated a process that is listed as part of a
malicious software.
Process ID: xxxx
Filename: xxxxxxx.exe
Found in: C:\nnnnnnnnnnnnnnnnnnn\nnnnnnnnn\
Identified as: xxxxxxxxxxxxxxx
If Spybot - Search & Destroy encounters this process again..
● Inform me again
○ Automatically kill this process
○ Allow this process to run (NOT RECOMMENDED)
■ Delete the associated file
Or if you did receive such a dialog and did not change the default option from "Inform me again" to either "Automatically kill this process" or "Allow this process to run (NOT RECOMMENDED)" then there will be no entries in "Allowed processes" or "Blocked processes".
I don't know if this answers your question or not, but I don't ever remember getting any messages or overriding any. And I don't think I have allowed any processes to run that SB brought to my attention as a potential threat. In fact I have never gotten a warning from SB that I can remember
Where would I go to check the settings you referred to?
md usa spybot fan
2006-12-18, 16:33
pegs1:
There are actually two Spybot resident programs:
Resident "SDHelper" (Internet Explorer bad download blocker).
Resident "TeaTimer" (Protection of over-all system settings).
The Resident "SDHelper" is based on a Browser Helper Object and therefore only works with Internet Explorer. The primary purpose of SDHelper is to block selected third party (tracking) cookies. The blocking of third party cookies can be accomplished in Firefox by following the instructions in the FAQ here:
Why do other anti-spyware applications detect so many more tracking cookies?http://www.spybot.info/en/faq/37.html
Resident "TeaTimer" has two functions:
TeaTimer's process monitor - TeaTimer monitors processes that are initiated in the system. If the process being initiated matches a list of known malicious processes in Spybot's detection files, the process is terminated and a dialog is issued to notify you and allow you to make choices as to how to handle the same process during future detections.
It immediately detects known malicious processes wanting to start and terminates them giving you some options how to deal with this process in the future: You can set TeaTimer to:
Inform me again.
Automatically kill this process.
Allow this process to run (NOT RECOMMENDED).
There is also an option to:
Delete the associated file.
TeaTimer's registry monitor - TeaTimer also monitors changes to certain critical registry keys such as System Startup, ActiveX Distribution Unit, Browser page and Browser Helper Object, etc. When any change is detected to these Registry keys a pop-up dialog is issued asking you to "Allow" or "Deny" the change and if you want TeaTimer to remember that decision so the same action is taken in the future.
Resident TeaTimer is not browser dependant. It works regardless of the browser you use although some of the registry key that it monitors in the registry monitor function are Internet Explorer related and are not used in FireFox.
When you right click on Spybot's system try icon and select Settings it brings up TeaTimer's "White & Black List". There are four (4) buttons:
Allowed processes
Blocked processes
Allowed registry changes
Blocked registry changes
The lists displayed by the first two (2) buttons, "Allowed processes" and "Blocked processes", are only populated if you receive a process termination dialog and override the default option of "Inform me again". If you select "Automatically kill this process" an entry would be place in "Blocked processes". If you select "Allow this process to run (NOT RECOMMENDED)" and entry would be placed in "Allowed processes".
The lists displayed by the second two (2) buttons, "Allowed registry changes" and "Blocked registry changes", are only populated if you receive a registry change dialog and checked "Remember this decision" when answering the dialog with either "Allow change" or "Deny change".
The list of processes that TeaTimer terminates as well as the list of registry keys that TeaTimer monitors are internal to TeaTimer and can not be displayed using the "White & Black List".
Well...I guess since I don't have anything listed in the Black and white lists ....thats a good thing?????
spybotsandra
2006-12-19, 09:38
Hello,
Then you did not click remember this decision.
There is only something in the black or whitelist when you have done that.
Best regards
Sandra
Team Spybot
Sorry for being so dense, but can I check somewhere to see if I did that?
md usa spybot fan
2006-12-19, 16:14
You already have! From your first post:
... there are no listings of any "allowed or blocked" processes or registeries.
Hold the phone.
Just by coincedence I was updating my display drivers today and got a message from SB. I have seen it a couple of times of before and the problem associated with it. Just never had the time to chase it down.
Here is the problem. When the window pops up and says there was a change to my registry or whatever. The screen itself isn't big enough for the information being displayed. I can drag the box sideways to make it longer, but I can't make it any taller. So whatever is listed below "old something" I can't see. I'm guessing its asking for permission, but I can't see any buttons. The only thing I can do is X close it. Which I'm guessing results in the change being denied.
I say that because since I deleted my old Display drivers and tried to install new ones my display is about windows 95 on my xp.
Any idea what I need to do to fix that pop up window?
md usa spybot fan
2006-12-20, 01:56
There is currently a bug in TeaTimer 1.4. Portions of TeaTimer's popup dialog overlay the "Allow change" and "Deny change" buttons. On my system the very top edges of the "Allow change" button (on the left) and "Deny change" button (on the right) are showing and I am still able to select the options. I also can check "Remember this decision" since it is visible. If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change". Note: If you close the dialog without answering "Allow change" or "Deny change" the registry change is denied.
If you can't deal with the problem that way until it is fixed, you can:
Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
Solution to fix the pop-ups in TeaTimer
http://forums.spybot.info/showthread.php?t=122
There are three (3) fixes published in that thread. They are:
The ResHacker fix published by ElPiedra (http://forums.spybot.info/member.php?u=128) here:
http://forums.spybot.info/showpost.php?p=423&postcount=1
The murdo (http://forums.spybot.info/member.php?u=440) patch published here:
http://forums.spybot.info/showpost.php?p=775&postcount=9
Also republished by RuggeR29 (http://forums.spybot.info/member.php?u=7292) (which I have never tried) here:
http://www.fureyonline.com/downloads/patch.zip
The patch originally by SyreneD (http://forums.spybot.info/member.php?u=1735) that I published here:
http://forums.spybot.info/showpost.php?p=2670&postcount=38
Also republished by SyreneD (http://forums.spybot.info/member.php?u=1735) himself here:
http://forums.spybot.info/showpost.php?p=23575&postcount=125
Disable TeaTimer as follows:
Go into Spybot > Mode > Advanced Mode > Tools > Resident.
Uncheck the following:Resident "TeaTimer" (Protection of over-all system settings) Active.
There is also a beta test version of TeaTimer that appears to resolve the problem. See:
Announcing betas: TeaTimer / Scan engine / Vista integration
http://forums.spybot.info/showthread.php?t=9474
********************
Notes about the patches (b. and c. above):
If you installed Spybot in the default location:
C:\Program Files\Spybot - Search & Destroy
The following patch (c.) defaults to that location:
The patch originally by SyreneD (http://forums.spybot.info/member.php?u=1735) that I published here:
http://forums.spybot.info/showpost.php?p=2670&postcount=38
Also republished by SyreneD (http://forums.spybot.info/member.php?u=1735) himself here:
http://forums.spybot.info/showpost.php?p=23575&postcount=125
If you use the following patch (b.) you have to navigate to the correct location (See Note #1) unless you execute the patch from within the "C:\Program Files\Spybot - Search & Destroy" folder:
The murdo (http://forums.spybot.info/member.php?u=440) patch published here:
http://forums.spybot.info/showpost.php?p=775&postcount=9
Also republished by RuggeR29 (http://forums.spybot.info/member.php?u=7292) (which I have never tried) here:
http://www.fureyonline.com/downloads/patch.zip
Note# 1: To the right of the Target File (TeaTimer.exe) there is a button that looks like "[ . . . ]". Click on that button, navigate to the correct folder, click "Open" and then "Start".