Teatimer doesn't see Webshots launcher

[rosawoodsii]

I use Webshots as my wallpaper, but I do not want it to start when I reboot. I can't find where it makes the change, and TeaTimer doesn't see it. WHY?

I also can't find how to change the whitelists and blacklists manually. Can anyone help me with these (related) problems?

[md usa spybot fan]

rosawoodsii:

...

I also can't find how to change the whitelists and blacklists manually. Can anyone help me with these (related) problems?

In TeaTimer 1.5:

If you check "Remember this decision" on a registry change, the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" similar registry changes for all future changes. To edit that information:

• Right click on the TeaTimer system tray icon (labeled "Spybot-SD Resident") and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
  
  • Allowed registry changes
  • Blocked registry changes
  • Allowed processes
  • Blocked processes
• You can review all the entries that you have stored by clicking on these buttons. If entries you are interested in are for registry changes, the entries that you should review are in "Allowed registry changes" and "Blocked registry changes".
• You can delete stored entries by clicking on the scripted black "X" to the right of the entry that you want to delete, answering "Yes" to the confirmation dialog and then clicking the "OK" button when you're done.

[rosawoodsii]

I'm familiar with all that you mention. However, Teatimer NEVER SEES Webshots making the registry change, so never gives me the dialog window to approve or disapprove the change, and when I go into the black and white lists, it's not there. I was hoping I could add it to the blacklist manually. Any way to do that?

[spybotsandra]

Hello,

It is also possible to manually add the TeaTimer blacklist.
You can write your own custom .sbi files, which are used by the Resident TeaTimer for blocking as well.
For more informations please have a look at this thread in our forum:
http://forums.spybot.info/showthread.php?t=15291

Best regards
Sandra
Team Spybot

[md usa spybot fan]

rosawoodsii:

I don't use Webshots, so I am not entirely sure if this will help. Using Google, I have noted that many HijackThis logs appear to have the following registry entry:

• "Webshots.lnk"="C:\Program Files\Webshots\Launcher.exe"

Since you mentioned "Launcher", I assume that this is the startup entry that you would like to eliminate.

There are several ways to do that.

1. Using "msconfig":
   
   • Click Start > Run > Type "msconfig" (no quotes) » then click on the "OK" button.
   • When the System Configuration Utility opens go to the Startup tab.
   • Look for a Startup Item named "Webshots.lnk" and disable it by unchecking it and clicking the "Apply" button.
2. Using Spybot:
   
   • Go into Spybot > Mode > Advanced Mode > Tools > System startup.
   • Look for a Startup Item named "Webshots.lnk" and disable it by unchecking it.

[rosawoodsii]

Thank you. I've done both of those things. Unfortunately, each time I start webshots (which I want to do manually only), it changes the entries, so each time I have to change either msconfig or system startup in Spybot S&D. The problem could be taken care of easily if only Teatimer would block the change to the startup file.

[md usa spybot fan]

rosawoodsii:

I don't quite understand what is keeping TeaTimer from recognizing the registry change. Although I don't know were that startup entry is being added in your system, I have added, deleted, disabled and enabled this entry:

"Webshots.lnk"="C:\\Program Files\\Webshots\\Launcher.exe"

To both of the following startup registry locations:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

Each time I add, delete, disable or enable the entry, I get a TeaTimer dialog for the change of the entry.

What version of Spybot - Search & Destroy are you running (Spybot > Help > About)?