"DefaultUserName" changed in Winlogon!

[rchapman]

After installing 1.5.2 on Windows XP SP2, I started running resident protection (which I had never done under 1.4 or previous versions). After some time, "popups" started occurring concerning an important registry value (DefaultUserName) being changed in Winlogon! every time after another user had previously logged on and off. Whitelisting sometimes ALMOST worked (there was a notification but no manual input required) but mostly NOT and the whitelist entries would often disappear with alternating user logons. In desperation, I uninstalled 1.5.2 and reinstalled and the problem appeared to be solved for several days -- alas, now it has returned!
AFAIK DefaultUserName WILL be changed every time a different user logs on and I don't understand why 1.5.2 suddenly starts caring and why this change can't be ignored! This all may just be an artifact of my ignorance but I'd sure appreciate enlightenment so I can turn resident protection back on. Thanks.
(FWIW I have 1.5.2 installed on another Windows XP SP2 system but haven't seen this behavior there -- SO FAR!)

[rchapman]

Alas, both systems now nag about the DefaultUserName change in the registry.
I'm too lazy to reinstall 1.5.2 on either/both systems to see if that works (for a while) and have turned resident protection OFF! sigh!

[129260]

uninstall and reinstall and uncheck teatimer when you install the program. Those "POPUPS" you are getting are fine, just check mark remember, and then allow them. Its nothing to wry about. Its because you prob saved some settings when you logged off and such, or something was installed or uninstalled. Its nothing to wry about. Your system isn't being attacked. see this post: http://89.238.64.41/showthread.php?t=24266

hope that helps.

[rchapman]

> uninstall and reinstall and ...

Yes, I had already done that and it appeared to suppress the notifications for an indefinite period -- then they started up again.

> ... just check mark remember, and then allow them.

I have done that BUT the additions to the "white list" were NOT permanent! I had two users on the machine (Windows XP SP2) one with full administrative rights and one without. Both users had resident running at logon. The user with admin rights could accept the DefaultUserName change with "remember" checked and that entry would be added to the white list. When the non-admin user logged on there would be a notification of the DefaultUserName change. That user would allow the change with "remember" checked and, indeed, that entry would be added to the list (making two white list entries - one for each DefaultUserName value). When the admin user next logged on there would be a notification of the DefaultUserName change that required manual intervention and the white list would now be EMPTY.

I was able to contrive a scenario that included a logon with an appropriate white list entry to "remember" a previous accept of the registry change and THEN a notification "popped up" that the change was being "automatically accepted" (<- in my words . IMHO that notification is annoying and extraneous for an inherent Windows XP action that has been accepted once and I would prefer an option to ignore (or silently log) the registry value change!

I have the highest admiration for Spybot S&D but will not be running TeaTimer on any of my systems until the current registry change notification behavior is 'fixed' (for lack of a better word OR I find out what I've been doing wrong. Thanks for taking the time to reply.

[md usa spybot fan]

if you dont want teatimer on your system...

uninstall and reinstall and uncheck teatimer when you install the program.

> uninstall and reinstall and ...

Yes, I had already done that and it appeared to suppress the notifications for an indefinite period -- then they started up again. …

To deactivate TeaTimer (or activate TeaTimer if it was not activated during installation), it is not necessary to uninstall and reinstall Spybot.

To deactivate TeaTimer:

• Go into Spybot > Mode > Advanced Mode > Tools > Resident.
• Uncheck (if checked) the following:
  
  • Resident "TeaTimer" (Protection of over-all system settings) active.

To activate TeaTimer:

• Go into Spybot > Mode > Advanced Mode > Tools > Resident.
• Check (if unchecked) the following:
  
  • Resident "TeaTimer" (Protection of over-all system settings) active.

[129260]

but its still installed on his system just disabled, i just said if he fully wants to get rid of it he can uninstall and then when he reinstalls, uncheck teatimer. You can disable it though like you said. sry if what i said didn't make sense.

[Izibia]

I got this problem too: TeaTimer got the Alzheimer (the Black&White list is cleared repeatedly).

So is it a known bug? If so, is there a way how to get rid of it?
The 1.5.1 version is OK?

[md usa spybot fan]

129260:

but its still installed on his system just disabled, i just said if he fully wants to get rid of it he can uninstall and then when he reinstalls, uncheck teatimer.

You are not correct. TeaTimer is actually installed during the installation of Spybot regardless of the whether or not the following item is checked or unchecked in the "Select Additional Tasks" dialog during the installation:

• Use system settings protection (TeaTimer)

Checking that item starts TeaTimer at the conclusion of the installation and adds a startup entry so that TeaTimer will start in the future when that user logs on.

I will repeat. It is/was not necessary to uninstall and reinstall Spybot and doing that accomplished nothing that could not have been accomplished just by deactivating TeaTimer.

[129260]

that is true, deactivating would have done the same thing as uninstalling, i agree with you. I'm sry I recommended an uninstall when it was needed. My apologies.

[129260]

when it was unneeded*