[b19: Fixed] Registry Changes after closing Teatimer???

[doodleswest]

I am using the latest beta, RC1.5.2 on windows XP with IE7. I exited Spybot Resident via my system tray icon and restarted it by launching Spybot S&D. When I restarted it (and every time my PC boots now) I get about 5 weird Windows registry changes such as Local Page, Boot Execute, Excludefromknowndlls, with gibberish characters for the new values. I have tried deny and allow, but they keeps popping up. I have not tried "Remember this decision" as I don't know what is going on with this. HELLLLLP!!!! I get the same popups when I close and restart teatimer at anytime.

[doodleswest]

This ssems to be a bug, as closing teatimer should actually reset the snapshot and eliminate the same problem it seems to be causing. I verified my snapshots are being updated when I close and retart teatimer.

[doodleswest]

Can anyone reproduce this bug?

[md usa spybot fan]

Yes!!! There appears to a bug in TeaTimer 1.5.0.15 delivered with spybotsd152rc1.exe.

A portion of the Resident.log:

1/7/2008 1:16:26 PM Allowed (based on user decision) value "Local Page" (new data: "%SystemRoot%\system32\blank.htm") changed in Browser page!
1/7/2008 1:16:31 PM Allowed (based on user decision) value "BootExecute" (new data: "autocheck autochk *
lsdelete
") changed in Session manager!
1/7/2008 1:16:39 PM Denied (based on user decision) value "ExcludeFromKnownDlls" (new data: "") changed in Session manager!
1/7/2008 1:16:40 PM Denied (based on user decision) value "BootExecute" (new data: "autocheck autochk *
lsdelete
") changed in Session manager!
1/7/2008 1:16:41 PM Denied (based on user decision) value "ExcludeFromKnownDlls" (new data: "") changed in Session manager!

[doodleswest]

Thanks...thought I was going crazy. Teatimer also using over 30 Mb RAM! Is that normal?

[md usa spybot fan]

After exiting TeaTimer.exe, starting SpybotSD.exe should not start Teatimer.exe (it never did in the past but it does now with spybotsd152rc1).

The snapshot files themselves look ok on preliminary inspection, however after exiting TeaTimer.exe and starting SpybotSD.exe the newly initiated TeaTimer.exe appears to be either reading and translating the information from the snapshot files into gibberish or accessing information not actually read from the snapshot files.

[doodleswest]

TeaTimer.exe appears to be either reading and translating the information from the snapshot files into gibberish or accessing information not actually read from the snapshot files.

_______________________________________________

Yes and it doesn't stop even after re-booting and resetting the snapshots by closing teatimer and deleting them.

[md usa spybot fan]

Attached is a sample of one of the TeaTimer messages received.

[PepiMK]

Whether starting Spybot-S&D starts TeaTimer depends on whether you've got the checkbox inside Spybot ticked. That shouldn't be that new really.

But that gibberish... I'm right now looking at it!
I've noticed that directly after you accept the change, the snapshot files will be correct, but upon exiting TeaTimer, that gibberish is written. The source of the problem should thus be easily found I think.

update: found & fixed

[PepiMK]

The project tracker entry, including an updated TeaTimer.exe file to verify the fix:

TeaTimer shows non-existing changes on each start