Help needed - registry entry changes

[BuBoo]

If you can help me I'd appreciate it. I'm technically challenged when it comes to this stuff. Here goes

I'm not sure if I updated my Spybot SnD last week or if that would have anything to do with this problem. However I continually get a popup warning that says:

Spybot Search & Destroy has dected an important registry entry that has been changed.

Category: System Startup global entry
Change: Value deleted

Entry: SpybotSnD
old data: "C:\Program Files\Spybot Search_Destroy\SpybotSD.exe"/autocheck

Then asks if I should allow or deny the change.

Yes, you guessed it -- I'm not sure what to do -- allow or deny?
So far I've been denying the change -- but something tells me I should be allowing a change???

[md usa spybot fan]

BuBoo:

That the time you received the TeaTimer dialog message about the registry change, were you attempting to schedule an automatic startup of Spybot at logon with an automatic scan (Check for Problems)?

If not what were you doing when the message first appeared?

__________

If you were attempting to schedule an automatic startup of Spybot at logon with an automatic scan, than you should do an "Allow change" on that particular change.

[BuBoo]

Thank you for responding so quickly.
So -- first off -- just to educate myself, the dialogue box I saw is called the Tea Timer dialogue message. Correct?

Secondly, I vaguely remember updating Spybot S&D to version 1.5.2 last week. Ever since then spybot has been running its scan program immediately upon my logging on to my computer each day.

This 'TeaTimer dialogue message' started yesterday. I was looking at a site and suddenly received a message that Spybot S&D - IE helper has detected an URL that is known as a malicious resource. It names the malicious resource URL as http: // served by: advertising.com/site = 746723 and identifies it as : 'Advertising . com. That particular message now keeps popping whenever I go to my yahoo account and asks if I should allow or deny -- I think I should deny.

Other than that -- I can't think of what else I was doing when I received the Tea Timer dialogue message about the registry change.

So -- I although I'm still a bit in the dark, I hope this helps to narrow down
what action I should take -- allow or deny?

P.S. is there a way to get rid of malicious resource URL's?

Thanks md usa spybot fan -- muchly appreciate any assistance you can provide.

[md usa spybot fan]

Thank you for responding so quickly.
So -- first off -- just to educate myself, the dialogue box I saw is called the Tea Timer dialogue message. Correct?

Correct, the registry change dialog is issued by TeaTimer.

Ever since then spybot has been running its scan program immediately upon my logging on to my computer each day.

To stop that behavior, go into Spybot » Mode » Advanced mode » Settings » Settings. In the option tree under "Automation", look at the "Program start" and "System start" settings. To return the those settings to their default values, uncheck everything under "Program start" and under "System start" make sure that only "No automation" is selected:

Automation
├─ Program start
│ ├─ □ Run check on program start.
│ ├─ □ Fix all problems on program start.
│ ├─ □ Rerun checks after fixing problems.
│ ├─ □ Immunize on program start if program has been updated.
│ ├─ □ Don't ask for fixing confirmation.
│ ├─ □ Wait a few minutes until starting the check.
│ ├─ □ Wait until specified programs have quit.
│ └─ □ Wait a few seconds if something else than spies were found.
├─ System start
│ ├─ ● No automation
│ ├─ ○ Automatically run program at system startup.
│ ├─ ○ Run program once at next system startup.
│ ├─ □ Run check on program start.
│ ├─ □ Fix all problems on program start.
│ ├─ □ Wait a few minutes until starting the check.
│ ├─ □ Wait until specified programs have quit.
│ ├─ □ Wait a few seconds if something else than spies were found.
│ └─ □ Close if everything's O.K.

I was looking at a site and suddenly received a message that Spybot S&D - IE helper has detected an URL that is known as a malicious resource. It names the malicious resource URL as http: // served by: advertising.com/site = 746723 and identifies it as : 'Advertising . com. That particular message now keeps popping whenever I go to my yahoo account and asks if I should allow or deny -- I think I should deny.

If Yahoo works properly when you deny accessing those URLs than you can continue to deny them. In fact if Yahoo works properly when you deny the URLs you could automatically deny them without seeing the dialog by changing SDHelper to "Block all pages silently". To do that, go into Internet Explorer > Tools > select "Spybot – Search Destroy Configuration". Then in the "Spybot-S&D - Configuration" window in the "Settings" tab under "When encountering bad things" you can select among:

• Block all pages silently
• Display dialog when blocking
• Ask for blocking confirmation

Select "Block all pages silently".

[BuBoo]

Hello md usa spybot fan

Your instructions appear to be clear as a bell. I will try all of these and get back to you regarding the 'outcome'. Thank you soooo much. I will post your forum in my weekly newsletter to let others know how helpful you have been.

Appreciations